Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

zalando/logbook

              main @ 89eb763
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Dependency Vulnerability: 1 prior fix. Scrutinize any change in this area.

pom.xml: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

XML External Entity (XXE): XML payloads processed during HTTP request body logging were parsed without disabling external entity resolution, exposing the application to XXE attacks. Developers must always configure parsing factories to disallow DOCTYPE declarations and external general or parameter entities.

RFD (Reflected File Download): The project historically inherited a Reflected File Download vulnerability via older Spring Framework versions (CVE-2020-5421). Outdated framework dependencies pose a recurring risk to downstream consumers of the logging library.

Dependency Vulnerability: Upstream vulnerabilities in critical networking dependencies like netty-codec-http can compromise the application's transport layer. Regular dependency scanning and timely upgrades are critical.