RHLW-2026-0F944E70846E7603 Lightwell Security Advisory: protobuf-kotlin 3.21.7.rhlw-00002

Red Hat Lightwell has released com.google.protobuf:protobuf-kotlin 3.21.7.rhlw-00002 with a backported security fix. CVE-2024-7254: Stack overflow in Protocol Buffers Java Lite This patched artifact is a drop-in replacement for com.google.protobuf:protobuf-kotlin 3.21.7 from Maven Central...

RHLW-2026-F2C01667A278F77C Lightwell Security Advisory: spring-websocket 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-websocket 5.3.18.rhlw-00010 with backported fixes for CVE-2025-41254 and CVE-2026-41838. This patched artifact is a drop-in replacement for org.springframework:spring-websocket 5.3.18 from Maven Central...

RHLW-2026-8EF16DDAA2E22182 Lightwell Security Advisory: spring-webflux 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-webflux 5.3.18.rhlw-00010 with backported fixes for CVE-2024-38816, CVE-2024-38819, CVE-2026-22735, CVE-2026-22737, CVE-2026-22740, CVE-2026-22741, CVE-2026-22745, CVE-2026-41839, CVE-2026-41840, CVE-2026-41841, CVE-2026-41842,...

RHLW-2026-8279A9B7F6BB0BE6 Lightwell Security Advisory: spring-messaging 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-messaging 5.3.18.rhlw-00010 with a backported security fix. CVE-2022-22971: In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of...

RHLW-2026-B9D35A62FC472CCA Lightwell Security Advisory: spring-jms 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-jms 5.3.18.rhlw-00010 with a backported security fix. This patched artifact is a drop-in replacement for org.springframework:spring-jms 5.3.18 from Maven Central...

RHLW-2026-80029B2333A1C4B6 Lightwell Security Advisory: spring-context 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-context 5.3.18.rhlw-00010 with backported fixes for CVE-2022-22968, CVE-2024-38820, and CVE-2025-22233. CVE-2022-22968: In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for...

RHLW-2026-A5EC8923604C1851 Lightwell Security Advisory: spring-beans 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-beans 5.3.18.rhlw-00010 with a backported security fix. CVE-2022-22970: In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely o...

RHLW-2026-6B59708C7ADB9EB8 Lightwell Security Advisory: spring 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring 5.3.18.rhlw-00010 with a backported security fix. CVE-2023-20860: Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in...

RHLW-2026-2CF5E53D95861E97 Lightwell Security Advisory: spring-security-saml2-service-provider 5.7.11.rhlw-00006

Red Hat Lightwell has released org.springframework.security:spring-security-saml2-service-provider 5.7.11.rhlw-00006 with backported fixes for CVE-2026-40988, CVE-2026-41003, and CVE-2026-41694. CVE-2026-40988: Unbounded DEFLATE Inflation in SAML 2.0 Service Provider CVE-2026-41003: Unencoded HTM...

RHLW-2026-351D5430E078D751 Lightwell Security Advisory: spring-security-crypto 5.7.11.rhlw-00006

Red Hat Lightwell has released org.springframework.security:spring-security-crypto 5.7.11.rhlw-00006 with a backported security fix. This patched artifact is a drop-in replacement for org.springframework.security:spring-security-crypto 5.7.11 from Maven Central...

RHLW-2026-C689B61FF2A020FA Lightwell Security Advisory: spring-boot-starter-actuator 2.7.18.rhlw-00004

Red Hat Lightwell has released org.springframework.boot:spring-boot-starter-actuator 2.7.18.rhlw-00004 with a backported security fix. CVE-2026-22733: Authentication Bypass under Actuator CloudFoundry endpoints This patched artifact is a drop-in replacement for...

RHLW-2026-11AB22698DD7C623 Lightwell Security Advisory: spring-boot-loader 2.7.18.rhlw-00004

Red Hat Lightwell has released org.springframework.boot:spring-boot-loader 2.7.18.rhlw-00004 with a backported security fix. CVE-2024-38807: Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may ...

