RHLW-2026-09128B29F89DC8ED Lightwell Security Advisory: jackson-databind 2.17.3.rhlw-00013

Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.17.3.rhlw-00013 with backported fixes for CVE-2026-83557, CVE-2026-54512, CVE-2026-54515, CVE-2026-19032, CVE-2026-77310, CVE-2026-54514, CVE-2026-59888, and CVE-2026-54513. CVE-2026-83557: jackson-databind omits...

RHLW-2026-6DD67008E326A981 Lightwell Security Advisory: avro 1.9.2.rhlw-00002

Red Hat Lightwell has released org.apache.avro:avro 1.9.2.rhlw-00002 with backported fixes for CVE-2024-47561 and CVE-2025-33042. CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema Java SDK CVE-2025-33042: Apache Avro Java SDK: Code injection on Java generated...

RHLW-2026-821EAAB8409C2A61 Lightwell Security Advisory: pypdf2 3.0.1+rhlw.1

Red Hat Lightwell has released pypdf2 3.0.1+rhlw.1 with a backported security fix. CVE-2023-36464: Infinite Loop when a comment isn't followed by a character in pypdf This patched artifact is a drop-in replacement for pypdf2 3.0.1 from PyPI...

RHLW-2026-21709A248F2EEB7D Lightwell Security Advisory: logback-classic 1.6.1.rhlw-00001

Red Hat Lightwell has released ch.qos.logback:logback-classic 1.6.1.rhlw-00001 with a backported security fix. This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.6.1 from Maven Central...

RHLW-2026-EAA1BBE31B9D0CC3 Lightwell Security Advisory: jsoup 1.7.2.rhlw-00001

Red Hat Lightwell has released org.jsoup:jsoup 1.7.2.rhlw-00001 with backported fixes for CVE-2015-6748 and CVE-2021-37714. CVE-2015-6748: Cross-site scripting XSS vulnerability in jsoup before 1.8.3. CVE-2021-37714: jsoup is a Java library for working with HTML. Those using jsoup versions prior ...

RHLW-2026-41BD2185E6D22E15 Lightwell Security Advisory: avro 1.11.0.rhlw-00002

Red Hat Lightwell has released org.apache.avro:avro 1.11.0.rhlw-00002 with backported fixes for CVE-2023-39410 and CVE-2024-47561. CVE-2023-39410: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when...

RHLW-2026-ED15C0B8D4D51966 Lightwell Security Advisory: junrar 7.5.5.rhlw-00001

Red Hat Lightwell has released com.github.junrar:junrar 7.5.5.rhlw-00001 with a backported security fix. CVE-2026-41245: Junrar: Path Traversal Zip-Slip via Sibling Directory Name Prefix This patched artifact is a drop-in replacement for com.github.junrar:junrar 7.5.5 from Maven Central...

RHLW-2026-666A4E7D1066F856 Lightwell Security Advisory: logback-core 1.5.16.rhlw-00002

Red Hat Lightwell has released ch.qos.logback:logback-core 1.5.16.rhlw-00002 with a backported security fix. CVE-2026-10532: Logback deserialization whitelist bypass for Proxy objects This patched artifact is a drop-in replacement for ch.qos.logback:logback-core 1.5.16 from Maven Central...

RHLW-2026-804D65DF1A73952A Lightwell Security Advisory: jackson-databind 2.18.0.rhlw-00010

Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.18.0.rhlw-00010 with backported fixes for CVE-2026-19032, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-59888, CVE-2026-59889, and CVE-2026-83557. CVE-2026-19032: jackson-databind resolves attacker-controlled...

RHLW-2026-5049B13F770FEE17 Lightwell Security Advisory: commons-lang3 3.17.0.rhlw-00011

Red Hat Lightwell has released org.apache.commons:commons-lang3 3.17.0.rhlw-00011 with a backported security fix. CVE-2025-48924: Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass... can throw a StackOverflowError on very long inputs This patched artifact is a drop-in replacement for...

