https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 00:53:12 +0000 https://cve.radiocsirt.org/vuln/cve-2026-22741 <p><strong>Affected:</strong> VMware Spring Framework</p> <p>Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.</p> <p>More precisely, an application can be vulnerable when all the following are true:</p> <p>* the application is using Spring MVC or Spring WebFlux * the application is configuring the  resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with caching enabled * the application adds support for encoded resources resolution * the resource cache must be empty when the attacker has access to the application</p> <p>When all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.</p> <p><strong>Affected:</strong> VMware Spring Framework</p> <p>Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.</p> <p>More precisely, an application can be vulnerable when all the following are true:</p> <p>* the application is using Spring MVC or Spring WebFlux * the application is configuring the  resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with caching enabled * the application adds support for encoded resources resolution * the resource cache must be empty when the attacker has access to the application</p> <p>When all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.</p> https://cve.radiocsirt.org/vuln/cve-2026-22741 https://cve.radiocsirt.org/vuln/ghsa-3pxv-7cmr-fjr4 <p><strong>Affected:</strong> Maven: org.apache.logging.log4j:log4j-core</p> <p>Apache Log4j Core&#39;s [`XmlLayout`](https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout), in versions up to and including 2.25.3, fails to sanitize characters forbidden by the [XML 1.0 specification](https://www.w3.org/TR/xml/#charsets), producing invalid XML output whenever a log message or MDC value contains such characters.</p> <p>The impact depends on the StAX implementation in use:</p> <p>* **JRE built-in StAX**: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records. * **Alternative StAX implementations** (e.g., [Woodstox](https://github.com/FasterXML/woodstox), a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j&#39;s internal status logger.</p> <p>Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.</p> <p><strong>Affected:</strong> Maven: org.apache.logging.log4j:log4j-core</p> <p>Apache Log4j Core&#39;s [`XmlLayout`](https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout), in versions up to and including 2.25.3, fails to sanitize characters forbidden by the [XML 1.0 specification](https://www.w3.org/TR/xml/#charsets), producing invalid XML output whenever a log message or MDC value contains such characters.</p> <p>The impact depends on the StAX implementation in use:</p> <p>* **JRE built-in StAX**: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records. * **Alternative StAX implementations** (e.g., [Woodstox](https://github.com/FasterXML/woodstox), a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j&#39;s internal status logger.</p> <p>Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.</p> https://cve.radiocsirt.org/vuln/ghsa-3pxv-7cmr-fjr4