Org.wildfly.security:wildfly-elytron

This hub aggregates every CVE we track for Org.wildfly.security:wildfly-elytron, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 5 most recently published vulnerabilities affecting Org.wildfly.security:wildfly-elytron.

• CVE-2024-12369Elytron-oidc-client: oidc authorization code injection4.2Dec 9, 2024
• CVE-2022-3143wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulne...7.4Jan 11, 2023
• CVE-2021-3642A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest...5.3Aug 5, 2021
• CVE-2020-10714A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack...7.5Sep 23, 2020
• CVE-2020-1748A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in a...7.5Sep 16, 2020