RHLW-2026-CC6F4A613453615E Lightwell Security Advisory: esapi 2.3.0.0-rhlw-00005

Red Hat Lightwell has released org.owasp.esapi:esapi 2.3.0.0-rhlw-00005 with a backported security fix. CVE-2025-5878: ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special element This patched artifact is a drop-in replacement for org.owasp.esapi:esapi 2.3.0.0 from Maven...

RHLW-2026-91A888529DD87FBC Lightwell Security Advisory: gson 2.8.6.rhlw-00002

Red Hat Lightwell has released com.google.code.gson:gson 2.8.6.rhlw-00002 with a backported security fix. CVE-2022-25647: Deserialization of Untrusted Data This patched artifact is a drop-in replacement for com.google.code.gson:gson 2.8.6 from Maven Central...

RHLW-2026-53FE7BBF25EA635A Lightwell Security Advisory: neethi 3.2.1.rhlw-00003

Red Hat Lightwell has released org.apache.neethi:neethi 3.2.1.rhlw-00003 with a backported security fix. CVE-2026-42402: Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS This patched artifact is a drop-in replacement for org.apache.neethi:neethi 3.2.1 from Maven Central...

RHLW-2026-81384C14BC892E51 Lightwell Security Advisory: thymeleaf 3.0.15.RELEASE-rhlw-00003

Red Hat Lightwell has released org.thymeleaf:thymeleaf 3.0.15.RELEASE-rhlw-00003 with a backported security fix. CVE-2023-38286: Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may b...

RHLW-2026-8FD370B9B3E9924A Lightwell Security Advisory: spring-security-core 6.5.7.rhlw-00002

Red Hat Lightwell has released org.springframework.security:spring-security-core 6.5.7.rhlw-00002 with backported fixes for CVE-2026-22746 and CVE-2026-22751. CVE-2026-22746: User Attribute Enumeration when Using DaoAuthenticationProvider CVE-2026-22751: Spring Security JdbcOneTimeTokenService...

RHLW-2026-4AA7EBDFD0B8C810 Lightwell Security Advisory: commons-io 2.8.0.rhlw-00002

Red Hat Lightwell has released commons-io:commons-io 2.8.0.rhlw-00002 with a backported security fix. CVE-2024-47554: Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader This patched artifact is a drop-in replacement for commons-io:commons-io 2.8.0 from Mave...

RHLW-2026-67695BC80DE4B2E2 Lightwell Security Advisory: zookeeper 3.8.3.rhlw-00003

Red Hat Lightwell has released org.apache.zookeeper:zookeeper 3.8.3.rhlw-00003 with a backported security fix. CVE-2026-24281: Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager This patched artifact is a drop-in replacement for...

RHLW-2026-49443DA84312BD4D Lightwell Security Advisory: jakarta.mail 1.6.7.rhlw-00001

Red Hat Lightwell has released com.sun.mail:jakarta.mail 1.6.7.rhlw-00001 with a backported security fix. CVE-2025-7962: In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages. This patched...

RHLW-2026-DD1828F1F23F1AE5 Lightwell Security Advisory: jackson-databind 2.11.3.rhlw-00004

Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.11.3.rhlw-00004 with backported fixes for CVE-2020-36518, CVE-2022-42004, and CVE-2021-46877. CVE-2020-36518: jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth o...

RHLW-2026-75DB1A29FED8473F Lightwell Security Advisory: assertj-core 3.17.2.rhlw-00002

Red Hat Lightwell has released org.assertj:assertj-core 3.17.2.rhlw-00002 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-F4501C345C2F2E8B Lightwell Security Advisory: assertj-core 3.17.1.rhlw-00003

Red Hat Lightwell has released org.assertj:assertj-core 3.17.1.rhlw-00003 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-04395E330CC28CB3 Lightwell Security Advisory: assertj-core 3.16.0.rhlw-00004

