最新のセキュリティ情報

cve-2026-47848 - MEDIUM - Reactor Netty WebSocket Client Leaks Credentials On Redirect

In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.

cve-2026-47844 - MEDIUM - Reactor Netty HTTP Server Leaks Exception Details

In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing.

cve-2026-47850 - MEDIUM - Spring Data REST allows mutation of the version property of immutable aggregates via PUT

Spring Data REST does not preserve the persisted version ( @Version ) property of an aggregate root when handling an HTTP PUT against an immutable target type. For mutable aggregates, the PUT merge logic explicitly retains the stored identifier and version properties, discarding any client-supplied values. For immutable aggregates — Java records, Kotlin data classes, all-args @PersistenceCreator types — or when a polymorphic ( @JsonTypeInfo ) subtype change occurs, the merge instead returns the request-body object and restores only Jackson @JsonIgnore -marked properties from storage. The vers…

cve-2026-47845 - MEDIUM - Reactor Netty HTTP Server may incorrectly evaluate proxy addresses

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol.

cve-2026-47843 - LOW - Reactor Netty may incorrectly route traffic due to DNS resolver reuse

In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. In order for this to happen, the application must dynamically create multiple clients (such as HttpClient or TcpClient ) that rely on different custom configuration. This can lead to traffic being routed to unintended destinations.

cve-2026-47837 - MEDIUM - Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated.

cve-2026-47842 - MEDIUM - Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation

This is a continuation of CVE-2020-5408 . Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Because the IV is fixed, identical plaintexts always produce identical ciphertext for a given password and salt, regardless of when or how many times the value was encrypted. An attacker with read access to the encrypted data store can exploit this property to determine when two records share the same plaintext value, correlate encrypted values…

cve-2026-47834 - MEDIUM - Spring Data JPA Sort expression validation bypass

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. The application is vulnerable if all of the following are true: The application accepts Sort parameters from untrusted input and uses them without prior sanitization as input for native SQL repository methods. The repository method is annotated with @NativeQuery or @Query(nativeQuery=true) . The repository method allows sorting via a Sort or Pageable parameter. The underlying database accepts non ASCII characters as part of its SQL syntax. On affected databases inf…

Signatures, be true: domain errors and functional handling in Kotlin

Here’s a function that signs a document: In Kotlin, Unit means the function completes without returning a meaningful value – roughly equivalent to void in Java. Got it? Now, tell me what could go wrong. You can’t. Yet, the code might be invalid. The signing window might have closed. The database might be down. The […]

Oracle Java の脆弱性対策について(2026年7月)

Scala 3.3.8 LTS is now available!

Scala 3.3.8 LTS is now available! This patch release backports most of the bugfixes and some of the improvements introduced in the Scala Next series to the Scala 3.8.4 release. All of the backported changes were proven to not break either binary or source compatibility, by testing over 1500 projects in the Scala 3 Open Community Build . Notable changes Support for JDK 26 #24430 Multiple coverage improvement to make it on par with Scala 2 support including // $COVERAGE-OFF$ and // $COVERAGE-ON$ markers New @uncheckedOverride annotation for definitions that may override. #24545 Trap Ctrl-C in t…

Oracle Java の脆弱性対策について(2026年4月)

Unveiling the ConFoo 2024 edition!

With over , delivered by speakers from around the world, ConFoo is a conference for Full-Stack developers covering everything from the backend to the frontend: JavaScript, PHP, Java, Dotnet, Security, Artificial Intelligence, DevOps, and much more. ConFoo brings an outstanding diversity of content to expand your knowledge, increase your productivity, and take your development skills to the next level. With a selection of presentations focused on cutting-edge technologies, there's a reason why attendees returning from ConFoo say they've learned more in these 3 days than in 3 years at universit…

Log4j Vulnerability Update

Log4j is a Java library by Apache used to log debug messages within applications. It's recently been featured in news outlets around the world due to a vulnerability (known as Log4Shell) that was discovered allowing remote code execution using a specific string.