RHLW-2026-847D178EF0F52697 Lightwell Security Advisory: spring-boot-devtools 2.7.18.rhlw-00004

Red Hat Lightwell has released org.springframework.boot:spring-boot-devtools 2.7.18.rhlw-00004 with a backported security fix. CVE-2026-40972: An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extre...

RHLW-2026-0A4E3CE968CB9794 Lightwell Security Advisory: spring-boot-autoconfigure 2.7.18.rhlw-00004

Red Hat Lightwell has released org.springframework.boot:spring-boot-autoconfigure 2.7.18.rhlw-00004 with a backported security fix. CVE-2026-41001: Predictable Temp Directory in Artemis Auto-configuration This patched artifact is a drop-in replacement for...

RHLW-2026-5C040610F497341F Lightwell Security Advisory: assertj-core 3.19.0.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 3.19.0.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-94BFC0F50BBF8711 Lightwell Security Advisory: zookeeper 3.4.14.rhlw-00001

Red Hat Lightwell has released org.apache.zookeeper:zookeeper 3.4.14.rhlw-00001 with a backported security fix. CVE-2023-44981: Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication This patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper 3.4.14 from...

RHLW-2026-8118B2499151DE91 Lightwell Security Advisory: httpclient5 5.6.1.rhlw-00012

Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.1.rhlw-00012 with a backported security fix. CVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS This patched artifact is a drop-in replacement...

RHLW-2026-2A7B95611000D6B5 Lightwell Security Advisory: httpclient5 5.6.0.rhlw-00001

Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.0.rhlw-00001 with backported fixes for CVE-2026-40542 and CVE-2026-64607. CVE-2026-40542: Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper...

RHLW-2026-4140A7A9C48DB376 Lightwell Security Advisory: netty-transport-sctp 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-transport-sctp 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-46340 and CVE-2026-59902. CVE-2026-46340: Netty: SCTP reassembly nests buffers without bound CVE-2026-59902: Netty: Memory Exhaustion in SctpMessageCompletionHandler This patch...

RHLW-2026-778FAAA627FD5B22 Lightwell Security Advisory: netty-transport-native-kqueue 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-transport-native-kqueue 4.1.100.Final-rhlw-00001 with a backported security fix. CVE-2026-45536: Netty: Unix-socket fd receive leaks descriptors when peer sends two at once This patched artifact is a drop-in replacement for...

RHLW-2026-A889D214E9EF7D94 Lightwell Security Advisory: netty-transport-native-epoll 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-transport-native-epoll 4.1.100.Final-rhlw-00001 with a backported security fix. CVE-2026-45536: Netty: Unix-socket fd receive leaks descriptors when peer sends two at once This patched artifact is a drop-in replacement for...

RHLW-2026-70779BC964A31A7E Lightwell Security Advisory: netty-resolver-dns 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-resolver-dns 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-45673, CVE-2026-45674, and CVE-2026-47691. CVE-2026-45673: Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port CVE-2026-45674: Netty Vulnerable to D...

RHLW-2026-7E27D228834C9346 Lightwell Security Advisory: netty-handler-ssl-ocsp 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-handler-ssl-ocsp 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-56820, CVE-2026-56821, and CVE-2026-56822. CVE-2026-56820: Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVE-2026-56821: Netty: Out-of-date...

RHLW-2026-05E60F2154DEE59A Lightwell Security Advisory: netty-handler-proxy 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-handler-proxy 4.1.100.Final-rhlw-00001 with a backported security fix. CVE-2026-42578: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation This patched artifact is a drop-in replacement for io.netty:netty-handler-proxy 4.1.100.Final...

RHLW-2026-313117B0CAD7329E Lightwell Security Advisory: netty-handler 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-handler 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2025-24970, CVE-2026-44249, CVE-2026-45416, CVE-2026-50010, CVE-2026-75595, and CVE-2026-75596. CVE-2025-24970: SslHandler doesn't correctly validate packets which can lead to native crash...

RHLW-2026-858CB80FC989D912 Lightwell Security Advisory: netty-common 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-common 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2024-47535 and CVE-2025-25193. CVE-2024-47535: Denial of Service attack on windows app using Netty CVE-2025-25193: Denial of Service attack on windows app using Netty This patched artifact ...

