java-security
Safeguard articles tagged "java-security" — guides, analysis, and best practices for software supply chain and application security.
139 articles
CVE-2018-1271: Path traversal in Spring MVC static resour...
A path traversal flaw in Spring MVC's static resource handling let attackers on Windows deployments escape the web root and read arbitrary files.
CVE-2020-5398: Content-type bypass in Spring Framework
CVE-2020-5398 lets attackers bypass Spring Framework RFD protections via Content-Disposition, tricking browsers into downloading malicious files.
CVE-2016-4977: Remote code execution in Spring Security O...
CVE-2016-4977 let attackers achieve remote code execution against Spring Security OAuth's whitelabel views via SpEL injection. Here's what shipped, why, and how to fix it.
CVE-2021-22112: Improper authorization in Spring Security...
CVE-2021-22112 let Spring Security lose SecurityContext changes mid-request, an improper authorization flaw exposing OAuth2-secured apps to privilege escalation.
OpenJDK Vulnerabilities: Tracking and Patching
OpenJDK vulnerabilities are disclosed and patched through Oracle's quarterly Critical Patch Update cycle, but tracking them well means watching your specific JDK distribution and version line, not just assuming a generic update covers you.
CVE-2023-34453: The snappy-java Integer Overflow Explained
CVE-2023-34453 is an integer overflow in snappy-java's BitShuffle code that lets an attacker crash a JVM. Here are the affected versions and the fix.
CVE-2023-34034 Explained: The Spring Security WebFlux Authorization Bypass
CVE-2023-34034 lets attackers slip past Spring Security rules in WebFlux apps because of a wildcard-matching mismatch. Here is exactly what breaks, who is affected, and how to fix it.
Apache Tomcat and Coyote Connector Vulnerabilities Explained
Apache tomcat vulnerabilities keep surfacing because Tomcat sits directly in the request path of so many Java applications; here is what the Coyote connector does and which vulnerability classes recur most.
10 Java security best practices
10 Java security best practices security teams should enforce across dependency management, deserialization, injection, secrets, and build pipelines.
10 Spring Boot security best practices
Ten concrete Spring Boot security practices, with real CVEs, config flags, and file paths, to close the gaps attackers actually exploit.
A guide to input validation with Spring Boot
Spring Boot doesn't validate input by default. Here's how Bean Validation actually works, where teams get it wrong, and how missing validation leads to injection and mass assignment.
spring-boot-starter-actuator: Securing Exposed Actuator Endpoints
spring-boot-starter-actuator gives you production-grade health and metrics endpoints, but a single misconfigured deployment can leak secrets and heap dumps to the internet.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.