Red Hat Lightwell has released org.assertj:assertj-core 3.16.0.rhlw-00004 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-E6EC7DDDAA32B002 Lightwell Security Advisory: assertj-core 3.24.2.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 3.24.2.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-AFDAB2228D9D349B Lightwell Security Advisory: assertj-core 2.9.0.rhlw-00002

Red Hat Lightwell has released org.assertj:assertj-core 2.9.0.rhlw-00002 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-621A8FC2F80D3756 Lightwell Security Advisory: assertj-core 3.26.0.rhlw-00004

Red Hat Lightwell has released org.assertj:assertj-core 3.26.0.rhlw-00004 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-44BCD6E79804E6F9 Lightwell Security Advisory: assertj-core 3.9.1.rhlw-00005

Red Hat Lightwell has released org.assertj:assertj-core 3.9.1.rhlw-00005 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-8213CB2F9FA5E4F3 Lightwell Security Advisory: assertj-core 3.17.0.rhlw-00002

Red Hat Lightwell has released org.assertj:assertj-core 3.17.0.rhlw-00002 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-533C8DF135D5B52E Lightwell Security Advisory: kafka-clients 3.9.1.rhlw-00001

Red Hat Lightwell has released org.apache.kafka:kafka-clients 3.9.1.rhlw-00001 with backported fixes for CVE-2026-33558 and CVE-2026-35554. CVE-2026-33558: Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output CVE-2026-35554: Apache Kafka Clients: Kafka Produc...

RHLW-2026-36BDDA9F7CE1C5CB Lightwell Security Advisory: logback-classic 1.2.12.rhlw-00005

Red Hat Lightwell has released ch.qos.logback:logback-classic 1.2.12.rhlw-00005 with backported fixes for CVE-2023-6378 and CVE-2024-12801. CVE-2023-6378: Logback "receiver" DOS vulnerability CVE-2024-12801: Server-Side Request Forgery SSRF in SaxEventRecorder by QOS.CH logback version 0.1 to...

RHLW-2026-D0749BC5EF98B166 Lightwell Security Advisory: jsch 0.2.1.rhlw-00004

Red Hat Lightwell has released com.github.mwiede:jsch 0.2.1.rhlw-00004 with a backported security fix. CVE-2023-48795: The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some...

RHLW-2026-CF15E492F63E9E38 Lightwell Security Advisory: jsoup 1.15.1.rhlw-00001

Red Hat Lightwell has released org.jsoup:jsoup 1.15.1.rhlw-00001 with a backported security fix. CVE-2022-36033: jsoup may not sanitize Cross-Site Scripting XSS attempts if SafeList.preserveRelativeLinks is enabled This patched artifact is a drop-in replacement for org.jsoup:jsoup 1.15.1 from Mav...

RHLW-2026-196E0BD4DF0804A6 Lightwell Security Advisory: spring-boot 2.7.18.rhlw-00004

Red Hat Lightwell has released org.springframework.boot:spring-boot 2.7.18.rhlw-00004 with backported fixes for CVE-2025-22235 and CVE-2026-40973. CVE-2026-40973: A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When...

RHLW-2026-25544E781D50B856 Lightwell Security Advisory: spring-expression 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-expression 5.3.18.rhlw-00010 with backported fixes for CVE-2023-20860, CVE-2025-41249, CVE-2024-38816, CVE-2024-22243, CVE-2024-38808, CVE-2023-20863, and CVE-2023-20861. CVE-2023-20860: Spring Framework running version 6.0.0 - 6.0.6 or...

RHLW-2026-EEB3D4215BEAE0D6 Lightwell Security Advisory: spring-security-web 5.7.11.rhlw-00006

Red Hat Lightwell has released org.springframework.security:spring-security-web 5.7.11.rhlw-00006 with backported fixes for CVE-2024-38821 and CVE-2026-22732. CVE-2026-22732: Under Some Conditions Spring Security HTTP Headers Are not Written This patched artifact is a drop-in replacement for...