RHLW-2026-F00B5FBBBB907153 Lightwell Security Advisory: netty-codec-xml 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-codec-xml 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-56817 and CVE-2026-73507. CVE-2026-56817: Netty: XML External Entity XXE injection via unconfigured XML factory when DTD and entity processing are enabled CVE-2026-73507: Netty:...

RHLW-2026-B66720D53A6E2BA6 Lightwell Security Advisory: netty-codec-stomp 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-codec-stomp 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-44891 and CVE-2026-59920. CVE-2026-44891: Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder CVE-2026-59920: Netty: STOMP CONNECT Frame Header Injection This...

RHLW-2026-6F1A404174E2316F Lightwell Security Advisory: netty-codec-redis 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-codec-redis 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-42586, CVE-2026-44250, CVE-2026-44890, CVE-2026-48006, CVE-2026-50011, and CVE-2026-56818. CVE-2026-42586: Netty: CRLF Injection in Netty Redis Codec Encoder CVE-2026-44250: Netty...

RHLW-2026-1CAAFB676CC0F4C9 Lightwell Security Advisory: netty-codec-http2 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-codec-http2 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2025-55163, CVE-2026-33871, CVE-2026-42587, CVE-2026-47244, CVE-2026-48043, CVE-2026-50560, CVE-2026-56819, and CVE-2026-59900. CVE-2025-55163: Netty MadeYouReset HTTP/2 DDoS...

RHLW-2026-99869C1CAD4574FC Lightwell Security Advisory: netty-codec-http 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-codec-http 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2024-29025, CVE-2025-58056, CVE-2025-67735, CVE-2026-33870, CVE-2026-41417, CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-50020, CVE-2026-5583...

RHLW-2026-2E889FEB45FC9875 Lightwell Security Advisory: netty-codec-haproxy 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-codec-haproxy 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-44893, CVE-2026-48059, CVE-2026-55851, and CVE-2026-59919. CVE-2026-44893: Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length CVE-2026-48059: Netty HAProx...

RHLW-2026-69CA3F0D713E6636 Lightwell Security Advisory: netty-codec-dns 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-codec-dns 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-42579 and CVE-2026-73508. CVE-2026-42579: Netty: DNS Codec Input Validation Bypass in Netty Encoder + Decoder CVE-2026-73508: Netty: Memory Leak in DNS Record Decoder via Malformed...

RHLW-2026-EE001BC1AC13AB0B Lightwell Security Advisory: netty-codec 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-codec 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2025-58057, CVE-2026-42583, and CVE-2026-59901. CVE-2025-58057: Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack CVE-2026-42583: Netty: Lz4FrameDecoder resource exhaustio...

RHLW-2026-44A75016EAB78E73 Lightwell Security Advisory: commons-fileupload 1.4.0.rhlw-00001

Red Hat Lightwell has released commons-fileupload:commons-fileupload 1.4.0.rhlw-00001 with backported fixes for CVE-2023-24998 and CVE-2025-48976. CVE-2023-24998: Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts CVE-2025-48976: Apache Commons FileUpload, Apache Common...

RHLW-2026-1A7BD97B99988E1C Lightwell Security Advisory: commons-beanutils 1.10.1.rhlw-00001

Red Hat Lightwell has released commons-beanutils:commons-beanutils 1.10.1.rhlw-00001 with a backported security fix. CVE-2025-48734: Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using...

RHLW-2026-89F4DBC7818C5084 Lightwell Security Advisory: commons-beanutils 1.10.0.rhlw-00001

Red Hat Lightwell has released commons-beanutils:commons-beanutils 1.10.0.rhlw-00001 with a backported security fix. CVE-2025-48734: Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using...

RHLW-2026-E708CF2111A96B61 Lightwell Security Advisory: okio 1.6.0.rhlw-00001

Red Hat Lightwell has released com.squareup.okio:okio 1.6.0.rhlw-00001 with a backported security fix. CVE-2023-3635: Okio GzipSource unhandled exception Denial of Service This patched artifact is a drop-in replacement for com.squareup.okio:okio 1.6.0 from Maven Central...

