Security advisories

high2026-06-11

CVE-2026-48006-Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

netty/netty · GHSA-6jv9-x5w9-2ccm

high2026-06-11

CVE-2026-47781-PDM: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

pdm-project/pdm · GHSA-qq6c-99pv-prvf

medium2026-06-11

CVE-2026-47780-free5GC UDR has improper `ueId` validation in EE subscription handlers that allows arbitrary identifier persistence

free5gc/free5gc · GHSA-6gxq-gpr8-xgjp

medium2026-06-11

CVE-2026-53723-guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator

guzzle/guzzle-services · GHSA-q8r6-5hfw-5jff

medium2026-06-11

CVE-2026-48998-guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation

guzzle/psr7 · GHSA-34xg-wgjx-8xph

medium2026-06-11

CVE-2026-49214-guzzlehttp/psr7 has CRLF Injection via URI Host Component

guzzle/psr7 · GHSA-hq7v-mx3g-29hw

high2026-06-11

CVE-2026-5497-vLLM is vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method

vllm-project/vllm · GHSA-wcwg-c5fc-9vrc

high2026-06-11

CVE-2026-40999-Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations

spring-projects/spring-ws · GHSA-whpp-xv3h-rwxf

high2026-06-11

CVE-2026-41699-Spring for GraphQL: Unsafe Deserialization

spring-projects/spring-graphql · GHSA-px92-q6rc-6mwv

high2026-06-11

CVE-2026-41856-Spring for GraphQL: Annotation Detection Vulnerability

spring-projects/spring-graphql · GHSA-phxq-526m-79px

medium2026-06-11

CVE-2026-40996-Spring Web Services: Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default

spring-projects/spring-ws · GHSA-p7qj-2q5w-f9r7

high2026-06-11

CVE-2026-41700-Spring for GraphQL: Cross-Site WebSocket Hijacking

spring-projects/spring-graphql · GHSA-m39w-hqxx-3r48

medium2026-06-11

CVE-2026-41001-Spring Boot: Predictable Temp Directory in Artemis Auto-configuration

spring-projects/spring-boot · GHSA-ggg2-9786-hwc8

high2026-06-11

CVE-2026-40994-Spring Web Services: Wss4jSecurityInterceptor disables WS-I BSP validation by default

spring-projects/spring-ws · GHSA-gg9r-wr4p-w63h

low2026-06-11

CVE-2026-41000-Spring Web Services: WSS4J validation does not use configured replay cache

spring-projects/spring-ws · GHSA-8qq9-r6cc-qjv9

medium2026-06-11

CVE-2026-40995-Spring Web Services: X.509 authentication bypasses Spring Security account checks

spring-projects/spring-ws · GHSA-6mfm-98wv-32wm

medium2026-06-11

CVE-2026-40997-Spring Web Services: SOAP security faults leak Spring Security account state

spring-projects/spring-ws · GHSA-5x25-c2rf-f2jx

high2026-06-11

CVE-2026-40998-Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource

spring-projects/spring-ws · GHSA-2mpf-m756-hxjm

medium2026-06-11

CVE-2026-40986-Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML

spring-projects/spring-webflow · GHSA-hw5c-xm3c-v96w

medium2026-06-11

CVE-2026-40992-Spring Boot's Mail Auto-Configuration Does Not Enable SSL Hostname Verification

spring-projects/spring-boot · GHSA-9wxp-w4px-32vh