ThreeTen Backport v1.6.8 was discovered to contain a NullPointerException via the component org.threeten.bp.LocalDate::compareTo(ChronoLocalDate). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.

ThreeTen Backport v1.6.8 was discovered to contain a NullPointerException via the component org.threeten.bp.LocalDate::compareTo(ChronoLocalDate).

mvel: TimeOut error when calling ParseTools.subCompileExpression() function io.vertx/vertx-core: memory leak due to the use of Netty FastThreadLocal data structures in Vertx io.vertx:vertx-core: memory leak when a TCP server is configured with TLS and SNI support pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE undertow: Out-of-memory Error after several closed connections with wildfly-http-client protocol undertow: response write hangs in case of Java 17 TLSv1.3 NewSessionTicket undertow: url-encoded request path information can be broken on ajp-listener jetty: stop accepting new connections from valid clients spring-security: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated spring-security: Broken Access Control With Direct Use of AuthenticatedVoter threetenbp: null pointer exception netty-codec-http: Allocation of Resources Without Limits or Throttling org.bouncycastle: Importing an EC certificate with crafted F2m parameters may lead to Denial of Service bc-java: BouncyCastle vulnerable to a timing variant of Bleichenbacher (Marvin Attack) org.bouncycastle:bcprov-jdk18on: Infinite loop in ED25519 verification in the ScalarUtil class org.bouncycastle: Use of Incorrectly-Resolved Name or Reference