Affected: CleanStart: wildfly, CleanStart: wso2am

CVE-2026-66274 affects multiple packages. A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. See references for individual vulnerability details.

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.

This issue affects Apache Qpid Proton-J: through 0.34.1.

Users are recommended to upgrade to version 0.35.0, which fixes the issue.

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.

This issue affects Apache Qpid Proton-J: through 0.34.1.

Users are recommended to upgrade to version 0.35.0, which fixes the issue.

io.quarkus:quarkus-qute: quarkus-qute:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine resteasy-core: RESTeasy SourceProvider remote unauthenticated file read org.mongodb/mongodb-driver: MongoDB Driver: Credential disclosure via cleartext logging during client initialization io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification