deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-xxh7-fcf3-rj7f
Package: org.eclipse.jetty:jetty-server (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-401: Missing Release of Memory after Effective Lifetime
Vulnerable versions: >= 12.1.0, <= 12.1.5
Patched in: 12.1.6

Summary: The Eclipse Jetty Server Artifact has a Gzip request memory leak 

Details:
### Description (as reported)

There is a memory leak when using `GzipHandler` in jetty-12.0.30 that can cause off-heap OOMs. This can be used for DoS attacks so I'm reporting this as a vulnerability.

The leak is created by requests where the request is inflated (`Content-Encoding: gzip`) and the response is not deflated (no `Accept-Encoding: gzip`). In these conditions, a new inflator will be created by `GzipRequest` and never released back into `GzipRequest.__inflaterPool` because `gzipRequest.destory()` is not called.

In heap dumps one can see thousands of `java.util.zip.Inflator` objects, which use both Java heaps and native memory. Leaking native memory causes of off-heap OOMs.

Code path in `GzipHandler.handle()`:
1. Line 601: `GzipRequest` is created when request inflation is needed.
2. Lines 611-616: The callback is only wrapped in `GzipResponseAndCallback` when both inflation and deflation are needed.
3. Lines 619-625: If the handler accepts the request (returns true), `gzipRequest.destroy()` is only called in the "request not accepted" path (returns false)

When deflation is needed, `GzipResponseAndCallback` (lines 102 and 116) properly calls `gzipRequest.destroy()` in its `succeeded()` and `failed()` methods. But this wrapper is only created when deflation is needed.

Possible fix:
The callback should be wrapped whenever a `GzipRequest` is created, not just when deflation is needed. This ensures `gzipRequest.destroy()` is always called when the request completes.


### Impact
The leak causes the JVM to crash with OOME.

### Patches
No patches yet.

### Workarounds
Disable `GzipHandler`.

### References
https://github.com/jetty/jetty.project/issues/14260

https://gitlab.eclipse.org/security/cve-assignment/-/issues/79
GitHub Security Advisory: GHSA-fw88-pf9m-p947
Package: org.apache.artemis:artemis-server (MAVEN)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: >= 2.50.0, < 2.52.0
Patched in: 2.52.0

Summary: Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions

Details:
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both:

- Incoming Core protocol connections from untrusted sources to the broker

- Outgoing Core protocol connections from the broker to untrusted targets

This issue affects:

- Apache Artemis from 2.50.0 through 2.51.0

- Apache ActiveMQ Artemis from 2.11.0 through 2.44.0.

Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue.

The issue can be mitigated by either of the following:

- Remove Core protocol support from any acceptor receiving connections from untrusted sources. Incoming Core protocol connections are supported by default via the "artemis" acceptor listening on port 61616. See the "protocols" URL parameter configured for the acceptor. An acceptor URL without this parameter supports all protocols by default, including Core.

- Use two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper SSL certificate when establishing a connection before any message protocol handshake is attempted. This will prevent unauthenticated exploitation of this vulnerability.
GitHub Security Advisory: GHSA-fw88-pf9m-p947
Package: org.apache.activemq:artemis-server (MAVEN)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: >= 2.11.0, <= 2.44.0
Patched in: unpatched

Summary: Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions

Details:
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both:

- Incoming Core protocol connections from untrusted sources to the broker

- Outgoing Core protocol connections from the broker to untrusted targets

This issue affects:

- Apache Artemis from 2.50.0 through 2.51.0

- Apache ActiveMQ Artemis from 2.11.0 through 2.44.0.

Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue.

The issue can be mitigated by either of the following:

- Remove Core protocol support from any acceptor receiving connections from untrusted sources. Incoming Core protocol connections are supported by default via the "artemis" acceptor listening on port 61616. See the "protocols" URL parameter configured for the acceptor. An acceptor URL without this parameter supports all protocols by default, including Core.

- Use two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper SSL certificate when establishing a connection before any message protocol handshake is attempted. This will prevent unauthenticated exploitation of this vulnerability.
GitHub Security Advisory: GHSA-c825-6ph3-4h84
Package: org.apache.activemq:activemq-mqtt (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: = 6.2.0
Patched in: 6.2.1

Summary: Apache ActiveMQ is Vulnerable to Integer Overflow or Wraparound

Details:
Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted.

