java-security
Safeguard articles tagged "java-security" — guides, analysis, and best practices for software supply chain and application security.
139 articles
How to Uninstall Java Safely on Windows, macOS, and Linux
To uninstall Java cleanly you need to remove the runtime, clear leftover paths and environment variables, and confirm nothing critical still depends on it.
Fixing vulnerabilities in Maven projects
Maven vulnerability remediation isn't just running mvn versions:use-latest — here's how to triage, patch, and verify fixes without breaking builds.
Fixing vulnerabilities in Gradle projects
Gradle's resolved dependency graph rarely matches build.gradle. Here's how to find, force-fix, and lock vulnerable transitive dependencies for good.
URLEncoder in Java: Correct Usage and Its Security Pitfalls
URLEncoder in Java is easy to misuse. Here is when it applies, why it is not URL encoding for whole URLs, and the injection risks of getting it wrong.
Spring Framework RCE Vulnerabilities: A History
From Spring4Shell to older data binding flaws, Spring framework RCE bugs keep resurfacing in the same handful of places — data binding, expression evaluation, and class loading.
CVE-2022-42004: The jackson-databind DoS Explained
CVE-2022-42004 is a denial-of-service flaw in jackson-databind where deeply nested arrays exhaust resources during deserialization. Here is who is affected and how to fix it.
CVE-2023-34462: The Netty SniHandler Memory Exhaustion Flaw
CVE-2023-34462 lets a crafted TLS ClientHello force Netty's SniHandler to allocate up to 16MB per connection, opening a denial-of-service path. Here is the root cause, affected versions, and the fix.
The Java Cheat Sheet Developers Actually Need for Secure Code
Most Java cheat sheets stop at syntax. This one is the security-focused reference: the APIs, patterns, and one-liners that keep injection, deserialization, and crypto bugs out of your code.
CVE-2023-1370: How a json-smart Recursion Bug Crashes Java Apps
CVE-2023-1370 lets an attacker crash any Java service that parses untrusted JSON with json-smart, using deeply nested arrays to exhaust the stack. Here is the fix.
Spring4Shell RCE vulnerability explained CVE-2022-22965
CVE-2022-22965 (Spring4Shell) lets attackers achieve unauthenticated RCE on Spring MVC/Tomcat apps. Here's the CVSS/EPSS/KEV data, timeline, and fixes.
Text4Shell RCE in Apache Commons Text CVE-2022-42889
CVE-2022-42889 (Text4Shell) is a 9.8-severity RCE in Apache Commons Text 1.5-1.9. Learn affected versions, timeline, and remediation steps.
Log4Shell remediation cheat sheet
A practical, no-fluff Log4Shell remediation cheat sheet: affected versions, CVSS/EPSS/KEV context, timeline, and the exact steps to close CVE-2021-44228.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.