RHLW-2026-27D20D7DF55218F5 Lightwell Security Advisory: json-smart 2.4.8.rhlw-00001

Red Hat Lightwell has released net.minidev:json-smart 2.4.8.rhlw-00001 with a backported security fix. CVE-2023-1370: Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON This patched artifact is a drop-in replacement for net.minidev:json-smart 2.4.8 from Maven...

RHLW-2026-7036555A81C446F8 Lightwell Security Advisory: netty-buffer 4.1.132.Final-rhlw-00002

Red Hat Lightwell has released io.netty:netty-buffer 4.1.132.Final-rhlw-00002 with a backported security fix. CVE-2026-45673: Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port This patched artifact is a drop-in replacement for io.netty:netty-buffer 4.1.132.Final fr...

RHLW-2026-27D595C7DC400686 Lightwell Security Advisory: classgraph 4.8.83.rhlw-00001

Red Hat Lightwell has released io.github.classgraph:classgraph 4.8.83.rhlw-00001 with a backported security fix. CVE-2021-47621: ClassGraph before 4.8.112 was not resistant to XML eXternal Entity XXE attacks. This patched artifact is a drop-in replacement for io.github.classgraph:classgraph 4.8.8...

RHLW-2026-9BD677F780E42D38 Lightwell Security Advisory: classgraph 4.8.36.rhlw-00001

Red Hat Lightwell has released io.github.classgraph:classgraph 4.8.36.rhlw-00001 with a backported security fix. CVE-2021-47621: ClassGraph before 4.8.112 was not resistant to XML eXternal Entity XXE attacks. This patched artifact is a drop-in replacement for io.github.classgraph:classgraph 4.8.3...

RHLW-2026-A9A544137749200C Lightwell Security Advisory: aircompressor 2.0.2.rhlw-00001

Red Hat Lightwell has released io.airlift:aircompressor 2.0.2.rhlw-00001 with a backported security fix. CVE-2025-67721: Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer This patched artifact is a drop-in replacement for...

RHLW-2026-D10068B21671906A Lightwell Security Advisory: commons-net 3.8.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.8.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-C7216DB110A73995 Lightwell Security Advisory: commons-net 3.7.2.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.7.2.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-71F0BC56442456D3 Lightwell Security Advisory: commons-net 3.7.1.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.7.1.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-20F36034F30C7A24 Lightwell Security Advisory: commons-net 3.5.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.5.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-E16A7A7E33D1BD95 Lightwell Security Advisory: commons-net 3.6.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.6.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-94B9703160382A25 Lightwell Security Advisory: commons-net 3.4.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.4.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-CE8CAF53627ADA47 Lightwell Security Advisory: commons-net 3.2.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.2.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-B6AD3B6E26EC332F Lightwell Security Advisory: commons-net 3.3.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.3.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-93C3DAF552B9D6BC Lightwell Security Advisory: commons-net 2.0.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 2.0.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-F33A833F49F3FD86 Lightwell Security Advisory: commons-io 2.2.0.rhlw-00004

Red Hat Lightwell has released commons-io:commons-io 2.2.0.rhlw-00004 with backported fixes for CVE-2021-29425 and CVE-2024-47554. CVE-2021-29425: In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the...

RHLW-2026-8F37E023B4E3806B Lightwell Security Advisory: commons-fileupload 1.5.0.rhlw-00002

Red Hat Lightwell has released commons-fileupload:commons-fileupload 1.5.0.rhlw-00002 with a backported security fix. CVE-2025-48976: Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers This patched artifact is a drop-in replacement for...

RHLW-2026-61325E90A4894C88 Lightwell Security Advisory: okio 1.17.2.rhlw-00001

Red Hat Lightwell has released com.squareup.okio:okio 1.17.2.rhlw-00001 with a backported security fix. CVE-2023-3635: Okio GzipSource unhandled exception Denial of Service This patched artifact is a drop-in replacement for com.squareup.okio:okio 1.17.2 from Maven Central...