This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0

Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.
GitHub Security Advisory: GHSA-c825-6ph3-4h84
Package: org.apache.activemq:activemq-mqtt (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: >= 6.0.0, < 6.1.9
Patched in: 6.1.9

Summary: Apache ActiveMQ is Vulnerable to Integer Overflow or Wraparound

Details:
Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted.

This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0

Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.
GitHub Security Advisory: GHSA-c825-6ph3-4h84
Package: org.apache.activemq:activemq-mqtt (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: < 5.19.2
Patched in: 5.19.2

Summary: Apache ActiveMQ is Vulnerable to Integer Overflow or Wraparound

Details:
Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted.

This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0

Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.
GitHub Security Advisory: GHSA-c825-6ph3-4h84
Package: org.apache.activemq:activemq-all (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: = 6.2.0
Patched in: 6.2.1

Summary: Apache ActiveMQ is Vulnerable to Integer Overflow or Wraparound

Details:
Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted.

This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0

Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.
GitHub Security Advisory: GHSA-c825-6ph3-4h84
Package: org.apache.activemq:activemq-all (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: >= 6.0.0, < 6.1.9
Patched in: 6.1.9

Summary: Apache ActiveMQ is Vulnerable to Integer Overflow or Wraparound

Details:
Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted.

This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0

Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.
GitHub Security Advisory: GHSA-c825-6ph3-4h84
Package: org.apache.activemq:activemq-all (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: < 5.19.2
Patched in: 5.19.2

Summary: Apache ActiveMQ is Vulnerable to Integer Overflow or Wraparound

Details:
Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted.

This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0

Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.
GitHub Security Advisory: GHSA-c825-6ph3-4h84
Package: org.apache.activemq:apache-activemq (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: = 6.2.0
Patched in: 6.2.1

Summary: Apache ActiveMQ is Vulnerable to Integer Overflow or Wraparound

Details:
Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted.

This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0

Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.
GitHub Security Advisory: GHSA-c825-6ph3-4h84
Package: org.apache.activemq:apache-activemq (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: >= 6.0.0, < 6.1.9
Patched in: 6.1.9

Summary: Apache ActiveMQ is Vulnerable to Integer Overflow or Wraparound

Details:
Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted.

This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0

Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.
GitHub Security Advisory: GHSA-c825-6ph3-4h84
Package: org.apache.activemq:apache-activemq (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: < 5.19.2
Patched in: 5.19.2

Summary: Apache ActiveMQ is Vulnerable to Integer Overflow or Wraparound

Details:
Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted.

This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0

Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.
GitHub Security Advisory: GHSA-6v53-7c9g-w56r
Package: tools.jackson.core:jackson-core (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 3.0.0, < 3.1.0
Patched in: 3.1.0

Summary: jackson-core has Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion

Details:
### Summary
The `UTF8DataInputJsonParser`, which is used when parsing from a `java.io.DataInput` source, bypasses the `maxNestingDepth` constraint (default: 500) defined in `StreamReadConstraints`.

A similar issue was found in `ReaderBasedJsonParser`.

This allows a user to supply a JSON document with excessive nesting, which can cause a `StackOverflowError` when the structure is processed, leading to a Denial of Service (DoS).

The related fix for com.fasterxml.jackson.core:jackson-core, CVE-2025-52999, was not fully applied to tools.jackson.core:jackson-core until the 3.1.0 release. It is recommended that 3.0.x users upgrade.

### Patches
jackson-core contains a configurable limit for how deep Jackson will traverse in an input document. This check was missing in a few places in tools.jackson.core:jackson-core. 

The change is in https://github.com/FasterXML/jackson-core/pull/1554. jackson-core will throw a StreamConstraintsException if the limit is reached.

jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs.

