Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

alibaba/druid

              master @ 0edb8fd
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

core/src/main/java/com/alibaba/druid/pool/DruidDataSource.java: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The connection pool historically allowed stale database sessions to persist after credential or URL changes. If old connections are not discarded, unauthorized clients can bypass updated database access controls.

Auth Bypass: WallFilter bypasses, including incorrect SPI order execution and failure to clear ThreadLocal context, can lead to data isolation bypasses and exposure of restricted database columns via proxies.