RHLW-2026-C45D2A64E2C0626E Lightwell Security Advisory: android-mail 1.6.7.rhlw-00001

Red Hat Lightwell has released com.sun.mail:android-mail 1.6.7.rhlw-00001 with a backported security fix. CVE-2025-7962: In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages. This patched...

RHLW-2026-0A6FC4430620D7B4 Lightwell Security Advisory: nimbus-jose-jwt 9.7.0.rhlw-00002

Red Hat Lightwell has released com.nimbusds:nimbus-jose-jwt 9.7.0.rhlw-00002 with a backported security fix. CVE-2023-52428: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service resource consumption via a large JWE p2c header value aka iteration count for the...

RHLW-2026-26042322A4C88B7D Lightwell Security Advisory: protobuf-java-util 3.21.7.rhlw-00002

Red Hat Lightwell has released com.google.protobuf:protobuf-java-util 3.21.7.rhlw-00002 with a backported security fix. CVE-2024-7254: Stack overflow in Protocol Buffers Java Lite This patched artifact is a drop-in replacement for com.google.protobuf:protobuf-java-util 3.21.7 from Maven Central...

RHLW-2026-C9A2C76071C97E3C Lightwell Security Advisory: protobuf-java 3.21.7.rhlw-00002

Red Hat Lightwell has released com.google.protobuf:protobuf-java 3.21.7.rhlw-00002 with a backported security fix. CVE-2024-7254: Stack overflow in Protocol Buffers Java Lite This patched artifact is a drop-in replacement for com.google.protobuf:protobuf-java 3.21.7 from Maven Central...

RHLW-2026-403D1E66C95EF9BB Lightwell Security Advisory: woodstox-core 6.0.3.rhlw-00001

Red Hat Lightwell has released com.fasterxml.woodstox:woodstox-core 6.0.3.rhlw-00001 with a backported security fix. CVE-2022-40152: Stack Buffer Overflow in Woodstox This patched artifact is a drop-in replacement for com.fasterxml.woodstox:woodstox-core 6.0.3 from Maven Central...

RHLW-2026-7B68982493D0DCE4 Lightwell Security Advisory: jackson-datatype-jsr310 2.8.11.rhlw-00001

Red Hat Lightwell has released com.fasterxml.jackson.datatype:jackson-datatype-jsr310 2.8.11.rhlw-00001 with a backported security fix. CVE-2018-1000873: Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in...

RHLW-2026-DD8ED0B211BE109B Lightwell Security Advisory: woodstox-core 5.0.3.rhlw-00001

Red Hat Lightwell has released com.fasterxml.woodstox:woodstox-core 5.0.3.rhlw-00001 with a backported security fix. CVE-2022-40152: Stack Buffer Overflow in Woodstox This patched artifact is a drop-in replacement for com.fasterxml.woodstox:woodstox-core 5.0.3 from Maven Central...

RHLW-2026-56415B28EA79906A Lightwell Security Advisory: jackson-dataformat-cbor 2.9.10.rhlw-00001

Red Hat Lightwell has released com.fasterxml.jackson.dataformat:jackson-dataformat-cbor 2.9.10.rhlw-00001 with a backported security fix. CVE-2020-28491: This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1...

RHLW-2026-2324B17F545E0135 Lightwell Security Advisory: jackson-dataformat-cbor 2.10.0.rhlw-00001

Red Hat Lightwell has released com.fasterxml.jackson.dataformat:jackson-dataformat-cbor 2.10.0.rhlw-00001 with a backported security fix. CVE-2020-28491: This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1...

RHLW-2026-BCAF0A0AE0978229 Lightwell Security Advisory: jackson-databind 2.13.4.2-rhlw-00004

Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.13.4.2-rhlw-00004 with a backported security fix. CVE-2026-91776: jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID This patched artifact is a drop-in...

RHLW-2026-BAD5CA0773255E9E Lightwell Security Advisory: jackson-databind 2.13.4.1-rhlw-00013

Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.13.4.1-rhlw-00013 with backported fixes for CVE-2026-50193, CVE-2026-54512, CVE-2026-54513, and CVE-2026-54514. CVE-2026-50193: jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString...

