Most recent entries from all

Withdrawn: CLEANSTART-2026-GC35580 — Security fixes in apicurio-registry 3.1.7-r6

Withdrawn by the publisher.

Affected: CleanStart: apicurio-registry

Package apicurio-registry version 3.1.7-r6 fixes 8 vulnerabilities: CVE-2025-59250, ghsa-m494-w24q-6f7w, CVE-2026-1002, CVE-2025-11965, CVE-2025-11966...

EUVD-2026-256620

fkie_cve-2025-11965

In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails to restrict access to hidden directories, allowing unauthorized users to retrieve files within them (e.g. '.git/config').

GHSA-h5fg-jpgr-rv9c — Vert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden Directories

Affected: Maven: io.vertx:vertx-web

# Description

There is a flaw in the hidden file protection feature of Vert.x Web’s `StaticHandler` when `setIncludeHidden(false)` is configured.

In the current implementation, only files whose final path segment (i.e., the file name) begins with a dot (`.`) are treated as “hidden” and are blocked from being served. However, this logic fails in the following cases:

- **Files under hidden directories**: For example, `/.secret/config.txt` — although `.secret` is a hidden directory, the file `config.txt` itself does not start with a dot, so it gets served. - **Real-world impact**: Sensitive files placed in hidden directories like `.git`, `.env`, `.aws` may become publicly accessible.

As a result, the behavior does not meet the expectations set by the `includeHidden=false` configuration, which should ideally protect all hidden files and directories. This gap may lead to unintended exposure of sensitive information.

# Steps to Reproduce

```bash 1. Prepare test environment

# Create directory structure mkdir -p src/test/resources/webroot/.secret mkdir -p src/test/resources/webroot/.git

# Place test files echo "This is a visible file" > src/test/resources/webroot/visible.txt echo "This is a hidden file" > src/test/resources/webroot/.hidden.txt echo "SECRET DATA: API_KEY=abc123" > src/test/resources/webroot/.secret/config.txt echo "Git config data" > src/test/resources/webroot/.git/config ```

```java 2. Implement test server

import io.vertx.core.AbstractVerticle; import io.…

RHSA-2025:23417 — Red Hat Security Advisory: Streams for Apache Kafka 3.1.0 release and security update

kafka: Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout io.vertx/vertx-core: Eclipse Vert.x Access Control Flaw io.vertx/vertx-web: Eclipse Vert.x cross site scripting org.apache.kafka: Kafka Client Arbitrary File Read SSRF apache-kafka: Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration org.apache.kafka: Kafka JNDI Login Module RCE Vulnerability commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang io.quarkus/quarkus-vertx: Quarkus potential data leak netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions netty-codec: netty-codec-compression: Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack