java-security
Safeguard articles tagged "java-security" — guides, analysis, and best practices for software supply chain and application security.
138 articles
YAML Parsers in Java: SnakeYAML Deserialization Risks Explained
Choosing a YAML parser in Java means choosing a deserialization posture. How SnakeYAML's CVE-2022-1471 worked, what changed in 2.0, and how to parse YAML safely.
CVE-2020-25638: SQL Injection in Hibernate ORM Explained
CVE-2020-25638 is a SQL injection flaw in hibernate-core that surfaces when SQL comments are enabled and literals are used in JPA Criteria queries. Here is who is affected and how to remediate it.
XXE Fix in Java: How to Harden Every XML Parser
The XXE fix in Java is the same idea across every parser — turn off DOCTYPE and external entities before you feed it untrusted XML. Here are the exact settings for each JDK XML API.
CVE-2024-22234: The Spring Security Access Control Bypass Explained
CVE-2024-22234 is a broken access control flaw in Spring Security where isFullyAuthenticated returns true for a null authentication. Here is how it works and how to fix it.
Apache Struts 2 Vulnerability History: The RCE Flaws You Must Patch
Apache Struts 2 vulnerabilities have caused some of the largest breaches on record. Here is the CVE lineage, why the same flaw keeps recurring, and how to detect it.
Fixing XXE in Java: A Parser-by-Parser Hardening Guide
A parser-by-parser XXE fix for Java, covering DocumentBuilderFactory, SAXParser, XMLInputFactory, TransformerFactory, and the XML libraries that still ship unsafe defaults.
Uncaught Exception in Java: A Security Guide
An uncaught exception in Java is more than a crash - it leaks stack traces, kills threads, and opens denial-of-service paths. Here is how to handle it safely.
Java Vulnerability Classes: A Reference List
A java vulnerability list organized by class — deserialization, injection, XXE, and the rest — because Java's ecosystem produces a specific, recurring set of vulnerability patterns worth knowing by name.
Java Deserialization Vulnerabilities: How They Work and How to Stop Them
A practical explanation of the Java deserialization vulnerability class: why untrusted object deserialization leads to remote code execution, and how to defend against it.
Log4j Maven Dependency: How to Find, Fix, and Pin It Safely
A practical guide to the Log4j Maven dependency: how to detect log4j-core in your tree, why 2.17.1 is the version to target, and how to pin it for good.
CVE-2020-15250: The JUnit Temp File Vulnerability
CVE-2020-15250 shows how a test-only utility class in JUnit 4 created world-readable temp files on Unix systems, and why it still shows up in scans of projects that never touched production code paths.
CVE-2021-29425: The Commons IO Path Traversal Bug
CVE-2021-29425 shows how a single unhandled case in Apache Commons IO's path normalization let attackers slip past directory checks that assumed a canonicalized path was actually safe.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.