RHLW-2026-96D3EE80FB77C7D0 Lightwell Security Advisory: logback-classic 1.5.16.rhlw-00002

Red Hat Lightwell has released ch.qos.logback:logback-classic 1.5.16.rhlw-00002 with a backported security fix. CVE-2026-10532: Logback deserialization whitelist bypass for Proxy objects This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.5.16 from Maven Central...

RHLW-2026-271A386EE9CF984F Lightwell Security Advisory: logback-classic 1.2.11.rhlw-00001

Red Hat Lightwell has released ch.qos.logback:logback-classic 1.2.11.rhlw-00001 with a backported security fix. CVE-2023-6378: Logback "receiver" DOS vulnerability This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.2.11 from Maven Central...

RHLW-2026-B44D1F7DAC7A0D3D Lightwell Security Advisory: postgresql 42.3.3.rhlw-00006

Red Hat Lightwell has released org.postgresql:postgresql 42.3.3.rhlw-00006 with backported fixes for CVE-2022-31197, CVE-2022-41946, CVE-2024-1597, and CVE-2026-42198. CVE-2022-31197: SQL Injection in ResultSet.refreshRow with malicious column names in pgjdbc CVE-2022-41946: TemporaryFolder on...

RHLW-2026-BDF75F90D46C1DA0 Lightwell Security Advisory: jackson-core 2.11.3.rhlw-00002

Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-core 2.11.3.rhlw-00002 with a backported security fix. CVE-2025-49128: Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation This patched artifact is a drop-in replacement for...

RHLW-2026-7E41B237DD570C9F Lightwell Security Advisory: mariadb-java-client 3.5.8.rhlw-00003

Red Hat Lightwell has released org.mariadb.jdbc:mariadb-java-client 3.5.8.rhlw-00003 with backported fixes for CVE-2026-55856, CVE-2026-55857, and CVE-2026-55858. CVE-2026-55856: MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake CVE-2026-55857: MariaDB...

RHLW-2026-2F27E699C38D33D5 Lightwell Security Advisory: neethi 3.2.2.rhlw-00006

Red Hat Lightwell has released org.apache.neethi:neethi 3.2.2.rhlw-00006 with backported fixes for CVE-2026-66142, CVE-2026-66143, and CVE-2026-66144. CVE-2026-66142: Apache Neethi: Uncontrolled recursion in policy processing CVE-2026-66143: Apache Neethi: Missing global alternative-output budget...

RHLW-2026-055D7BDE52D9946F Lightwell Security Advisory: logback-core 1.2.12.rhlw-00005

Red Hat Lightwell has released ch.qos.logback:logback-core 1.2.12.rhlw-00005 with backported fixes for CVE-2023-6378 and CVE-2024-12801. CVE-2023-6378: Logback "receiver" DOS vulnerability CVE-2024-12801: Server-Side Request Forgery SSRF in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14...

RHLW-2026-32DE0F514C232FF5 Lightwell Security Advisory: httpclient5 5.6.2.rhlw-00005

Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.2.rhlw-00005 with backported fixes for CVE-2026-64607 and CVE-2026-71290. CVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS CVE-2026-71290:...

RHLW-2026-F50C19633C98B180 Lightwell Security Advisory: jackson-databind 2.13.4.rhlw-00027

Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.13.4.rhlw-00027 with a backported security fix. CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution SSRF This patched artifact is a drop-in replacement for...

RHLW-2026-A317DDBA4AF7590D Lightwell Security Advisory: commons-io 2.11.0.rhlw-00009

Red Hat Lightwell has released commons-io:commons-io 2.11.0.rhlw-00009 with a backported security fix. CVE-2024-47554: Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader This patched artifact is a drop-in replacement for commons-io:commons-io 2.11.0 from...

RHLW-2026-5920E9C5F3ADA010 Lightwell Security Advisory: postgresql 42.7.3.rhlw-00001

Red Hat Lightwell has released org.postgresql:postgresql 42.7.3.rhlw-00001 with a backported security fix. CVE-2026-42198: pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS This patched artifact is a drop-in replacement for org.postgresql:postgresql 42.7.3 from...

