java-security
Safeguard articles tagged "java-security" — guides, analysis, and best practices for software supply chain and application security.
138 articles
org.apache.tomcat.embed: Embedded Tomcat Versions and Vulnerabilities
org.apache.tomcat.embed ships inside almost every Spring Boot jar, and its CVEs follow it there. Here is how to find your real embedded Tomcat version and patch it.
What Is a Cross-Site Scripting Vulnerability, and How Do You Fix It?
A cross-site scripting vulnerability lets an attacker run their JavaScript in your users' browsers, and you fix it by encoding output and validating input at the right boundaries.
Maven SBOM: How to Generate a Software Bill of Materials for Java Builds
A Maven SBOM inventories every direct and transitive dependency in your Java build. Here is how to generate one with the CycloneDX plugin and put it to work for security.
org.springframework:spring-web: Known CVEs and How to Stay Patched
A security-focused look at org.springframework:spring-web, including the Spring4Shell RCE, how spring-web relates to spring-webmvc, and how to keep the dependency safe.
The POJO Class in Java: A Security Guide to Plain Objects
A POJO class in Java looks harmless — just fields and getters — but the moment it becomes a deserialization target it turns into an attack surface. Here is how plain objects go wrong and how to keep them safe.
Log4j 1.2.17: Why It Is Still a Security Problem
Log4j 1.2.17 is the last release of a branch that reached end of life in 2015. It carries multiple RCE and deserialization flaws and cannot be patched. Here is what to do about it.
XXE Example in Java: How the Attack Works and How to Stop It
A concrete XXE example in Java showing why default XML parsers are dangerous, what an attacker can read, and the exact parser configuration that shuts it down.
The Most Common Java Security Flaws and How to Fix Them
A practitioner's tour of the Java security flaws that actually break production systems — deserialization, injection, XXE, and the dependency risks that scanners miss.
Java URL Decode: Doing It Safely Without Opening Holes
Java URL decode looks trivial until you hit double-decoding and encoding mismatches. Here is how to decode URLs in Java correctly and where the security bugs hide.
What a Code Fixer Really Does: A Security Guide
A code fixer promises to find and repair bugs automatically, but for security work the details matter. Here is how to use one without introducing new risk.
CVE-2023-22081: The Oracle Java JSSE Denial-of-Service Flaw
CVE-2023-22081 is a Java SE and GraalVM vulnerability in the JSSE component that can cause a partial denial of service over HTTPS. Here is what to patch.
CVE-2022-40152: Woodstox XML Parsing Denial of Service
CVE-2022-40152 lets malicious XML with deeply nested DTD content crash Woodstox-based parsers via stack overflow. Here is the root cause, affected versions, and how to remediate it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.