RHLW-2026-4D628364A5512412 Lightwell Security Advisory: nimbus-jose-jwt 9.7.0.rhlw-00004

Red Hat Lightwell has released com.nimbusds:nimbus-jose-jwt 9.7.0.rhlw-00004 with a backported security fix. CVE-2025-53864: Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in...

RHLW-2026-6E6E3B76EDF3A10B Lightwell Security Advisory: mina-core 2.2.5.rhlw-00009

Red Hat Lightwell has released org.apache.mina:mina-core 2.2.5.rhlw-00009 with a backported security fix. CVE-2026-47065: Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232 This patched artifact is a drop-in replacement for org.apache.mina:mina-core 2.2.5 fr...

RHLW-2026-F43B17F69A51FEEE Lightwell Security Advisory: dom4j 1.6.1.rhlw-00004

Red Hat Lightwell has released dom4j:dom4j 1.6.1.rhlw-00004 with backported fixes for CVE-2018-1000632 and CVE-2020-10683. CVE-2018-1000632: dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in ...

RHLW-2026-2CB9A31C02A7F38B Lightwell Security Advisory: mina-filter-compression 2.2.5.rhlw-00008

Red Hat Lightwell has released org.apache.mina:mina-filter-compression 2.2.5.rhlw-00008 with a backported security fix. CVE-2026-47321: The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting siz...

RHLW-2026-3C10659B7340E612 Lightwell Security Advisory: assertj-core 3.18.1.rhlw-00003

Red Hat Lightwell has released org.assertj:assertj-core 3.18.1.rhlw-00003 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-422078E03066E6AC Lightwell Security Advisory: wss4j-ws-security-stax 4.0.1.rhlw-00003

Red Hat Lightwell has released org.apache.wss4j:wss4j-ws-security-stax 4.0.1.rhlw-00003 with a backported security fix. CVE-2026-92121: In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The...

RHLW-2026-E0E5640C50CEEA84 Lightwell Security Advisory: thymeleaf 3.0.15.RELEASE-rhlw-00009

Red Hat Lightwell has released org.thymeleaf:thymeleaf 3.0.15.RELEASE-rhlw-00009 with backported fixes for CVE-2026-40477, CVE-2026-40478, and CVE-2026-41901. CVE-2026-40477: Improper restriction of the scope of accessible objects in Thymeleaf expressions CVE-2026-40478: Improper neutralization o...

RHLW-2026-5E3F8CCB11A37BA5 Lightwell Security Advisory: neethi 3.2.2.rhlw-00028

Red Hat Lightwell has released org.apache.neethi:neethi 3.2.2.rhlw-00028 with backported fixes for CVE-2026-91863, CVE-2026-91865, CVE-2026-91866, and CVE-2026-91867. CVE-2026-91863: Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service...

RHLW-2026-B11ABDA52745AF4C Lightwell Security Advisory: tokenizers 0.23.1+rhlw.1

Red Hat Lightwell has released tokenizers 0.23.1+rhlw.1 with a backported security fix. CVE-2026-85670: tokenizers BpeBuilder Buffer Overflow via merge token This patched artifact is a drop-in replacement for tokenizers 0.23.1 from PyPI...

RHLW-2026-730F8211B080B586 Lightwell Security Advisory: logback-core 1.5.18.rhlw-00003

Red Hat Lightwell has released ch.qos.logback:logback-core 1.5.18.rhlw-00003 with a backported security fix. CVE-2026-1225: ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes...

RHLW-2026-B13520FAC3AB7893 Lightwell Security Advisory: opentelemetry-api 1.25.0.rhlw-00002

Red Hat Lightwell has released io.opentelemetry:opentelemetry-api 1.25.0.rhlw-00002 with a backported security fix. CVE-2026-45292: opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation This patched artifact is a drop-in replacement for io.opentelemetry:opentelemetry-api 1.25...

RHLW-2026-C5D9DDA1CBA52009 Lightwell Security Advisory: opentelemetry-api 1.28.0.rhlw-00002

Red Hat Lightwell has released io.opentelemetry:opentelemetry-api 1.28.0.rhlw-00002 with a backported security fix. CVE-2026-45292: opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation This patched artifact is a drop-in replacement for io.opentelemetry:opentelemetry-api 1.28...

