RHLW-2026-10F7476FF588DDE7 Lightwell Security Advisory: commons-configuration2 2.14.0.rhlw-00001

Red Hat Lightwell has released org.apache.commons:commons-configuration2 2.14.0.rhlw-00001 with a backported security fix. CVE-2026-45205: Apache Commons Configuration: StackOverflowError for YAML input with cycles This patched artifact is a drop-in replacement for...

RHLW-2026-90932E54C65972CD Lightwell Security Advisory: json-smart 2.5.0.rhlw-00001

Red Hat Lightwell has released net.minidev:json-smart 2.5.0.rhlw-00001 with a backported security fix. CVE-2024-57699: A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’’, a stack exhaustion can be...

RHLW-2026-BE2F564B0BEE4A36 Lightwell Security Advisory: commons-beanutils 1.9.4.rhlw-00001

Red Hat Lightwell has released commons-beanutils:commons-beanutils 1.9.4.rhlw-00001 with a backported security fix. CVE-2025-48734: Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using t...

RHLW-2026-A4C4A4BF58E29184 Lightwell Security Advisory: json-path 2.7.0.rhlw-00001

Red Hat Lightwell has released com.jayway.jsonpath:json-path 2.7.0.rhlw-00001 with a backported security fix. CVE-2023-51074: json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse method. This patched artifact is a drop-in replacement for com.jayway.jsonpath:json-path...

RHLW-2026-CD97E66695607070 Lightwell Security Advisory: xalan-bcel-6.6.1 2.7.2.Final-rhlw-00004

Red Hat Lightwell has released xalan:xalan-bcel-6.6.1 2.7.2.Final-rhlw-00004 with a backported security fix. CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets This patched artifact is a drop-in replacement for...

RHLW-2026-DB6CFA79167EC456 Lightwell Security Advisory: snakeyaml 1.33.0.rhlw-00001

Red Hat Lightwell has released org.yaml:snakeyaml 1.33.0.rhlw-00001 with a backported security fix. CVE-2022-1471: Remote Code execution in SnakeYAML This patched artifact is a drop-in replacement for org.yaml:snakeyaml 1.33.0 from Maven Central...

RHLW-2026-C782A5BB98E3A176 Lightwell Security Advisory: snakeyaml 1.29.0.rhlw-00021

Red Hat Lightwell has released org.yaml:snakeyaml 1.29.0.rhlw-00021 with backported fixes for CVE-2022-1471, CVE-2022-25857, CVE-2022-38749, CVE-2022-38750, CVE-2022-38751, CVE-2022-38752, and CVE-2022-41854. CVE-2022-1471: Remote Code execution in SnakeYAML CVE-2022-25857: Denial of Service DoS...

RHLW-2026-DE2BB03E40C2EC86 Lightwell Security Advisory: xmlunit-assertj3 2.8.4.rhlw-00001

Red Hat Lightwell has released org.xmlunit:xmlunit-assertj3 2.8.4.rhlw-00001 with a backported security fix. CVE-2024-31573: XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet used for an XSLT transformation, because XSLT extension...

RHLW-2026-BF51D193D76DE6EF Lightwell Security Advisory: xmlunit-assertj3 2.9.1.rhlw-00002

Red Hat Lightwell has released org.xmlunit:xmlunit-assertj3 2.9.1.rhlw-00002 with a backported security fix. CVE-2024-31573: XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet used for an XSLT transformation, because XSLT extension...

RHLW-2026-A06FD4CFDAB7EF70 Lightwell Security Advisory: spring-aop 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-aop 5.3.18.rhlw-00010 with a backported security fix. CVE-2016-1000027: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution RCE issue if used for Java deserialization of untrusted data. Depending on how t...

RHLW-2026-1DA18FF8E343FDF8 Lightwell Security Advisory: json 20220320.0.0.rhlw-00003

Red Hat Lightwell has released org.json:json 20220320.0.0.rhlw-00003 with a backported security fix. CVE-2022-45688: A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service DoS via crafted JSON or XML data. This patched artifact is a...

RHLW-2026-779E7AA7BC83A4C5 Lightwell Security Advisory: spring-security-aspects 5.7.11.rhlw-00006

Red Hat Lightwell has released org.springframework.security:spring-security-aspects 5.7.11.rhlw-00006 with a backported security fix. This patched artifact is a drop-in replacement for org.springframework.security:spring-security-aspects 5.7.11 from Maven Central...

