deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-cmxv-58fp-fm3g
Package: org.asynchttpclient:async-http-client (MAVEN)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 3.0.0.Beta1, < 3.0.9
Patched in: 3.0.9

Summary: AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects

Details:
### Impact
When redirect following is enabled (followRedirect(true)), AsyncHttpClient forwards Authorization and Proxy-Authorization headers along with Realm credentials to arbitrary redirect targets regardless of domain, scheme, or port changes. This leaks credentials on cross-domain redirects and HTTPS-to-HTTP downgrades.

Additionally, even when stripAuthorizationOnRedirect is set to true, the Realm object containing plaintext credentials is still propagated to the redirect request, causing credential re-generation for Basic and Digest authentication schemes via NettyRequestFactory.

An attacker who controls a redirect target (via open redirect, DNS rebinding, or MITM on HTTP) can capture Bearer tokens, Basic auth credentials, or any other Authorization header value.

### Patches
Fixed in version 3.0.9 or 2.14.5. Users should upgrade immediately.

The fix automatically strips Authorization and Proxy-Authorization headers and clears Realm credentials whenever a redirect crosses origin boundaries (different scheme, host, or port) or downgrades from HTTPS to HTTP.

### Workarounds
For users unable to upgrade, set (stripAuthorizationOnRedirect(true)) in the client config and avoid using Realm-based authentication with redirect following enabled. Note that (stripAuthorizationOnRedirect(true)) alone is insufficient on versions prior to 3.0.9 or 2.14.5 because the Realm bypass still re-generates credentials.

Alternatively, disable redirect following (followRedirect(false)) and handle redirects manually with origin validation.

### References
 - Fix commit: https://github.com/AsyncHttpClient/async-http-client/commit/6b2fbb7f8
GitHub Security Advisory: GHSA-cwq5-8pvq-j65j
Package: io.github.ndsev:zserio-runtime (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: <= 2.18.0
Patched in: 2.18.1

Summary: Zserio Runtime: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization

Details:
## Summary

### Unbounded Memory Allocation (all platforms)

A crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service).

**Affected code (C++):**
- `cpp/runtime/src/zserio/Array.h` (line 1029) — `m_rawArray.reserve(readLength)` with unchecked `readLength`
- `cpp/runtime/src/zserio/BitStreamReader.h` (lines 249, 281) — `value.reserve(len)` with unchecked `len`

**Affected code (Java):**
- `java/runtime/src/zserio/runtime/array/Array.java` (line 271) — `rawArray.reset(readSize)` → `new int[readSize]`
- `java/runtime/src/zserio/runtime/io/ByteArrayBitStreamReader.java` (line 245) — `new byte[length]`

## Proof of Concept

### Memory Allocation DoS (verified on 64-bit)

| Payload | Claimed Size | Allocated | Amplification |
|---------|-------------|-----------|---------------|
| 4 bytes | 100,000,000 | 762 MB | ~200 million x |
| 5 bytes | 2,147,483,647 | ~16 GB | system crash |

The full PoC source code and Docker build files are available upon request.

## Impact

zserio is the serialization framework underlying the **NDS (Navigation Data Standard)**, used by 43 member companies including Toyota, BMW, Volkswagen, Mercedes-Benz, and others. According to the Eclipse zserio project:

> "Zserio serialized data is used in millions of deployments in cars on the road"

Attack vectors include NDS.Live cloud map updates, map data supply chain compromise, and backend data processing pipelines. On 32-bit automotive ECUs, this could affect ADAS functionality.

## Suggested Fix

### For all runtimes: Validate varsize against stream size

```
if (claimedSize > remainingBytesInStream) {
    throw error("varsize claims more data than available in stream");
}
```

## Disclosure Timeline

- **2026-03-08:** Reported to Woven by Toyota PSIRT (go-zserio)
- **2026-03-10:** Reported to ndsev/zserio maintainers via GitHub Security Advisory
- **2026-03-23:** Split off overflow vulnerability to own report
- **90-day coordinated disclosure timeline**

A patch for this issue is available at https://github.com/ndsev/zserio/releases/tag/v2.18.1.

