java-security
Safeguard articles tagged "java-security" — guides, analysis, and best practices for software supply chain and application security.
139 articles
Unsafe deserialization in SnakeYAML CVE-2022-1471
CVE-2022-1471 lets attackers achieve RCE via SnakeYAML's unsafe Constructor. Learn affected versions, CVSS/EPSS context, and remediation steps.
CVE-2022-3509: The protobuf-java DoS Vulnerability Explained
CVE-2022-3509 is a denial-of-service flaw in protobuf-java's text-format parser that lets crafted input trigger long garbage-collection pauses. Here is who is affected and how to fix it.
Encryption Algorithms in Java: A Practical Overview
Java ships a wide menu of encryption algorithms through its Java Cryptography Architecture, but picking the wrong mode or a deprecated cipher is one of the most common security findings in Java codebases.
The Spring Boot BOM: A Security-First Guide to Version Management
The Spring Boot BOM pins hundreds of transitive versions for you. Used well it closes CVEs fast; used carelessly it hides an end-of-life framework in your build.
How to prevent log injection vulnerabilities in Java
Log injection let attackers turn Log4j logging calls into remote code execution in 2021. Here's how CWE-117 works in Java and how to stop it.
CVE-2022-45688: The Hutool JSON Stack Overflow, Explained
CVE-2022-45688 is a stack-overflow denial-of-service bug in the XML-to-JSON conversion path of hutool-json and org.json. Here is what triggers it and how to fix it.
CVE-2022-45146: Bouncy Castle FIPS Use-After-Free Explained
CVE-2022-45146 is a use-after-free issue in Bouncy Castle's FIPS Java API that surfaces on Java 13 and later. Here is who it affects and how to remediate.
Fix My Java Code: A Practical Guide to Finding and Fixing Security Bugs
"Fix my Java code" usually means a security or dependency problem. Here is a repeatable way to find the real fault, fix it, and stop it from returning.
org.apache.tomcat.embed: Embedded Tomcat Versions and Vulnerabilities
org.apache.tomcat.embed ships inside almost every Spring Boot jar, and its CVEs follow it there. Here is how to find your real embedded Tomcat version and patch it.
What Is a Cross-Site Scripting Vulnerability, and How Do You Fix It?
A cross-site scripting vulnerability lets an attacker run their JavaScript in your users' browsers, and you fix it by encoding output and validating input at the right boundaries.
162 vulnerabilities disclosed in Java's top 10 libraries
Safeguard's H1 2026 analysis found 162 CVEs across Java's ten most-downloaded libraries, with critical RCE risk concentrated in Tomcat and Spring.
Maven SBOM: How to Generate a Software Bill of Materials for Java Builds
A Maven SBOM inventories every direct and transitive dependency in your Java build. Here is how to generate one with the CycloneDX plugin and put it to work for security.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.