RHLW-2026-F8F17F4598510B8D Lightwell Security Advisory: json-path 2.8.0.rhlw-00001

Red Hat Lightwell has released com.jayway.jsonpath:json-path 2.8.0.rhlw-00001 with a backported security fix. CVE-2023-51074: json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse method. This patched artifact is a drop-in replacement for com.jayway.jsonpath:json-path...

RHLW-2026-A08954EF69E23D40 Lightwell Security Advisory: logback-core 1.2.11.rhlw-00001

Red Hat Lightwell has released ch.qos.logback:logback-core 1.2.11.rhlw-00001 with backported fixes for CVE-2023-6378, CVE-2024-12798, CVE-2024-12801, CVE-2025-11226, CVE-2026-10532, CVE-2026-1225, and CVE-2026-9828. CVE-2023-6378: Logback "receiver" DOS vulnerability CVE-2024-12798: ACE...

RHLW-2026-A9AFA2D7B2973961 Lightwell Security Advisory: spring-web 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-web 5.3.18.rhlw-00010 with backported fixes for CVE-2016-1000027, CVE-2024-22259, CVE-2024-22262, CVE-2024-38809, and CVE-2024-38820. CVE-2016-1000027: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution...

RHLW-2026-E6D7B954CD8149D6 Lightwell Security Advisory: httpclient 4.5.12.rhlw-00001

Red Hat Lightwell has released org.apache.httpcomponents:httpclient 4.5.12.rhlw-00001 with a backported security fix. CVE-2020-13956: Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI...

RHLW-2026-67AFC831A93FF9CC Lightwell Security Advisory: spring-webmvc 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-webmvc 5.3.18.rhlw-00010 with backported fixes for CVE-2023-20860, CVE-2024-38816, CVE-2024-38819, CVE-2024-38828, CVE-2025-41242, CVE-2026-22735, CVE-2026-22737, CVE-2026-22741, and CVE-2026-22745. CVE-2023-20860: Spring Framework running...

RHLW-2026-F342BDBD2D18AAA6 Lightwell Security Advisory: spring-core 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-core 5.3.18.rhlw-00010 with a backported security fix. CVE-2025-41249: The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with...

RHLW-2026-630128D9882E951F Lightwell Security Advisory: spring-security-core 5.7.11.rhlw-00006

Red Hat Lightwell has released org.springframework.security:spring-security-core 5.7.11.rhlw-00006 with backported fixes for CVE-2024-22257, CVE-2024-38827, and CVE-2026-22746. CVE-2026-22746: User Attribute Enumeration when Using DaoAuthenticationProvider This patched artifact is a drop-in...

RHLW-2026-FB860419F051AEDD Lightwell Security Advisory: netty-codec-smtp 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-codec-smtp 4.1.100.Final-rhlw-00001 with a backported security fix. CVE-2025-59419: Netty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email Forgery This patched artifact is a drop-in replacement for io.netty:netty-codec-smtp...

RHLW-2026-48B9709BA25473BE Lightwell Security Advisory: netty-codec-mqtt 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-codec-mqtt 4.1.100.Final-rhlw-00001 with a backported security fix. CVE-2026-44248: Netty: Resource exhaustion in MqttDecoder This patched artifact is a drop-in replacement for io.netty:netty-codec-mqtt 4.1.100.Final from Maven Central...

RHLW-2026-AABBC2804B02664A Lightwell Security Advisory: junit 4.13.0.rhlw-00001

Red Hat Lightwell has released junit:junit 4.13.0.rhlw-00001 with a backported security fix. CVE-2020-15250: In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is...

RHLW-2026-7A34EF2DB32D7967 Lightwell Security Advisory: h2 2.2.219.rhlw-00001

Red Hat Lightwell has released com.h2database:h2 2.2.219.rhlw-00001 with a backported security fix. CVE-2022-45868: The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in...

RHLW-2026-8DE53CADE32781FB Lightwell Security Advisory: junit 4.12.0.rhlw-00002

Red Hat Lightwell has released junit:junit 4.12.0.rhlw-00002 with a backported security fix. CVE-2020-15250: In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is...