## Reporter

Ryuji Yasukochi (ryuji.yasu@gmail.com)
GitHub Security Advisory: GHSA-28jg-cgg7-j4wc
Package: org.apache.kafka:kafka-clients (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input
Vulnerable versions: >= 4.1.0, < 4.1.2
Patched in: 4.1.2

Summary: Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation

Details:
A security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it.

Apache advises Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.
GitHub Security Advisory: GHSA-m8mh-x359-vm8m
Package: org.apktool:apktool-lib (MAVEN)
Severity: HIGH (CVSS 7.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 3.0.0, < 3.0.2
Patched in: 3.0.2

Summary: Apktool: Path Traversal to Arbitrary File Write

Details:
A path traversal vulnerability in `brut/androlib/res/decoder/ResFileDecoder.java` allows a maliciously crafted APK to write arbitrary files to the filesystem during standard decoding (`apktool d`). This is a security regression introduced in commit [e10a045](https://github.com/iBotPeaches/Apktool/commit/e10a0450c7afcd9462c0b76bcbff0e7428b92bdd#diff-cd531ebe1014bfd18185bf21585ca5cdb16fbcb07703ebc47949a1b4e4e36bc3) ([PR #4041](https://github.com/iBotPeaches/Apktool/pull/4041), December 12, 2025), which removed the `BrutIO.sanitizePath()` call that previously prevented path traversal in resource file output paths.

An attacker can embed `../` sequences in the `resources.arsc` Type String Pool to escape the output directory and write files to arbitrary locations, including `~/.ssh/config`, `~/.bashrc`, or Windows Startup folders, escalating to RCE.

**Fix:** Re-introduce `BrutIO.sanitizePath()` in `ResFileDecoder.java` before file write operations.
GitHub Security Advisory: GHSA-49vv-25qx-mg44
Package: io.openremote:openremote-manager (MAVEN)
Severity: HIGH (CVSS 7.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: < 1.22.1
Patched in: 1.22.1

Summary: OpenRemote has Improper Access Control via updateUserRealmRoles function

Details:
### Summary
A user who has `write:admin` in one Keycloak realm can call the Manager API to update **Keycloak realm roles** for users in **another** realm, including **`master`**. The handler uses the `{realm}` path segment when talking to the identity provider but does not check that the caller may administer that realm. This could result in a privilege escalation to `master` realm administrator if the attacker controls any user in `master` realm.

### Details
In `manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java`, there is no check to validate if the caller should be able to administer a realm they're trying to update.

```340:353:manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java
    @Override
    public void updateUserRealmRoles(RequestParams requestParams, String realm, String userId, String[] roles) {
        try {
            identityService.getIdentityProvider().updateUserRealmRoles(
                realm,
                userId,
                roles);
        } catch (ClientErrorException ex) {
            ex.printStackTrace(System.out);
            throw new WebApplicationException(ex.getCause(), ex.getResponse().getStatus());
        } catch (Exception ex) {
            throw new WebApplicationException(ex);
        }
    }
```

### PoC
1. Create a **new** Keycloak realm other than `master`. Add a user and grant that user the OpenRemote client role `write:admin`. Remember the realm name (call it `NEW_REALM`).
2. In Keycloak realm `master`, pick a **low-privilege** user (no `admin` realm role). Copy that user’s UUID (`<master-user-uuid>`).
3. Authenticate as the user from step 1 and obtain a Bearer access token (`<token>`) for `NEW_REALM`.
4. Replace placeholders and run:
```bash
curl -k -X PUT "https://<host>/api/<NEW_REALM>/user/master/userRealmRoles/<master-user-uuid>" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '["admin"]'
```
5. In the Keycloak Admin Console, realm master, that user, Role mapping. Confirm the admin realm role is assigned.
### Impact
An attacker with the OpenRemote client role write:admin in any realm can call this API with {realm} set to another realm (for example master) and change Keycloak realm roles for users there. That can grant admin on master to a user UUID they target, which gives Keycloak administrator access for the master realm.
GitHub Security Advisory: GHSA-69rw-45wj-g4v6
Package: io.spinnaker.echo:echo-pipelinetriggers (MAVEN)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 2025.3.2
Patched in: 2025.3.2

Summary: Spinnaker: RCE via expression parsing due to unrestricted context handling

