deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-8hfc-fq58-r658
Package: org.springframework.boot:spring-boot-starter-actuator (MAVEN)
Severity: HIGH (CVSS 8.2)
CWE: CWE-288: Authentication Bypass Using an Alternate Path or Channel, CWE-306: Missing Authentication for Critical Function
Vulnerable versions: >= 4.0.0-M1, < 4.0.4
Patched in: 4.0.4

Summary: Spring Boot has an Authentication Bypass under Actuator Health groups paths

Details:
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path.
This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15.
This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.
GitHub Security Advisory: GHSA-8hfc-fq58-r658
Package: org.springframework.boot:spring-boot-starter-actuator (MAVEN)
Severity: HIGH (CVSS 8.2)
CWE: CWE-288: Authentication Bypass Using an Alternate Path or Channel, CWE-306: Missing Authentication for Critical Function
Vulnerable versions: >= 3.5.0, < 3.5.12
Patched in: 3.5.12

Summary: Spring Boot has an Authentication Bypass under Actuator Health groups paths

Details:
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path.
This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15.
This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.
GitHub Security Advisory: GHSA-8hfc-fq58-r658
Package: org.springframework.boot:spring-boot-starter-actuator (MAVEN)
Severity: HIGH (CVSS 8.2)
CWE: CWE-288: Authentication Bypass Using an Alternate Path or Channel, CWE-306: Missing Authentication for Critical Function
Vulnerable versions: >= 3.4.0, <= 3.4.13
Patched in: unpatched

Summary: Spring Boot has an Authentication Bypass under Actuator Health groups paths

Details:
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path.
This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15.
This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.
GitHub Security Advisory: GHSA-6hcq-hmm3-jj3c
Package: org.springframework:spring-webflux (MAVEN)
Severity: LOW (CVSS 2.6)
CWE: CWE-667: Improper Locking
Vulnerable versions: >= 5.3.0, <= 5.3.39
Patched in: unpatched

Summary: Spring MVC and WebFlux has Server Sent Event stream corruption

Details:
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
GitHub Security Advisory: GHSA-6hcq-hmm3-jj3c
Package: org.springframework:spring-webflux (MAVEN)
Severity: LOW (CVSS 2.6)
CWE: CWE-667: Improper Locking
Vulnerable versions: >= 6.0.0, <= 6.1.21
Patched in: unpatched

Summary: Spring MVC and WebFlux has Server Sent Event stream corruption

Details:
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
GitHub Security Advisory: GHSA-6hcq-hmm3-jj3c
Package: org.springframework:spring-webflux (MAVEN)
Severity: LOW (CVSS 2.6)
CWE: CWE-667: Improper Locking
Vulnerable versions: >= 6.2.0, < 6.2.17
Patched in: 6.2.17

Summary: Spring MVC and WebFlux has Server Sent Event stream corruption

Details:
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
GitHub Security Advisory: GHSA-6hcq-hmm3-jj3c
Package: org.springframework:spring-webflux (MAVEN)
Severity: LOW (CVSS 2.6)
CWE: CWE-667: Improper Locking
Vulnerable versions: >= 7.0.0-M1, < 7.0.6
Patched in: 7.0.6

Summary: Spring MVC and WebFlux has Server Sent Event stream corruption

Details:
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
GitHub Security Advisory: GHSA-6hcq-hmm3-jj3c
Package: org.springframework:spring-webmvc (MAVEN)
Severity: LOW (CVSS 2.6)
CWE: CWE-667: Improper Locking
Vulnerable versions: >= 5.3.0, <= 5.3.39
Patched in: unpatched

Summary: Spring MVC and WebFlux has Server Sent Event stream corruption

Details:
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
GitHub Security Advisory: GHSA-6hcq-hmm3-jj3c
Package: org.springframework:spring-webmvc (MAVEN)
Severity: LOW (CVSS 2.6)
CWE: CWE-667: Improper Locking
Vulnerable versions: >= 6.0.0, <= 6.1.21
Patched in: unpatched

Summary: Spring MVC and WebFlux has Server Sent Event stream corruption

Details:
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
GitHub Security Advisory: GHSA-6hcq-hmm3-jj3c
Package: org.springframework:spring-webmvc (MAVEN)
Severity: LOW (CVSS 2.6)
CWE: CWE-667: Improper Locking
Vulnerable versions: >= 6.2.0, < 6.2.17
Patched in: 6.2.17

Summary: Spring MVC and WebFlux has Server Sent Event stream corruption

Details:
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
GitHub Security Advisory: GHSA-6hcq-hmm3-jj3c
Package: org.springframework:spring-webmvc (MAVEN)
Severity: LOW (CVSS 2.6)
CWE: CWE-667: Improper Locking
Vulnerable versions: >= 7.0.0-M1, < 7.0.6
Patched in: 7.0.6

Summary: Spring MVC and WebFlux has Server Sent Event stream corruption

Details:
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
GitHub Security Advisory: GHSA-p9hg-wrmv-v8cp
Package: org.jenkins-ci.plugins:loadninja (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-312: Cleartext Storage of Sensitive Information
Vulnerable versions: < 2.2
Patched in: 2.2

Summary: Jenkins LoadNinja Plugin does not mask LoadNinja API keys displayed on the job configuration form

Details:
Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
GitHub Security Advisory: GHSA-2c4w-2px5-9x3x
Package: org.apache.axis:axis (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 1.2
Patched in: 1.2

Summary: Apache Axis allows Exposure of Sensitive Information to an Unauthorized Actor

Details:
Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
GitHub Security Advisory: GHSA-r6qv-frpc-q66c
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following'), CWE-61: UNIX Symbolic Link (Symlink) Following
Vulnerable versions: <= 2.554
Patched in: 2.555

Summary: Jenkins has a link following vulnerability allows arbitrary file creation

Details:
Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins.
This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.
GitHub Security Advisory: GHSA-mgp5-rv84-w37q
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 9.0.83, < 9.0.115
Patched in: 9.0.115

Summary: Apache Tomcat has an Improper Input Validation vulnerability

Details:
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.

This issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.


The following versions were EOL at the time the CVE was created but are 
known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.

Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.

Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.
GitHub Security Advisory: GHSA-mgp5-rv84-w37q
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 10.1.0-M7, < 10.1.52
Patched in: 10.1.52

Summary: Apache Tomcat has an Improper Input Validation vulnerability

Details:
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.

This issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.


The following versions were EOL at the time the CVE was created but are 
known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.

Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.

Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.
GitHub Security Advisory: GHSA-mgp5-rv84-w37q
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 11.0.0-M1, < 11.0.18
Patched in: 11.0.18

Summary: Apache Tomcat has an Improper Input Validation vulnerability

Details:
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.

This issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.


The following versions were EOL at the time the CVE was created but are 
known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.

Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.

Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.
GitHub Security Advisory: GHSA-mgp5-rv84-w37q
Package: org.apache.tomcat:tomcat-coyote (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 9.0.83, < 9.0.115
Patched in: 9.0.115

Summary: Apache Tomcat has an Improper Input Validation vulnerability

Details:
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.

This issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.


The following versions were EOL at the time the CVE was created but are 
known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.

Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.

Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.
GitHub Security Advisory: GHSA-mgp5-rv84-w37q
Package: org.apache.tomcat:tomcat-coyote (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 10.1.0-M7, < 10.1.52
Patched in: 10.1.52

Summary: Apache Tomcat has an Improper Input Validation vulnerability

Details:
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.

This issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.


The following versions were EOL at the time the CVE was created but are 
known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.

Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.

Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.
GitHub Security Advisory: GHSA-mgp5-rv84-w37q
Package: org.apache.tomcat:tomcat-coyote (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 11.0.0-M1, < 11.0.18
Patched in: 11.0.18

Summary: Apache Tomcat has an Improper Input Validation vulnerability

Details:
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.

This issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.


The following versions were EOL at the time the CVE was created but are 
known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.

Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.

Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.
GitHub Security Advisory: GHSA-qqjr-hf5h-jx3q
Package: org.jenkins-ci.plugins:loadninja (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-312: Cleartext Storage of Sensitive Information
Vulnerable versions: < 2.2
Patched in: 2.2

Summary: Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in job config.xml files

Details:
Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
GitHub Security Advisory: GHSA-phhv-63fh-rrc8
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-346: Origin Validation Error, CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action
Vulnerable versions: >= 2.442, < 2.555
Patched in: 2.555

Summary: Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation

Details:
Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding attacks that allow bypassing origin validation.
GitHub Security Advisory: GHSA-c267-rfvc-mvpm
Package: org.springframework.ai:spring-ai-mariadb-store (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 1.0.4
Patched in: 1.0.4

Summary: SQL Injection in Spring AI MariaDBFilterExpressionConverter

Details:
A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands.

The vulnerability exists due to missing input sanitization.
GitHub Security Advisory: GHSA-c267-rfvc-mvpm
Package: org.springframework.ai:spring-ai-mariadb-store (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 1.1.0-M1, < 1.1.3
Patched in: 1.1.3

Summary: SQL Injection in Spring AI MariaDBFilterExpressionConverter

Details:
A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands.

The vulnerability exists due to missing input sanitization.
GitHub Security Advisory: GHSA-rp9g-qx29-88cp
Package: org.springframework.ai:spring-ai-vector-store (MAVEN)
Severity: HIGH (CVSS 8.6)
CWE: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Vulnerable versions: < 1.0.4
Patched in: 1.0.4

Summary: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter

Details:
A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.

This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.

The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like ", ||, and && are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.
GitHub Security Advisory: GHSA-rp9g-qx29-88cp
Package: org.springframework.ai:spring-ai-vector-store (MAVEN)
Severity: HIGH (CVSS 8.6)
CWE: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Vulnerable versions: >= 1.1.0-M1, < 1.1.3
Patched in: 1.1.3

Summary: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter

Details:
A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.

This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.

The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like ", ||, and && are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.
GitHub Security Advisory: GHSA-xv6h-r36f-3gp5
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
Vulnerable versions: < 26.5.4
Patched in: 26.5.4

Summary: Keycloak: Denial of Service due to excessive SAMLRequest decompression

Details:
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.
GitHub Security Advisory: GHSA-xv6h-r36f-3gp5
Package: org.keycloak:keycloak-saml-core (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
Vulnerable versions: < 26.5.4
Patched in: 26.5.4

Summary: Keycloak: Denial of Service due to excessive SAMLRequest decompression

Details:
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.
GitHub Security Advisory: GHSA-xv6h-r36f-3gp5
Package: org.keycloak:keycloak-saml-adapter-core (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
Vulnerable versions: < 26.5.4
Patched in: 26.5.4

Summary: Keycloak: Denial of Service due to excessive SAMLRequest decompression

Details:
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.