Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

LINE Armeria 1.43.0 fixes path-scoped decorator auth bypass, Thrift memory DoS, and SAML inflate bomb

Armeria (LINE)

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

LINE's Armeria 1.43.0 security release patches three High issues published Nov 6 2026: GHSA-xqhm-4ph4-423v / CVE-2026-121823 lets attackers bypass path-scoped decorators (for example decoratorUnder("/admin", auth)) by inserting a '.' path segment that FileService, TomcatService and JettyService still resolve; GHSA-2pfv-5p52-crjm / CVE-2026-121824 lets a reachable Thrift endpoint allocate attacker-controlled heap from malformed TBinary/TCompact length fields before the body is verified; and GHSA-6hgp-j5h7-33m3 / CVE-2026-121820 lets an unauthenticated HTTP-Redirect SAMLRequest/SAMLResponse inflate into an unbounded buffer in armeria-saml before any signature check. The same release also fixes Moderate CORS any-origin route ignore (GHSA-386q-mrg6-jfj8 / CVE-2026-121821), Low FileService stored XSS (GHSA-x9vf-hjgg-cq25 / CVE-2026-121822), and Moderate armeria-xds symlink SDS confinement bypass (GHSA-m64h-m6r5-6jrx / CVE-2026-121819). Upgrade to 1.43.0.

Why this severity: Three High advisories in 1.43.0 (path decorator auth bypass, Thrift memory DoS, SAML inflate DoS) plus Medium/Low CORS, FileService XSS, and xds symlink siblings

Started
Nov 6, 2026
CVEs
CVE-2026-121823CVE-2026-121824CVE-2026-121820CVE-2026-121821CVE-2026-121822CVE-2026-121819

Follow this incident

Discuss on X ↗

Affected

  • com.linecorp.armeria:armeria <= 1.42.0 (path decorator / CORS / FileService XSS ranges vary by advisory; treat all <=1.42.0 as needing 1.43.0)
  • com.linecorp.armeria:armeria-thrift / armeria-thrift0.9 / related Thrift artifacts prior to 1.43.0
  • com.linecorp.armeria:armeria-saml <= 1.42.0
  • com.linecorp.armeria:armeria-xds >= 1.40.0, < 1.43.0

Fixed in

  • com.linecorp.armeria:* 1.43.0

Timeline1

  1. LINE publishes Armeria 1.43.0 and six GitHub security advisories covering path-scoped decorator bypass, Thrift malformed-message memory DoS, armeria-saml HTTP-Redirect decompression bomb, CORS any-origin route ignore, FileService stored XSS, and armeria-xds symlink SDS bypass.

Advisories8

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo