LINE Armeria 1.43.0 fixes path-scoped decorator auth bypass, Thrift memory DoS, and SAML inflate bomb ยท updates https://pwn.watch/i/line-armeria-1-43-0-path-decorator-thrift-saml-fixes-nov-2026 LINE's Armeria 1.43.0 security release patches three High issues published Nov 6 2026: GHSA-xqhm-4ph4-423v / CVE-2026-121823 lets attackers bypass path-scoped decorators (for example decoratorUnder("/admin", auth)) by inserting a '.' path segment that FileService, TomcatService and JettyService still resolve; GHSA-2pfv-5p52-crjm / CVE-2026-121824 lets a reachable Thrift endpoint allocate attacker-controlled heap from malformed TBinary/TCompact length fields before the body is verified; and GHSA-6hgp-j5h7-33m3 / CVE-2026-121820 lets an unauthenticated HTTP-Redirect SAMLRequest/SAMLResponse inflate into an unbounded buffer in armeria-saml before any signature check. The same release also fixes Moderate CORS any-origin route ignore (GHSA-386q-mrg6-jfj8 / CVE-2026-121821), Low FileService stored XSS (GHSA-x9vf-hjgg-cq25 / CVE-2026-121822), and Moderate armeria-xds symlink SDS confinement bypass (GHSA-m64h-m6r5-6jrx / CVE-2026-121819). Upgrade to 1.43.0. en Fri, 06 Nov 2026 00:00:00 GMT LINE Armeria 1.43.0 fixes path-scoped decorator auth bypass, Thrift memory DoS, and SAML inflate bomb: LINE publishes Armeria 1.43.0 and six GitHub security advisories covering path-scoped decorator bypass, Thrift malformed-message memory DoS, armeria-saml HTTP-Redirect decompression bomb, CORS any-origin route ignore, FileService stored XSS, and armeria-xds symlink SDS bypass. https://pwn.watch/i/line-armeria-1-43-0-path-decorator-thrift-saml-fixes-nov-2026 https://pwn.watch/i/line-armeria-1-43-0-path-decorator-thrift-saml-fixes-nov-2026#2026-11-06-3df6ec20 Fri, 06 Nov 2026 00:00:00 GMT high <p><a href="https://github.com/line/armeria/security/advisories/GHSA-xqhm-4ph4-423v">Source</a></p>