RHLW-2026-37913C8C5F4BDEA1 Lightwell Security Advisory: jetty-ee10-demo-async-rest-jar 12.0.32.rhlw-00002

Red Hat Lightwell has released org.eclipse.jetty.ee10.demos:jetty-ee10-demo-async-rest-jar 12.0.32.rhlw-00002 with a backported security fix. CVE-2026-2332: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing This patched artifact is a drop-in replacement for...

RHLW-2026-CD27691C140AA026 Lightwell Security Advisory: plexus-utils 4.0.1.rhlw-00001

Red Hat Lightwell has released org.codehaus.plexus:plexus-utils 4.0.1.rhlw-00001 with a backported security fix. CVE-2025-67030: Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This...

RHLW-2026-E9A6A9AE2DA7F754 Lightwell Security Advisory: assertj-guava 3.27.6.rhlw-00002

Red Hat Lightwell has released org.assertj:assertj-guava 3.27.6.rhlw-00002 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-2F00B906A72C7D80 Lightwell Security Advisory: assertj-guava 3.27.5.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-guava 3.27.5.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-BEB8398E1777D04E Lightwell Security Advisory: assertj-guava 3.27.3.rhlw-00002

Red Hat Lightwell has released org.assertj:assertj-guava 3.27.3.rhlw-00002 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-4688FA8056BB5EB0 Lightwell Security Advisory: assertj-guava 3.27.4.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-guava 3.27.4.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-AFABA61EB7F2850C Lightwell Security Advisory: assertj-guava 3.27.2.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-guava 3.27.2.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-8EE8407887122C89 Lightwell Security Advisory: assertj-guava 3.27.0.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-guava 3.27.0.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-1DFA725FAA28BD98 Lightwell Security Advisory: assertj-guava 3.26.3.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-guava 3.26.3.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-9EB6B9377232BC55 Lightwell Security Advisory: assertj-guava 3.26.0.rhlw-00004

Red Hat Lightwell has released org.assertj:assertj-guava 3.26.0.rhlw-00004 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-EDFB54BE5079EBB7 Lightwell Security Advisory: assertj-guava 3.25.3.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-guava 3.25.3.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-0A09F6ECF7835EA0 Lightwell Security Advisory: assertj-guava 3.25.1.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-guava 3.25.1.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-C53452D5F25A2707 Lightwell Security Advisory: assertj-guava 3.25.0.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-guava 3.25.0.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-A5A3E82A382AB25B Lightwell Security Advisory: assertj-guava 3.24.2.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-guava 3.24.2.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-6AAF368527C42953 Lightwell Security Advisory: assertj-guava 3.24.1.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-guava 3.24.1.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-F5CFA6309AD4F62E Lightwell Security Advisory: assertj-core 3.6.1.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 3.6.1.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-CED7F507FAE93C0B Lightwell Security Advisory: assertj-core 3.5.2.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 3.5.2.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-06C890C70B401B52 Lightwell Security Advisory: assertj-core 3.4.1.rhlw-00002

Red Hat Lightwell has released org.assertj:assertj-core 3.4.1.rhlw-00002 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-BFCCEA342DD4B844 Lightwell Security Advisory: assertj-core 3.23.1.rhlw-00002

Red Hat Lightwell has released org.assertj:assertj-core 3.23.1.rhlw-00002 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-3F93BDCC94A21F2E Lightwell Security Advisory: assertj-core 3.22.0.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 3.22.0.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-125C08589A792D0C Lightwell Security Advisory: assertj-core 3.14.0.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 3.14.0.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-69E0A9B52C08198F Lightwell Security Advisory: assertj-core 3.1.0.rhlw-00003

Red Hat Lightwell has released org.assertj:assertj-core 3.1.0.rhlw-00003 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-A8F2FEB806A7EC11 Lightwell Security Advisory: assertj-core 3.12.2.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 3.12.2.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-C0819A53DD258DB2 Lightwell Security Advisory: assertj-core 2.6.0.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 2.6.0.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-D8B82278A734AA57 Lightwell Security Advisory: assertj-core 2.5.0.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 2.5.0.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-3837A83BE413601A Lightwell Security Advisory: zookeeper-jute 3.8.3.rhlw-00003

Red Hat Lightwell has released org.apache.zookeeper:zookeeper-jute 3.8.3.rhlw-00003 with a backported security fix. CVE-2026-24281: Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager This patched artifact is a drop-in replacement for...

