java-security
Safeguard articles tagged "java-security" — guides, analysis, and best practices for software supply chain and application security.
138 articles
URLEncoder in Java: Correct Usage and Its Security Pitfalls
URLEncoder in Java is easy to misuse. Here is when it applies, why it is not URL encoding for whole URLs, and the injection risks of getting it wrong.
Spring Framework RCE Vulnerabilities: A History
From Spring4Shell to older data binding flaws, Spring framework RCE bugs keep resurfacing in the same handful of places — data binding, expression evaluation, and class loading.
CVE-2022-42004: The jackson-databind DoS Explained
CVE-2022-42004 is a denial-of-service flaw in jackson-databind where deeply nested arrays exhaust resources during deserialization. Here is who is affected and how to fix it.
CVE-2023-34462: The Netty SniHandler Memory Exhaustion Flaw
CVE-2023-34462 lets a crafted TLS ClientHello force Netty's SniHandler to allocate up to 16MB per connection, opening a denial-of-service path. Here is the root cause, affected versions, and the fix.
The Java Cheat Sheet Developers Actually Need for Secure Code
Most Java cheat sheets stop at syntax. This one is the security-focused reference: the APIs, patterns, and one-liners that keep injection, deserialization, and crypto bugs out of your code.
CVE-2023-1370: How a json-smart Recursion Bug Crashes Java Apps
CVE-2023-1370 lets an attacker crash any Java service that parses untrusted JSON with json-smart, using deeply nested arrays to exhaust the stack. Here is the fix.
CVE-2022-3509: The protobuf-java DoS Vulnerability Explained
CVE-2022-3509 is a denial-of-service flaw in protobuf-java's text-format parser that lets crafted input trigger long garbage-collection pauses. Here is who is affected and how to fix it.
Encryption Algorithms in Java: A Practical Overview
Java ships a wide menu of encryption algorithms through its Java Cryptography Architecture, but picking the wrong mode or a deprecated cipher is one of the most common security findings in Java codebases.
The Spring Boot BOM: A Security-First Guide to Version Management
The Spring Boot BOM pins hundreds of transitive versions for you. Used well it closes CVEs fast; used carelessly it hides an end-of-life framework in your build.
CVE-2022-45146: Bouncy Castle FIPS Use-After-Free Explained
CVE-2022-45146 is a use-after-free issue in Bouncy Castle's FIPS Java API that surfaces on Java 13 and later. Here is who it affects and how to remediate.
CVE-2022-45688: The Hutool JSON Stack Overflow, Explained
CVE-2022-45688 is a stack-overflow denial-of-service bug in the XML-to-JSON conversion path of hutool-json and org.json. Here is what triggers it and how to fix it.
Fix My Java Code: A Practical Guide to Finding and Fixing Security Bugs
"Fix my Java code" usually means a security or dependency problem. Here is a repeatable way to find the real fault, fix it, and stop it from returning.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.