In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier

org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding io.projectreactor/reactor-core: Reactor Core: Denial of Service via Flux.windowTimeout operator with fairBackpressure io.projectreactor/reactor-core: Reactor Core: Denial of Service in bufferTimeout operator org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names org.jsoup/jsoup: jsoup: Denial of Service via deeply nested XML documents org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver quarkus-websockets-next: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering quarkus-vertx-http: Authorization Bypass via Path Normalization Discrepancy in Quarkus HTTP Security com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service com.github.luben/zstd-jni: zstd-jni: Denial of Service or Information Disclosure via out-of-bounds read com.github.luben/zstd-jni: zstd-jni…