Details:
Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring Expression Language) to process information - specifically around expected artifacts. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, unlike orca, it was NOT restricting that context to a set of trusted classes, but allowing FULL JVM access. This enabled a user to use arbitrary java classes which allow deep access to the system. This enabled the ability to invoke commands, access files, etc. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable echo entirely.
GitHub Security Advisory: GHSA-69rw-45wj-g4v6
Package: io.spinnaker.echo:echo-pipelinetriggers (MAVEN)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 2025.4-0, < 2025.4.2
Patched in: 2025.4.2

Summary: Spinnaker: RCE via expression parsing due to unrestricted context handling

Details:
Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring Expression Language) to process information - specifically around expected artifacts. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, unlike orca, it was NOT restricting that context to a set of trusted classes, but allowing FULL JVM access. This enabled a user to use arbitrary java classes which allow deep access to the system. This enabled the ability to invoke commands, access files, etc. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable echo entirely.
GitHub Security Advisory: GHSA-69rw-45wj-g4v6
Package: io.spinnaker.echo:echo-pipelinetriggers (MAVEN)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 2026.0-0, < 2026.0.1
Patched in: 2026.0.1

Summary: Spinnaker: RCE via expression parsing due to unrestricted context handling

Details:
Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring Expression Language) to process information - specifically around expected artifacts. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, unlike orca, it was NOT restricting that context to a set of trusted classes, but allowing FULL JVM access. This enabled a user to use arbitrary java classes which allow deep access to the system. This enabled the ability to invoke commands, access files, etc. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable echo entirely.
GitHub Security Advisory: GHSA-x3j7-7pgj-h87r
Package: io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo (MAVEN)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2026.0.1
Patched in: 2026.0.1

Summary: Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths

Details:
Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.
GitHub Security Advisory: GHSA-cj8j-37rh-8475
Package: org.bouncycastle:bcpg-jdk18on (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.84
Patched in: 1.84

Summary: Bouncy Castle Uncontrolled Resource Consumption vulnerability

Details:
Allocation of resources without limits or throttling vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This issue affects BC-JAVA before 1.84.

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.
GitHub Security Advisory: GHSA-cj8j-37rh-8475
Package: org.bouncycastle:bcpg-jdk16 (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: <= 1.46
Patched in: unpatched

Summary: Bouncy Castle Uncontrolled Resource Consumption vulnerability

Details:
Allocation of resources without limits or throttling vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This issue affects BC-JAVA before 1.84.

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.
GitHub Security Advisory: GHSA-cj8j-37rh-8475
Package: org.bouncycastle:bcpg-jdk15on (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: <= 1.70
Patched in: unpatched

Summary: Bouncy Castle Uncontrolled Resource Consumption vulnerability

Details:
Allocation of resources without limits or throttling vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This issue affects BC-JAVA before 1.84.

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.
GitHub Security Advisory: GHSA-cj8j-37rh-8475
Package: org.bouncycastle:bcpg-jdk15to18 (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.84
Patched in: 1.84

Summary: Bouncy Castle Uncontrolled Resource Consumption vulnerability

Details:
Allocation of resources without limits or throttling vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This issue affects BC-JAVA before 1.84.

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.
GitHub Security Advisory: GHSA-cj8j-37rh-8475
Package: org.bouncycastle:bcpg-jdk15 (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: <= 1.46
Patched in: unpatched

Summary: Bouncy Castle Uncontrolled Resource Consumption vulnerability

Details:
Allocation of resources without limits or throttling vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This issue affects BC-JAVA before 1.84.

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.
GitHub Security Advisory: GHSA-cj8j-37rh-8475
Package: org.bouncycastle:bcpg-jdk14 (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.84
Patched in: 1.84

Summary: Bouncy Castle Uncontrolled Resource Consumption vulnerability

Details:
Allocation of resources without limits or throttling vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This issue affects BC-JAVA before 1.84.

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.
GitHub Security Advisory: GHSA-cj8j-37rh-8475
Package: org.bouncycastle:bcpg-jdk12 (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: <= 130
Patched in: unpatched

Summary: Bouncy Castle Uncontrolled Resource Consumption vulnerability

Details:
Allocation of resources without limits or throttling vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This issue affects BC-JAVA before 1.84.