RHLW-2026-E9343E476D7F9ACF Lightwell Security Advisory: snowflake-jdbc 3.26.1.rhlw-00004

Red Hat Lightwell has released net.snowflake:snowflake-jdbc 3.26.1.rhlw-00004 with a backported security fix. CVE-2026-3293: snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos This patched artifact is a drop-in replacement for net.snowflake:snowflake-jdbc...

RHLW-2026-9031FC90E5B99BD1 Lightwell Security Advisory: okio 3.0.0.rhlw-00004

Red Hat Lightwell has released com.squareup.okio:okio 3.0.0.rhlw-00004 with a backported security fix. CVE-2023-3635: Okio GzipSource unhandled exception Denial of Service This patched artifact is a drop-in replacement for com.squareup.okio:okio 3.0.0 from Maven Central...

RHLW-2026-F7C61B4B79130A3C Lightwell Security Advisory: kafka-clients 3.6.2.rhlw-00004

Red Hat Lightwell has released org.apache.kafka:kafka-clients 3.6.2.rhlw-00004 with backported fixes for CVE-2024-31141, CVE-2025-27817, CVE-2026-33558, and CVE-2026-35554. CVE-2024-31141: Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider...

RHLW-2026-03CCE96257578D24 Lightwell Security Advisory: cxf-rt-transports-jms 4.2.2.rhlw-00007

Red Hat Lightwell has released org.apache.cxf:cxf-rt-transports-jms 4.2.2.rhlw-00007 with a backported security fix. CVE-2026-66909: Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage This patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-transports-jms 4.2.2 from...

RHLW-2026-2CEEE64F37112E19 Lightwell Security Advisory: cxf-rt-rs-security-sso-oidc 3.6.9.rhlw-00002

Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-sso-oidc 3.6.9.rhlw-00002 with backported fixes for CVE-2026-57817 and CVE-2026-65583. CVE-2026-57817: Apache CXF: The authorization code hash chash is not enforced for the hybrid OIDC flow CVE-2026-65583: Apache CXF: Self-issued ID...

RHLW-2026-2D8697B26CCD16C3 Lightwell Security Advisory: cxf-rt-rs-security-oauth2 4.2.2.rhlw-00006

Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-oauth2 4.2.2.rhlw-00006 with backported fixes for CVE-2026-57818, CVE-2026-63687, CVE-2026-68079, and CVE-2026-68481. CVE-2026-57818: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider CVE-2026-63687:...

RHLW-2026-FD244C7EA4E4E9E4 Lightwell Security Advisory: cxf-rt-rs-security-oauth2 3.6.9.rhlw-00003

Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-oauth2 3.6.9.rhlw-00003 with backported fixes for CVE-2026-50623, CVE-2026-50627, CVE-2026-50628, CVE-2026-50629, CVE-2026-50630, CVE-2026-50631, CVE-2026-57818, CVE-2026-61466, CVE-2026-63687, CVE-2026-68079, and CVE-2026-68481...

RHLW-2026-685154D7989C42E9 Lightwell Security Advisory: commons-compress 1.9.0.rhlw-00005

Red Hat Lightwell has released org.apache.commons:commons-compress 1.9.0.rhlw-00005 with backported fixes for CVE-2018-11771, CVE-2021-35515, CVE-2021-35517, CVE-2021-36090, and CVE-2024-25710. CVE-2018-11771: When reading a specially crafted ZIP archive, the read method of Apache Commons Compres...

RHLW-2026-DBE0B911151FB6DD Lightwell Security Advisory: protobuf-javalite 3.21.7.rhlw-00002

Red Hat Lightwell has released com.google.protobuf:protobuf-javalite 3.21.7.rhlw-00002 with a backported security fix. CVE-2024-7254: Stack overflow in Protocol Buffers Java Lite This patched artifact is a drop-in replacement for com.google.protobuf:protobuf-javalite 3.21.7 from Maven Central...

RHLW-2026-9FA472B9239A3A7E Lightwell Security Advisory: avro-compiler 1.9.2.rhlw-00002

Red Hat Lightwell has released org.apache.avro:avro-compiler 1.9.2.rhlw-00002 with a backported security fix. CVE-2025-33042: Apache Avro Java SDK: Code injection on Java generated code This patched artifact is a drop-in replacement for org.apache.avro:avro-compiler 1.9.2 from Maven Central...

