Withdrawn by the publisher.

Affected: CleanStart: elasticsearch

Multiple security vulnerabilities affect the elasticsearch package. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details.

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application.

Affected: Maven: org.jsoup:jsoup

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application.

jsoup-1.23.2-1.1 on GA media

org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding io.projectreactor/reactor-core: Reactor Core: Denial of Service via Flux.windowTimeout operator with fairBackpressure io.projectreactor/reactor-core: Reactor Core: Denial of Service in bufferTimeout operator org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names org.jsoup/jsoup: jsoup: Denial of Service via deeply nested XML documents org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver quarkus-websockets-next: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering quarkus-vertx-http: Authorization Bypass via Path Normalization Discrepancy in Quarkus HTTP Security com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service com.github.luben/zstd-jni: zstd-jni: Denial of Service or Information Disclosure via out-of-bounds read com.github.luben/zstd-jni: zstd-jni…

Security update for jsoup, re2j

Affected: Ubuntu:Pro:14.04:LTS: jsoup, Ubuntu:16.04:LTS: jsoup, Ubuntu:18.04:LTS: jsoup, Ubuntu:20.04:LTS: jsoup, Ubuntu:22.04:LTS: jsoup, Ubuntu:24.04:LTS: jsoup, Ubuntu:26.04:LTS: jsoup

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application.