RHLW-2026-5665FF8F68D7CABB Lightwell Security Advisory: ant 1.8.2.rhlw-00006

Red Hat Lightwell has released org.apache.ant:ant 1.8.2.rhlw-00006 with backported fixes for CVE-2020-11979 and CVE-2020-1945. CVE-2020-11979: As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to acces...

RHLW-2026-9CAB5871D815DD9D Lightwell Security Advisory: logback-classic 1.5.9.rhlw-00031

Red Hat Lightwell has released ch.qos.logback:logback-classic 1.5.9.rhlw-00031 with backported fixes for CVE-2024-12798, CVE-2024-12801, CVE-2026-10532, and CVE-2026-19880. CVE-2024-12798: ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14...

RHLW-2026-B2C64E34AE82B333 Lightwell Security Advisory: pdfbox 2.0.19.rhlw-00001

Red Hat Lightwell has released org.apache.pdfbox:pdfbox 2.0.19.rhlw-00001 with a backported security fix. CVE-2021-27807: A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions. This patched artifa...

RHLW-2026-ECC1D237BC4CBA0C Lightwell Security Advisory: ognl 3.0.8.rhlw-00002

Red Hat Lightwell has released ognl:ognl 3.0.8.rhlw-00002 with a backported security fix. CVE-2016-3093: Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service block access to a w...

RHLW-2026-817B6809AF7B9C1B Lightwell Security Advisory: async-http-client 3.0.5.rhlw-00002

Red Hat Lightwell has released org.asynchttpclient:async-http-client 3.0.5.rhlw-00002 with backported fixes for CVE-2026-45300 and CVE-2026-55688. CVE-2026-45300: async-http-client: Cookie header not stripped on cross-origin redirect CVE-2026-55688: AsyncHttpClient: Cookie stored for an unrelated...

RHLW-2026-07E5370D09E5A6F8 Lightwell Security Advisory: logback-core 1.5.9.rhlw-00031

Red Hat Lightwell has released ch.qos.logback:logback-core 1.5.9.rhlw-00031 with backported fixes for CVE-2024-12798, CVE-2024-12801, CVE-2026-10532, and CVE-2026-19880. CVE-2024-12798: ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0...

RHLW-2026-2AEBDB8547D9B041 Lightwell Security Advisory: opennlp-tools 2.5.9.rhlw-00002

Red Hat Lightwell has released org.apache.opennlp:opennlp-tools 2.5.9.rhlw-00002 with a backported security fix. CVE-2026-63317: Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML This patched artifact is a drop-in replacement for...

RHLW-2026-F8FC2683E717E6A2 Lightwell Security Advisory: commons-io 2.13.0.rhlw-00007

Red Hat Lightwell has released commons-io:commons-io 2.13.0.rhlw-00007 with a backported security fix. CVE-2024-47554: Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader This patched artifact is a drop-in replacement for commons-io:commons-io 2.13.0 from...

RHLW-2026-E78D277BDE69C3F5 Lightwell Security Advisory: apache-mime4j-core 0.8.9.rhlw-00004

Red Hat Lightwell has released org.apache.james:apache-mime4j-core 0.8.9.rhlw-00004 with a backported security fix. CVE-2024-21742: Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add...

RHLW-2026-F6F1FA9B81C3BBBE Lightwell Security Advisory: quarkus-http-core 4.1.8.rhlw-00005

Red Hat Lightwell has released io.quarkus.http:quarkus-http-core 4.1.8.rhlw-00005 with backported fixes for CVE-2024-12397 and CVE-2024-3653. CVE-2024-12397: Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling CVE-2024-3653: Undertow: learningpushhandler can lead to remote memory dos...

RHLW-2026-C69885B4933C8262 Lightwell Security Advisory: xstream 1.4.18.rhlw-00006

Red Hat Lightwell has released com.thoughtworks.xstream:xstream 1.4.18.rhlw-00006 with backported fixes for CVE-2021-43859, CVE-2022-41966, and CVE-2024-47072. CVE-2021-43859: XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a...