RHLW-2026-C317E2781FF17B2F Lightwell Security Advisory: jetty-http 12.0.32.rhlw-00002

Red Hat Lightwell has released org.eclipse.jetty:jetty-http 12.0.32.rhlw-00002 with a backported security fix. CVE-2026-2332: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing This patched artifact is a drop-in replacement for org.eclipse.jetty:jetty-http 12.0.32 from Maven Centr...

RHLW-2026-0436667CEE7724A6 Lightwell Security Advisory: apache-mime4j-dom 0.8.9.rhlw-00004

Red Hat Lightwell has released org.apache.james:apache-mime4j-dom 0.8.9.rhlw-00004 with a backported security fix. CVE-2024-21742: Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add...

RHLW-2026-16C4875677D98603 Lightwell Security Advisory: mina-core 2.2.5.rhlw-00002

Red Hat Lightwell has released org.apache.mina:mina-core 2.2.5.rhlw-00002 with a backported security fix. CVE-2026-41635: Apache MINA: AbstractIoBuffer.resolveClass null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE This patched artifact is a drop-in replacement for...

RHLW-2026-9020B77E982DA216 Lightwell Security Advisory: sshd-git 2.19.0.rhlw-00003

Red Hat Lightwell has released org.apache.sshd:sshd-git 2.19.0.rhlw-00003 with a backported security fix. This patched artifact is a drop-in replacement for org.apache.sshd:sshd-git 2.19.0 from Maven Central...

RHLW-2026-02416B185203289C Lightwell Security Advisory: netty-codec-dns 4.1.132.Final-rhlw-00002

Red Hat Lightwell has released io.netty:netty-codec-dns 4.1.132.Final-rhlw-00002 with a backported security fix. CVE-2026-42579: Netty: DNS Codec Input Validation Bypass in Netty Encoder + Decoder This patched artifact is a drop-in replacement for io.netty:netty-codec-dns 4.1.132.Final from Maven...

RHLW-2026-109B0867DB5B9DDE Lightwell Security Advisory: cxf-rt-transports-jms 3.6.9.rhlw-00004

Red Hat Lightwell has released org.apache.cxf:cxf-rt-transports-jms 3.6.9.rhlw-00004 with backported fixes for CVE-2026-44417, CVE-2026-50632, and CVE-2026-66909. CVE-2026-44417: Apache CXF: Incomplete fix for CVE-2025-48913 Untrusted JMS configuration can lead to RCE CVE-2026-50632: Apache CXF:...

RHLW-2026-CF52DC28CCB66C72 Lightwell Security Advisory: cxf-rt-rs-security-sso-oidc 4.2.2.rhlw-00008

Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-sso-oidc 4.2.2.rhlw-00008 with backported fixes for CVE-2026-57817 and CVE-2026-65583. CVE-2026-57817: Apache CXF: The authorization code hash chash is not enforced for the hybrid OIDC flow CVE-2026-65583: Apache CXF: Self-issued ID...

RHLW-2026-F1A22CABC5A36F13 Lightwell Security Advisory: xstream 1.4.20.rhlw-00001

Red Hat Lightwell has released com.thoughtworks.xstream:xstream 1.4.20.rhlw-00001 with a backported security fix. CVE-2024-47072: XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream This patched artifact is a drop-in replacement for...

RHLW-2026-F06E820781099AD6 Lightwell Security Advisory: assertj-core 3.27.4.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 3.27.4.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-EE4B4A9CCFE02127 Lightwell Security Advisory: zookeeper 3.5.8.rhlw-00001

Red Hat Lightwell has released org.apache.zookeeper:zookeeper 3.5.8.rhlw-00001 with a backported security fix. CVE-2023-44981: Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication This patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper 3.5.8 from Mav...

RHLW-2026-EDFFB5D3BB599FF9 Lightwell Security Advisory: assertj-core 3.27.3.rhlw-00002

Red Hat Lightwell has released org.assertj:assertj-core 3.27.3.rhlw-00002 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-EA9F6FE6976A39AA Lightwell Security Advisory: xmlunit-core 2.8.4.rhlw-00001

Red Hat Lightwell has released org.xmlunit:xmlunit-core 2.8.4.rhlw-00001 with a backported security fix. CVE-2024-31573: XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet used for an XSLT transformation, because XSLT extension...

RHLW-2026-E5ADAE5B227184E1 Lightwell Security Advisory: xmlunit-core 2.9.1.rhlw-00002

Red Hat Lightwell has released org.xmlunit:xmlunit-core 2.9.1.rhlw-00002 with a backported security fix. CVE-2024-31573: XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet used for an XSLT transformation, because XSLT extension...

RHLW-2026-D16850B6ED26ED8A Lightwell Security Advisory: assertj-core 3.27.2.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 3.27.2.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-D0894948A3363188 Lightwell Security Advisory: assertj-core 3.26.3.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 3.26.3.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-C7695B3B26607B57 Lightwell Security Advisory: snakeyaml 1.30.0.rhlw-00013

Red Hat Lightwell has released org.yaml:snakeyaml 1.30.0.rhlw-00013 with backported fixes for CVE-2022-38750, CVE-2022-38751, CVE-2022-38752, and CVE-2022-41854. CVE-2022-38750: DoS in SnakeYAML CVE-2022-38751: DoS in SnakeYAML CVE-2022-38752: DoS in SnakeYAML CVE-2022-41854: Stack Overflow in...

RHLW-2026-C47EB74B897B797C Lightwell Security Advisory: assertj-core 3.27.5.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 3.27.5.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-B7941F01D48EB65E Lightwell Security Advisory: assertj-core 3.25.0.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 3.25.0.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-B2C0EE9CF7434158 Lightwell Security Advisory: assertj-core 3.24.1.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 3.24.1.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-97A6348484D7BBF1 Lightwell Security Advisory: log4j-core 2.24.3.rhlw-00004

Red Hat Lightwell has released org.apache.logging.log4j:log4j-core 2.24.3.rhlw-00004 with backported fixes for CVE-2025-68161, CVE-2026-34477, CVE-2026-34478, and CVE-2026-34480. CVE-2025-68161: Apache Log4j Core: Missing TLS hostname verification in Socket appender CVE-2026-34477: Apache Log4j...

RHLW-2026-91AEDC27B0276F09 Lightwell Security Advisory: assertj-core 3.25.3.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 3.25.3.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-8E630EFEDD4A966B Lightwell Security Advisory: assertj-core 3.27.0.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 3.27.0.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-68F6300FE5CDDF04 Lightwell Security Advisory: assertj-core 3.27.6.rhlw-00002

Red Hat Lightwell has released org.assertj:assertj-core 3.27.6.rhlw-00002 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-5EB0CB8050278DB4 Lightwell Security Advisory: protobuf-kotlin-lite 3.21.7.rhlw-00002

Red Hat Lightwell has released com.google.protobuf:protobuf-kotlin-lite 3.21.7.rhlw-00002 with a backported security fix. CVE-2024-7254: Stack overflow in Protocol Buffers Java Lite This patched artifact is a drop-in replacement for com.google.protobuf:protobuf-kotlin-lite 3.21.7 from Maven Centr...

RHLW-2026-4B923E6A0C9408D7 Lightwell Security Advisory: assertj-core 3.25.1.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 3.25.1.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-36D9ED0BB47C794F Lightwell Security Advisory: woodstox-core 6.2.2.rhlw-00004

Red Hat Lightwell has released com.fasterxml.woodstox:woodstox-core 6.2.2.rhlw-00004 with a backported security fix. CVE-2022-40152: Stack Buffer Overflow in Woodstox This patched artifact is a drop-in replacement for com.fasterxml.woodstox:woodstox-core 6.2.2 from Maven Central...

RHLW-2026-27CC0B801A76F59B Lightwell Security Advisory: zookeeper 3.5.7.rhlw-00001

Red Hat Lightwell has released org.apache.zookeeper:zookeeper 3.5.7.rhlw-00001 with a backported security fix. CVE-2023-44981: Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication This patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper 3.5.7 from Mav...

RHLW-2026-1716354E811DCC0A Lightwell Security Advisory: zookeeper 3.5.9.rhlw-00001

Red Hat Lightwell has released org.apache.zookeeper:zookeeper 3.5.9.rhlw-00001 with a backported security fix. CVE-2023-44981: Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication This patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper 3.5.9 from Mav...