issues Search Results · language:Dune language:JavaScript language:Java language:JavaScript

Filter by

• • Code... (...)results
  • Repositories
    results
  • Issues
    results
  • Pull requests
    results
  • Discussions
    results
  • Users
    results
  • More

• State

  • Open
  • Closed

• Advanced

  • Owner
  • State
  • Close reason
  • Has linked pull request
  • Author
  • Assignee
  • Mentioned user
  • Mentioned team
  • Commenter
  • Involved user
  • Label
  • Milestone
  • Number of comments
  • Number of interactions
• Advanced search

Filter:Issues33.4M (33.4M)

33.4M results  (678 ms)

33.4M results

Sort by: Best match

Filter

cpkb-bluezoo/gumdrop

[SEC-015] HTTP/2 rapid reset (CVE-2023-44487) only partially mitigated

Security review finding SEC-015 from SECURITY-REVIEW.md (2026-07-05). Severity Medium Confidence Reported Component HTTP/2 Locations src/org/bluezoo/gumdrop/http/HTTPProtocolHandler.java:871-882, ...

area:http

bug

medium

security

• cpkb-bluezoo
·
• Opened 
  42 minutes ago
·
• #19

cpkb-bluezoo/gumdrop

[SEC-014] Session replication deserialization filter too permissive

Security review finding SEC-014 from SECURITY-REVIEW.md (2026-07-05). Severity High Confidence Reported Component servlet / session Locations src/org/bluezoo/gumdrop/servlet/session/SessionSerializer.java:366-462 ...

area:servlet

bug

high

security

• cpkb-bluezoo
·
• Opened 
  42 minutes ago
·
• #18

cpkb-bluezoo/gumdrop

[SEC-013] FTP active mode (PORT/EPRT) enables FTP bounce

Security review finding SEC-013 from SECURITY-REVIEW.md (2026-07-05). Severity High Confidence Reported Component FTP Locations - src/org/bluezoo/gumdrop/ftp/FTPProtocolHandler.java:817, :921 ...

area:ftp

bug

high

security

• cpkb-bluezoo
·
• Opened 
  42 minutes ago
·
• #17

cpkb-bluezoo/gumdrop

[SEC-012] Open UDP DNS resolver/forwarder bypasses listener ACLs

Security review finding SEC-012 from SECURITY-REVIEW.md (2026-07-05). Severity High Confidence Reported Component DNS Locations - src/org/bluezoo/gumdrop/dns/DNSListener.java:124-131 - src/org/bluezoo/gumdrop/dns/DNSService.java:370-420 ...

area:dns

bug

high

security

• cpkb-bluezoo
·
• Opened 
  42 minutes ago
·
• #16

cpkb-bluezoo/gumdrop

[SEC-011] gRPC full-body buffering with overflowable total

Security review finding SEC-011 from SECURITY-REVIEW.md (2026-07-05). Severity High Confidence Reported Component gRPC Locations - src/org/bluezoo/gumdrop/grpc/server/GrpcHandler.java:74-108 ...

area:grpc

bug

high

security

• cpkb-bluezoo
·
• Opened 
  42 minutes ago
·
• #15

cpkb-bluezoo/gumdrop

[SEC-010] HTTP request body has no global size cap

Security review finding SEC-010 from SECURITY-REVIEW.md (2026-07-05). Severity High Confidence Reported Component HTTP Locations - src/org/bluezoo/gumdrop/http/Stream.java:454-466, :751-780 ...

area:http

bug

high

security

• cpkb-bluezoo
·
• Opened 
  42 minutes ago
·
• #14

cpkb-bluezoo/gumdrop

[SEC-009] WebSocket frame payload allocated before size limit enforced

Security review finding SEC-009 from SECURITY-REVIEW.md (2026-07-05). Severity High Confidence Reported Component WebSocket Locations - src/org/bluezoo/gumdrop/websocket/WebSocketFrame.java:252-294 ...

area:websocket

bug

high

security

• cpkb-bluezoo
·
• Opened 
  42 minutes ago
·
• #13

cpkb-bluezoo/gumdrop

[SEC-008] Duplicate/conflicting Content-Length accepted (request smuggling)

Security review finding SEC-008 from SECURITY-REVIEW.md (2026-07-05). Severity High Confidence Reported Component HTTP Locations src/org/bluezoo/gumdrop/http/Stream.java:454-461 Description Multiple ...

area:http

bug

high

security

• cpkb-bluezoo
·
• Opened 
  42 minutes ago
·
• #12

cpkb-bluezoo/gumdrop

[SEC-007] HTTP Digest replay logic inverted; verifier uses hardcoded method/URI

Security review finding SEC-007 from SECURITY-REVIEW.md (2026-07-05). Severity High Confidence Verified Component HTTP auth Locations src/org/bluezoo/gumdrop/http/HTTPAuthenticationProvider.java:527, ...

area:auth

area:http

bug

high

security

• cpkb-bluezoo
·
• Opened 
  42 minutes ago
·
• #11

cpkb-bluezoo/gumdrop

[SEC-006] SMTP OAUTHBEARER lets client authzid override token subject

Security review finding SEC-006 from SECURITY-REVIEW.md (2026-07-05). Severity High Confidence Reported Component SMTP Locations src/org/bluezoo/gumdrop/smtp/SMTPProtocolHandler.java:1607-1630 ...

area:smtp

bug

high

security

• cpkb-bluezoo
·
• Opened 
  42 minutes ago
·
• #10

Learn how you can use GitHub Issues to plan and track your work.

Save views for sprints, backlogs, teams, or releases. Rank, sort, and filter issues to suit the occasion. The possibilities are endless.Learn more about GitHub Issues

ProTip! Restrict your search to the title by using the in:title qualifier.

Learn how you can use GitHub Issues to plan and track your work.

Save views for sprints, backlogs, teams, or releases. Rank, sort, and filter issues to suit the occasion. The possibilities are endless.Learn more about GitHub Issues

ProTip! Restrict your search to the title by using the in:title qualifier.