RHLW-2026-0D09FAEDDB529ACC Lightwell Security Advisory: zookeeper-jute 3.5.9.rhlw-00001

Red Hat Lightwell has released org.apache.zookeeper:zookeeper-jute 3.5.9.rhlw-00001 with a backported security fix. CVE-2023-44981: Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication This patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper-jute 3.5....

RHLW-2026-93F19CE4E79AD4F9 Lightwell Security Advisory: zookeeper-jute 3.5.8.rhlw-00001

Red Hat Lightwell has released org.apache.zookeeper:zookeeper-jute 3.5.8.rhlw-00001 with a backported security fix. CVE-2023-44981: Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication This patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper-jute 3.5....

RHLW-2026-7EAC4E5EC1CCA641 Lightwell Security Advisory: zookeeper-jute 3.5.7.rhlw-00001

Red Hat Lightwell has released org.apache.zookeeper:zookeeper-jute 3.5.7.rhlw-00001 with a backported security fix. CVE-2023-44981: Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication This patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper-jute 3.5....

RHLW-2026-09AD7CE59E9C497A Lightwell Security Advisory: zookeeper-jute 3.4.14.rhlw-00001

Red Hat Lightwell has released org.apache.zookeeper:zookeeper-jute 3.4.14.rhlw-00001 with a backported security fix. CVE-2023-44981: Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication This patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper-jute...

RHLW-2026-4F7C55B876854238 Lightwell Security Advisory: fontbox 2.0.19.rhlw-00001

Red Hat Lightwell has released org.apache.pdfbox:fontbox 2.0.19.rhlw-00001 with a backported security fix. CVE-2021-27807: A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions. This patched...

RHLW-2026-64CFAC683D7A9AF7 Lightwell Security Advisory: log4j-1.2-api 2.24.3.rhlw-00004

Red Hat Lightwell has released org.apache.logging.log4j:log4j-1.2-api 2.24.3.rhlw-00004 with backported fixes for CVE-2025-68161, CVE-2026-34477, CVE-2026-34478, and CVE-2026-34480. CVE-2025-68161: Apache Log4j Core: Missing TLS hostname verification in Socket appender CVE-2026-34477: Apache Log4...

RHLW-2026-E56FD5F91F882DB9 Lightwell Security Advisory: httpclient5-cache 5.6.2.rhlw-00005

Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5-cache 5.6.2.rhlw-00005 with a backported security fix. CVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport default config, MITM This patched artifact is a...

RHLW-2026-7B188D550BF6BFC3 Lightwell Security Advisory: httpclient 4.5.6.rhlw-00001

Red Hat Lightwell has released org.apache.httpcomponents:httpclient 4.5.6.rhlw-00001 with a backported security fix. CVE-2020-13956: Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI...

RHLW-2026-C23E4577FAE1D333 Lightwell Security Advisory: cxf-jaxrs-service 4.2.2.rhlw-00008

Red Hat Lightwell has released org.apache.cxf.archetype:cxf-jaxrs-service 4.2.2.rhlw-00008 with backported fixes for CVE-2026-57817 and CVE-2026-65583. CVE-2026-57817: Apache CXF: The authorization code hash chash is not enforced for the hybrid OIDC flow CVE-2026-65583: Apache CXF: Self-issued ID...

RHLW-2026-689BBA11EAE91BCB Lightwell Security Advisory: cxf-jaxrs-service 3.6.9.rhlw-00004

Red Hat Lightwell has released org.apache.cxf.archetype:cxf-jaxrs-service 3.6.9.rhlw-00004 with backported fixes for CVE-2026-44417, CVE-2026-50632, and CVE-2026-66909. CVE-2026-44417: Apache CXF: Incomplete fix for CVE-2025-48913 Untrusted JMS configuration can lead to RCE CVE-2026-50632: Apache...

RHLW-2026-4051AB209E8865E6 Lightwell Security Advisory: avro-android 1.11.0.rhlw-00002

Red Hat Lightwell has released org.apache.avro:avro-android 1.11.0.rhlw-00002 with backported fixes for CVE-2023-39410 and CVE-2024-47561. CVE-2023-39410: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution...

RHLW-2026-C44E4CF8DCDA3E35 Lightwell Security Advisory: json-smart 2.5.1.rhlw-00001

Red Hat Lightwell has released net.minidev:json-smart 2.5.1.rhlw-00001 with a backported security fix. CVE-2024-57699: A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’’, a stack exhaustion can be...