### Workarounds
Users should avoid parsing input files from untrusted sources.

### Resources
[GHSA-6v53-7c9g-w56r](https://github.com/FasterXML/jackson-core/security/advisories/GHSA-6v53-7c9g-w56r)
https://nvd.nist.gov/vuln/detail/CVE-2025-52999
https://github.com/FasterXML/jackson-core/pull/1554
GitHub Security Advisory: GHSA-429m-9874-rx9w
Package: com.github.psi-probe:psi-probe-core (MAVEN)
Severity: LOW (CVSS 6.3)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 5.3.0
Patched in: unpatched

Summary: PSI Probe vulnerable to Server-Side Request Forgery

Details:
A vulnerability has been found in psi-probe PSI Probe up to 5.3.0. This affects the function lookup of the file psi-probe-core/src/main/java/psiprobe/tools/Whois.java of the component Whois. The manipulation leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-5fvg-qwcp-r325
Package: org.apache.ranger:ranger-nifi-registry-plugin (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-297: Improper Validation of Certificate with Host Mismatch
Vulnerable versions: < 2.8.0
Patched in: 2.8.0

Summary: Apache Ranger Vulnerable to Improper Validation of Certificate with Host Mismatch

Details:
Hostname verification bypass issue in Apache Ranger NiFiRegistryClient/NiFiClient is reported in Apache Ranger versions <= 2.7.0.

Users are recommended to upgrade to version 2.8.0, which fixes this issue.
GitHub Security Advisory: GHSA-c87w-642h-m97h
Package: org.apache.ranger:ranger-plugins-common (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 2.8.0
Patched in: 2.8.0

Summary: Apache Ranger has a Code Injection vulnerability

Details:
Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0.

Users are recommended to upgrade to version 2.8.0, which fixes this issue.
GitHub Security Advisory: GHSA-h2xq-h7f9-vh6c
Package: org.xwiki.contrib.blog:application-blog-ui (MAVEN)
Severity: HIGH (CVSS 9.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 9.15.7
Patched in: 9.15.7

Summary: XWiki Blog Application home page vulnerable to Stored XSS via Post Title

Details:
### Impact

The Blog Application is vulnerable to Stored Cross-Site Scripting (XSS) via the Blog Post Title. The vulnerability arises because the post title is injected directly into the HTML <title> tag without proper escaping.

An attacker with permissions to create or edit blog posts can inject malicious JavaScript into the title field. This script will execute in the browser of any user (including administrators) who views the blog post. This leads to potential session hijacking or privilege escalation.

To reproduce:

* Log in as a user with rights to create blog posts.
* Create a new blog post.
* In the Title field, insert the following payload designed to break out of the title tag: ```</title><script>alert('XSS in title blog')</script>```
* Save (Publish) the post.
* View the post in the blog home page

### Patches
The vulnerability has been patched in the blog application version 9.15.7 by adding missing escaping.

### Workarounds
XWiki Blog Application maintainers are not aware of any workarounds.

### Resources
* https://jira.xwiki.org/browse/BLOG-245
* https://github.com/xwiki-contrib/application-blog/commit/cca87f0a0edc2e7e049d46d51f4a4d8f78b714ba

### Attribution

Łukasz Rybak reported this vulnerability.
GitHub Security Advisory: GHSA-7g5x-9c4v-4w5r
Package: org.keycloak:keycloak-services (MAVEN)
Severity: LOW (CVSS 3.1)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: < 26.4.4
Patched in: 26.4.4

Summary: Keycloak REST Services has a WebAuthn Attestation Statement Verification Bypass

Details:
A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.
GitHub Security Advisory: GHSA-v4jw-m6rm-399h
Package: org.keycloak:keycloak-server-spi-private (MAVEN)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-266: Incorrect Privilege Assignment, CWE-284: Improper Access Control
Vulnerable versions: < 26.5.2
Patched in: 26.5.2

Summary: Keycloak Server Private SPI: Improper Access Control Allows Administrators to Bypass Attribute Visibility Restrictions and Modify Unmanaged User Profile Attributes

Details:
A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.
GitHub Security Advisory: GHSA-gx6c-pv62-9mcf
Package: net.snowflake:snowflake-jdbc (MAVEN)
Severity: LOW (CVSS 3.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: <= 4.0.1
Patched in: unpatched

Summary: Snowflake JDBC Driver is Vulnerable to Uncontrolled Resource Consumption through SdkProxyRoutePlanner

Details:
A weakness has been identified in Snowflake JDBC Driver up to 4.0.1. Impacted is the function SdkProxyRoutePlanner of the file src/main/java/net/snowflake/client/internal/core/SdkProxyRoutePlanner.java of the component JDBC URL Handler. Executing a manipulation of the argument nonProxyHosts can lead to inefficient regular expression complexity. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. This patch is called 5fb0a8a318a2ed87f4022a1f56e742424ba94052. A patch should be applied to remediate this issue.