Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-41007Highorg.springframework.hateoas:spring-hateoas: Spring HATEOAS heap exhaustion through unbounded internal cachingCVE-2026-41006Highorg.springframework.hateoas:spring-hateoas: Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configurationCVE-2026-41715Mediumio.projectreactor.netty:reactor-netty: Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade RedirectCVE-2026-41710Mediumorg.springframework.retry:spring-retry: Spring Retry has Cache Exhaustion in Stateful Retries that leads to Denial of ServiceCVE-2026-41840Mediumorg.springframework:spring-webflux: Spring Framework Denial of Service via Multipart Requests in WebFluxCVE-2026-41841Mediumorg.springframework:spring-webmvc: Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFluxCVE-2026-41842Highorg.springframework:spring-webmvc: Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFluxCVE-2026-40984Highio.micrometer:micrometer-core: Micrometer HTTP server instrumentations DoSCVE-2026-40983Highio.micrometer:micrometer-core: Micrometer gRPC server instrumentation DoSCVE-2026-47691Highio.netty:netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS RecordsCVE-2026-47244Mediumio.netty:netty-codec-http2: Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforcedCVE-2026-46340Highio.netty:netty-transport-sctp: Netty: SCTP reassembly nests buffers without boundCVE-2026-45674Highio.netty:netty-resolver-dns: Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME RecordsCVE-2026-45673Mediumio.netty:netty-resolver-dns: Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source PortCVE-2026-45536Mediumio.netty:netty-transport-native-epoll: Netty: Unix-socket fd receive leaks descriptors when peer sends two at onceCVE-2026-45416Highio.netty:netty-handler: Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytesCVE-2026-44894Highio.netty:netty-codec-classes-quic: Netty's Default QUIC token handler accepts any client-supplied tokenCVE-2026-44893Highio.netty:netty-codec-haproxy: Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV lengthCVE-2026-44892Highio.netty:netty-codec-http3: Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header SizeCVE-2026-44890Highio.netty:netty-codec-redis: Netty has Unbounded Direct Memory Consumption in its RedisDecoderCVE-2026-44250Highio.netty:netty-codec-redis: Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested ArraysCVE-2026-44249Highio.netty:netty-handler: Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator MaskingCVE-2026-11477Loworg.hswebframework.web:hsweb-authorization-oauth2: hsweb-framework has an open redirect issueCVE-2026-11470Loworg.hswebframework.web:hsweb-system-file: hsweb-framework has a Path Traversal issueCVE-2026-9088Loworg.keycloak:keycloak-services: Keycloak: Information disclosure due to user profile permission bypass

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo