Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

CVE-2026-59899

### Impact `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-chann

历史摘要 · 未重新核验 · GitHub Advisory

Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

CVE-2026-59898

## Summary An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version

历史摘要 · 未重新核验 · GitHub Advisory

Netty: TOCTOU in OcspServerCertificateValidator

CVE-2026-56822

### Summary Netty's OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP

历史摘要 · 未重新核验 · GitHub Advisory

Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator

CVE-2026-56821

### Summary `OcspServerCertificateValidator` flags an out-of-date OCSP response but does not stop processing it, so an e

历史摘要 · 未重新核验 · GitHub Advisory

Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

CVE-2026-56820

### Summary Netty's OcspClient does not validate that the CertificateID in an OCSP response matches the requested Certif

历史摘要 · 未重新核验 · GitHub Advisory

Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling

CVE-2026-56817

Any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a DOCTYPE declar

历史摘要 · 未重新核验 · GitHub Advisory

Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types

CVE-2026-56816

### Summary Netty's Http3FrameCodec buffers incoming data for HTTP/3 reserved frame types up to the specified payload le

历史摘要 · 未重新核验 · GitHub Advisory

Netty: Security Control Bypass via CORS Short-Circuit Failure

CVE-2026-56746

### Summary Netty's CorsHandler provides a `shortCircuit()` configuration designed to reject unauthorized cross-origin r

历史摘要 · 未重新核验 · GitHub Advisory

Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion

CVE-2026-56745

The `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initia

历史摘要 · 未重新核验 · GitHub Advisory

jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization

CVE-2026-59889

## Summary `UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property by it

历史摘要 · 未重新核验 · GitHub Advisory

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

## Summary The fix released in jackson-core `2.18.6` and `2.21.1` for [GHSA-72hv-8253-57qq](https://github.com/FasterXM

历史摘要 · 未重新核验 · GitHub Advisory

AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance

CVE-2026-11400

Aurora PostgreSQL is a fully managed relational database engine that's compatible with PostgreSQL. The team has identif

历史摘要 · 未重新核验 · GitHub Advisory

ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handlers bypass authorization

About 14 HTTP handlers resolve the {database} path param and call getDatabase(...) WITHOUT user.canAccessToDatabase(...)

历史摘要 · 未重新核验 · GitHub Advisory

ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js

The GHSA-48qw-824m-86pr hardening added a checkPermissionsOnDatabase(UPDATE_SECURITY) gate on the polyglot engine (Polyg

历史摘要 · 未重新核验 · GitHub Advisory

ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)

ScriptTriggerExecutor sets allowedPackages to java.lang.*, java.util.*, java.time.*, java.math.* (ScriptTriggerExecutor.

历史摘要 · 未重新核验 · GitHub Advisory

ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

### Impact A user holding only `reader` (read-only) privileges on a single database could execute arbitrary JVM code by

历史摘要 · 未重新核验 · GitHub Advisory

ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

CVE-2026-54076

### Impact The fix for CVE-2026-44221 (GHSA-fxc7-fm93-6q77) added an `UPDATE_SCHEMA` authorization check to a single sc

历史摘要 · 未重新核验 · GitHub Advisory

ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

CVE-2026-54077

### Impact The SQL `IMPORT DATABASE` statement did not require administrative privileges and passed its source URL to t

历史摘要 · 未重新核验 · GitHub Advisory

dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS

CVE-2026-50270

### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without

历史摘要 · 未重新核验 · GitHub Advisory

Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder

CVE-2026-44891

### Summary The StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, allo

历史摘要 · 未重新核验 · GitHub Advisory