https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 14:50:06 +0000 https://db.gcve.eu/vuln/certfr-2026-avi-1165 certfr-2026-avi-1165 https://db.gcve.eu/vuln/certfr-2026-avi-1165 https://db.gcve.eu/vuln/cleanstart-2026-ah35927 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: wso2is</p> <p>Multiple security vulnerabilities affect the wso2is package. DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: wso2is</p> <p>Multiple security vulnerabilities affect the wso2is package. DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. See references for individual vulnerability details.</p> https://db.gcve.eu/vuln/cleanstart-2026-ah35927 https://db.gcve.eu/vuln/fkie_cve-2026-64607 <p>HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.</p> <p>This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.</p> <p>HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.</p> <p>This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.</p> https://db.gcve.eu/vuln/fkie_cve-2026-64607 https://db.gcve.eu/vuln/ghsa-hjcp-jmpx-g3qm <p><strong>Affected:</strong> Maven: org.apache.httpcomponents.client5:httpclient5</p> <p>HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.</p> <p>This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.</p> <p><strong>Affected:</strong> Maven: org.apache.httpcomponents.client5:httpclient5</p> <p>HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.</p> <p>This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.</p> https://db.gcve.eu/vuln/ghsa-hjcp-jmpx-g3qm https://db.gcve.eu/vuln/opensuse-su-2026:11647-1 <p>httpcomponents-client-4.5.14-2.1 on GA media</p> <p>httpcomponents-client-4.5.14-2.1 on GA media</p> https://db.gcve.eu/vuln/opensuse-su-2026:11647-1 https://db.gcve.eu/vuln/rhsa-2026:60239 <p>jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409) Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass mina: mina: Arbitrary Code Execution via Deserialization Bypass jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration jenkins: Jenkins: Phishing attack via improper red…</p> <p>jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409) Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass mina: mina: Arbitrary Code Execution via Deserialization Bypass jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration jenkins: Jenkins: Phishing attack via improper red…</p> https://db.gcve.eu/vuln/rhsa-2026:60239 https://db.gcve.eu/vuln/ubuntu-cve-2026-64607 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: commons-httpclient, Ubuntu:Pro:14.04:LTS: httpcomponents-client, Ubuntu:16.04:LTS: commons-httpclient, Ubuntu:Pro:16.04:LTS: httpcomponents-client, Ubuntu:18.04:LTS: commons-httpclient, Ubuntu:Pro:18.04:LTS: httpcomponents-client, Ubuntu:20.04:LTS: commons-httpclient, Ubuntu:Pro:20.04:LTS: httpcomponents-client, Ubuntu:22.04:LTS: commons-httpclient, Ubuntu:22.04:LTS: httpcomponents-client and 4 more</p> <p>HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: commons-httpclient, Ubuntu:Pro:14.04:LTS: httpcomponents-client, Ubuntu:16.04:LTS: commons-httpclient, Ubuntu:Pro:16.04:LTS: httpcomponents-client, Ubuntu:18.04:LTS: commons-httpclient, Ubuntu:Pro:18.04:LTS: httpcomponents-client, Ubuntu:20.04:LTS: commons-httpclient, Ubuntu:Pro:20.04:LTS: httpcomponents-client, Ubuntu:22.04:LTS: commons-httpclient, Ubuntu:22.04:LTS: httpcomponents-client and 4 more</p> <p>HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-64607 https://db.gcve.eu/vuln/wid-sec-w-2026-2615 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache HttpComponents ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache HttpComponents ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://db.gcve.eu/vuln/wid-sec-w-2026-2615