Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

weld/core

              main @ c940cd3
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Information Disclosure: 3 prior fixes. Scrutinize any change in this area.

impl/src/main/java/org/jboss/weld/bean/proxy/ProxyFactory.java: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Privilege Escalation: Insecure assignment or generation of fallback ProtectionDomains during proxy class generation allows generated proxies to bypass intended access controls or run with elevated permissions. Developers must ensure proxy classes inherit the precise ProtectionDomain of the proxied bean.

Sandbox Escape: Leaking highly privileged AccessibleObject instances (Fields, Methods, Constructors) that have had JVM access checks suppressed exposes critical internals to untrusted user code or external CDI extensions.

Information Disclosure: Failing to fully deactivate contexts and invalidate ThreadLocal variables (such as BeanStore references) allows stale session or request state to leak across threads pooled by web servers, directly leading to data disclosure across distinct client sessions.