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.
GitHub Security Advisory: GHSA-c3fc-8qff-9hwx
Package: org.bouncycastle:bcprov-jdk18on (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Vulnerable versions: >= 1.74, < 1.84
Patched in: 1.84

Summary: Bouncy Castle has an LDAP injection

Details:
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper.

This issue affects BC-JAVA: from 1.74 before 1.84.
GitHub Security Advisory: GHSA-c3fc-8qff-9hwx
Package: org.bouncycastle:bcprov-jdk15to18 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Vulnerable versions: >= 1.74, < 1.84
Patched in: 1.84

Summary: Bouncy Castle has an LDAP injection

Details:
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper.

This issue affects BC-JAVA: from 1.74 before 1.84.
GitHub Security Advisory: GHSA-c3fc-8qff-9hwx
Package: org.bouncycastle:bcprov-jdk14 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Vulnerable versions: >= 1.74, < 1.84
Patched in: 1.84

Summary: Bouncy Castle has an LDAP injection

Details:
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper.

This issue affects BC-JAVA: from 1.74 before 1.84.
GitHub Security Advisory: GHSA-xw5c-jc7x-gf75
Package: org.pac4j:pac4j-core (MAVEN)
Severity: HIGH (CVSS 6.5)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 6.0.0-RC1, < 6.4.1
Patched in: 6.4.1

Summary: PAC4J has a Cross-Site Request Forgery (CSRF) Vulnerability

Details:
PAC4J is vulnerable to Cross-Site Request Forgery (CSRF). A malicious attacker can craft a specially designed website which, when visited by a user, will automatically submit a forged cross-site request with a token whose hash collides with the victim's legitimate CSRF token. Importantly, the attacker does not need to know the victim’s CSRF token or its hash prior to the attack. Collisions in the deterministic String.hashCode() function can be computed directly, reducing the effective token's security space to 32 bits. This bypasses CSRF protection, allowing profile updates, password changes, account linking, and any other state-changing operations to be performed without the victim's consent.

This issue was fixed in PAC4J versions 5.7.10 and 6.4.1.
GitHub Security Advisory: GHSA-xw5c-jc7x-gf75
Package: org.pac4j:pac4j-core (MAVEN)
Severity: HIGH (CVSS 6.5)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 5.7.10
Patched in: 5.7.10

Summary: PAC4J has a Cross-Site Request Forgery (CSRF) Vulnerability

Details:
PAC4J is vulnerable to Cross-Site Request Forgery (CSRF). A malicious attacker can craft a specially designed website which, when visited by a user, will automatically submit a forged cross-site request with a token whose hash collides with the victim's legitimate CSRF token. Importantly, the attacker does not need to know the victim’s CSRF token or its hash prior to the attack. Collisions in the deterministic String.hashCode() function can be computed directly, reducing the effective token's security space to 32 bits. This bypasses CSRF protection, allowing profile updates, password changes, account linking, and any other state-changing operations to be performed without the victim's consent.

This issue was fixed in PAC4J versions 5.7.10 and 6.4.1.
GitHub Security Advisory: GHSA-6r5v-hp32-fjqw
Package: wss4j:wss4j (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: < 1.6.17
Patched in: 1.6.17

Summary: Improper Access Control in Apache WSS4J

Details:
Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
GitHub Security Advisory: GHSA-2p5w-cvg5-gc5c
Package: org.hibernate:hibernate-core (MAVEN)
Severity: HIGH (CVSS 8.3)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 5.2.8, <= 5.6.15
Patched in: unpatched

Summary: Hibernate vulnerable to SQL Injection

Details:
A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.
GitHub Security Advisory: GHSA-4h8f-2wvx-gg5w
Package: org.bouncycastle:bcprov-jdk15on (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-297: Improper Validation of Certificate with Host Mismatch
Vulnerable versions: >= 1.61, < 1.78
Patched in: 1.78

Summary: Bouncy Castle Java Cryptography API vulnerable to DNS poisoning

Details:
An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.
GitHub Security Advisory: GHSA-27h3-crw2-q36w
Package: org.apache.skywalking:server-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-202: Exposure of Sensitive Information Through Data Queries
Vulnerable versions: >= 9.7.0, < 10.4.0
Patched in: 10.4.0

Summary: SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information

Details:
The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.

This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0.

Users are recommended to upgrade to version 10.4.0, which fixes the issue.