java
Safeguard articles tagged "java" — guides, analysis, and best practices for software supply chain and application security.
86 articles
Apache Tomcat CVE-2025-24813: a deserialization deep dive
Tomcat's partial-PUT deserialization RCE turned a session persistence feature into a remote code execution path, and the pattern is one Java middleware keeps repeating.
nimbus-jose-jwt: JWT Handling in Java Done Right
com.nimbusds:nimbus-jose-jwt is the JVM's workhorse JOSE library. Here is how to configure it so algorithm confusion, weak validation, and its one recent CVE never reach production.
spring-boot-starter-security: Secure Defaults and Common Mistakes
What actually happens when you add spring-boot-starter-security to your build, the defaults it turns on, and the configuration mistakes that quietly undo them.
Semgrep Supply Chain: April 2026 Update Reviewed
Semgrep's April 2026 release added dedicated advisory pages, dependency path data in SBOM exports, a Guardian Supply Chain hook, and Maven/Gradle scanning without lockfiles.
java.lang.NullPointerException: Causes, Fixes, and Prevention
What actually throws java.lang.NullPointerException, how to read the helpful messages modern JVMs print, and the handful of patterns that keep null out of your call paths.
com.fasterxml.jackson.databind: Maven Coordinates, Modules, and Version Strategy
com.fasterxml.jackson.databind is the Java package, not the Maven groupId, and that mixup breaks builds weekly. Here are the correct coordinates, the module map, and a version strategy that survives audits.
Code Quality Tools That Also Strengthen Your Security
Code quality tools do more than catch style nits; the good ones surface the same weak patterns that turn into vulnerabilities. Here is how quality tooling and security overlap, with a focus on Java.
CVE-2014-0114: The Apache Commons BeanUtils ClassLoader Flaw Explained
CVE-2014-0114 lets attackers manipulate the ClassLoader through Apache Commons BeanUtils and Struts 1, opening a path to remote code execution. Here is what it affects and how to remediate it.
How to Install Maven on Windows, macOS, and Linux
A step-by-step guide to install Maven on any OS, verify the install, and avoid the JAVA_HOME and PATH mistakes that trip up most first-time setups.
netty-handler: TLS in Netty and Keeping It Patched
netty-handler is where Netty's TLS lives, which makes it the module scanners flag most. What SslHandler actually does, the hostname-verification gotcha, and the patch cadence to keep.
What Is a DTO (Data Transfer Object)? Security Notes for Java and Beyond
A DTO is a plain object that carries data across a boundary. Used well it is also one of your best defenses against mass assignment and data over-exposure.
jackson-core Maven: What It Is and Where the Risk Lives
jackson-core is the low-level streaming engine behind Jackson, added via Maven. Here is what the artifact does, why it is safer than jackson-databind, and how to keep the whole stack patched.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.