java-security
Safeguard articles tagged "java-security" — guides, analysis, and best practices for software supply chain and application security.
139 articles
SQL Injection Prevention in Java with PreparedStatement
Java teams still ship SQL injection bugs despite PreparedStatement being free and built into the JDK since 1997. Here is how it works and where it fails.
Path Traversal Prevention in Java with Path.normalize
Path.normalize() cleans up "." and ".." in a Java path — but it doesn't stop path traversal. Here's why the Zip Slip pattern still slips past code review in 2026.
XXE Prevention in Java: Hardening DocumentBuilderFactory
Java's DocumentBuilderFactory parses XML with external entities on by default, turning XML uploads into file-read and SSRF vectors. Here is how to lock it down.
Fastjson AutoType Bypass RCE (CVE-2022-25845) Explained
CVE-2022-25845 defeated Fastjson's autoType protection and reopened a deserialization RCE path. Here's how the bypass worked and how to lock the library down.
Insecure Deserialization Prevention in Java with Deserial...
Java deserialization RCEs still hit production years after JEP 290 shipped filters. Here's how JEP 290/415 filters work, common rollout mistakes, and how Safeguard closes the gaps.
Jackson-databind Polymorphic Deserialization Gadget (CVE-2019-12384) Explained
CVE-2019-12384 chained a logback gadget with H2's RUNSCRIPT to turn default typing into code execution. Here's the mechanism, the classpath caveat, and how to fix it for good.
Secure Random Number Generation in Java with SecureRandom...
Why java.util.Random and even UUID.randomUUID() can leak predictable tokens, and how Java's SecureRandom and NIST DRBG providers actually protect secrets.
Is Java Safe? A Realistic Look at Java Security in 2025
Is Java safe? The language has strong built-in protections, but real Java risk lives in dependencies, deserialization, and configuration. Here is the honest picture.
spring-security-core Maven: Keeping Your Auth Layer Patched
The spring-security-core Maven artifact is the heart of authentication and authorization in Spring apps, and a handful of recent CVEs make version hygiene non-negotiable.
CVE-2023-34455: snappy-java's Unchecked Chunk Length DoS
CVE-2023-34455 lets an attacker crash a JVM by feeding snappy-java a bogus chunk length. Here is the root cause, affected versions, and the fix.
CVE-2023-42794: The Apache Tomcat Incomplete Cleanup DoS Explained
An unreleased refactoring in Tomcat's bundled Commons FileUpload left temp files undeleted on Windows, risking a disk-exhaustion DoS. Here is what CVE-2023-42794 is and how to fix it.
spring-web Maven Dependency: Known CVEs and How to Stay Patched
The spring-web Maven artifact pulls a lot of transitive weight and has been at the center of high-profile RCE bugs. Here is what to watch and how to keep it patched.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.