java
Safeguard articles tagged "java" — guides, analysis, and best practices for software supply chain and application security.
96 articles
spring-context: The Dependency at the Heart of Spring (and Its CVEs)
spring-context is the artifact that gives you Spring's ApplicationContext, and it drags four more Spring modules into your build. Here is what it does, what it pulls in, and the CVEs that have hit it.
spring-security-crypto: What It Does and How to Use It Safely
The spring-security-crypto module gives Spring apps password hashing, symmetric encryption, and key generation without pulling in the full security framework. Here is how to use each piece correctly.
SnakeYAML in Maven: How to Use It Safely and Avoid CVE-2022-1471
Adding SnakeYAML as a Maven dependency is fine, but parsing untrusted YAML with the default constructor is not. Here is how to pin a safe version and lock down deserialization.
Java Stream Sum: How to Add Numbers Safely in Java
A practical look at computing a Java stream sum correctly, from IntStream.sum() to reduce(), plus the overflow and null pitfalls that turn a simple total into a bug.
What Is a Code Analyzer? A Practical Security Guide
A code analyzer inspects source or compiled code for bugs and security flaws before they ship. Here is how the different types work and where they fit in a pipeline.
Eclipse Jetty Vulnerabilities: What to Patch and When
Jetty's HTTP/2 handling and older 9.4.x branches have carried real denial-of-service and information-disclosure CVEs — here's what a jetty 9.4.41 exploit actually looks like and which versions close it.
CVE-2023-34042: How the Spring Security XSD Permission Flaw Works
CVE-2023-34042 is a world-writable file permission issue in Spring Security's config JAR. Here is what actually breaks, who is affected, and how to remediate it.
URL Encoding and Decoding in Java: URLEncoder and URLDecoder
How URLEncoder.encode in Java actually behaves, why it turns spaces into plus signs, the Charset overload you should be using, and where hand-rolled encoding turns into an injection bug.
xercesImpl: XXE Risks in Java XML Parsing and How to Configure It
The xercesImpl Maven artifact turns up transitively in thousands of Java builds. Here is its real CVE history, why XXE is your configuration's fault, and the hardening block to paste.
Java SBOM Generation Tools Compared
Six tools generate SBOMs from Java projects. They disagree on transitive depth, license fields, and licensing of their own output. A head-to-head.
Java Modules Supply Chain Security
The Java Platform Module System arrived in Java 9 and has aged into quiet maturity. What JPMS actually does for supply chain posture in enterprise Java.
Reachability Analysis for Java: A 2026 Deep Dive
Java reachability under classpath reality: reflection, Spring autowiring, shaded JARs, Log4Shell, and what modern tools actually resolve versus over-approximate.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.