Skip to contentLine Corporation Armeria vulnerabilities
- line corporation armeriaA vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can cause excessive memory allocation, potentially resulting in denial of service.CVE-2026-1218248.7 High
- line corporation armeriaA vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path normalization can allow unauthenticated attackers to bypass path-based access controls and acce…CVE-2026-1218238.7 High
- line corporation armeriaA vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names can cause stored cross-site scripting (XSS) when directory listing is enabled and…CVE-2026-1218222.4 Low
- line corporation armeriaA vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured path restrictions, allowing an attacker-controlled website visit…CVE-2026-1218215.3 Medium
- line corporation armeriaA vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder decompresses attacker-supplied SAML messages without limiting the output size befo…CVE-2026-1218208.7 High
- line corporation armeriaA vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment without resolving symbolic links, allowing a compromised or semi-t…CVE-2026-1218195.9 Medium
- line corporation armeriaA vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is reflected into the HTTP Location header after successful authentication, allowing…CVE-2026-117535.1 Medium
- line corporation armeriaA vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing replay of previously consumed assertion IDs within their validi…CVE-2026-117497.6 High
- line corporation armeriaA vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed u…CVE-2026-117519.1 Critical
- line corporation armeriaArmeria: External Control of File Name or Path in xDS SDS DataSourceCVE-2026-11752Fix available5.9 Medium
- line corporation armeriaArmeria SAML authentication bypass due to missing validation on unsigned SAML messagesCVE-2024-1735Fix available9.1 Critical
- line armeriaPaths contain matrix variables bypass decoratorsCVE-2023-38493Fix available7.5 High
- line armeriaImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in com.linecorp.armeria:armeriaCVE-2021-43795Fix available7.5 High
- line armeriaImproper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in ArmeriaCVE-2019-16771Fix available4.8 Medium