# LINE Armeria 1.43.0 fixes path-scoped decorator auth bypass, Thrift memory DoS, and SAML inflate bomb · pwn.watch

> LINE's Armeria 1.43.0 security release patches three High issues published Nov 6 2026: GHSA-xqhm-4ph4-423v / CVE-2026-121823 lets attackers bypass path-scoped decorators (for example decoratorUnder("/admin", auth)) by inserting a '.' path segment that FileService, TomcatService and JettyService still resolve; GHSA-2pfv-5p52-crjm / CVE-2026-121824 lets a reachable Thrift endpoint allocate attacker-controlled heap from malformed TBinary/TCompact length fields before the body is verified; and GHSA-6hgp-j5h7-33m3 / CVE-2026-121820 lets an unauthenticated HTTP-Redirect SAMLRequest/SAMLResponse inflate into an unbounded buffer in armeria-saml before any signature check. The same release also fixes Moderate CORS any-origin route ignore (GHSA-386q-mrg6-jfj8 / CVE-2026-121821), Low FileService stored XSS (GHSA-x9vf-hjgg-cq25 / CVE-2026-121822), and Moderate armeria-xds symlink SDS confinement bypass (GHSA-m64h-m6r5-6jrx / CVE-2026-121819). Upgrade to 1.43.0.

Page: https://pwn.watch/i/line-armeria-1-43-0-path-decorator-thrift-saml-fixes-nov-2026 · generated 2026-11-06T10:56:42.467Z

## Status
- Severity: high · status: live · patch: patched
- Product: Armeria (LINE)
- Started: 2026-11-06
- CVEs: CVE-2026-121823, CVE-2026-121824, CVE-2026-121820, CVE-2026-121821, CVE-2026-121822, CVE-2026-121819
- Affected: com.linecorp.armeria:armeria <= 1.42.0 (path decorator / CORS / FileService XSS ranges vary by advisory; treat all <=1.42.0 as needing 1.43.0); com.linecorp.armeria:armeria-thrift / armeria-thrift0.9 / related Thrift artifacts prior to 1.43.0; com.linecorp.armeria:armeria-saml <= 1.42.0; com.linecorp.armeria:armeria-xds >= 1.40.0, < 1.43.0
- Fixed in: com.linecorp.armeria:* 1.43.0

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/line-armeria-1-43-0-path-decorator-thrift-saml-fixes-nov-2026/feed.xml
- JSON Feed: https://pwn.watch/i/line-armeria-1-43-0-path-decorator-thrift-saml-fixes-nov-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/line-armeria-1-43-0-path-decorator-thrift-saml-fixes-nov-2026.json
- This file: https://pwn.watch/i/line-armeria-1-43-0-path-decorator-thrift-saml-fixes-nov-2026/llms.txt

## Updates (newest first)
- 2026-11-06: LINE publishes Armeria 1.43.0 and six GitHub security advisories covering path-scoped decorator bypass, Thrift malformed-message memory DoS, armeria-saml HTTP-Redirect decompression bomb, CORS any-origin route ignore, FileService stored XSS, and armeria-xds symlink SDS bypass. (https://github.com/line/armeria/security/advisories/GHSA-xqhm-4ph4-423v)

## Fix brief
# Security brief: LINE Armeria 1.43.0 fixes path-scoped decorator auth bypass, Thrift memory DoS, and SAML inflate bomb

Source: https://pwn.watch/i/line-armeria-1-43-0-path-decorator-thrift-saml-fixes-nov-2026 · status: live · severity: high · updated Nov 6, 2026, 09:49 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
LINE's Armeria 1.43.0 security release patches three High issues published Nov 6 2026: GHSA-xqhm-4ph4-423v / CVE-2026-121823 lets attackers bypass path-scoped decorators (for example decoratorUnder("/admin", auth)) by inserting a '.' path segment that FileService, TomcatService and JettyService still resolve; GHSA-2pfv-5p52-crjm / CVE-2026-121824 lets a reachable Thrift endpoint allocate attacker-controlled heap from malformed TBinary/TCompact length fields before the body is verified; and GHSA-6hgp-j5h7-33m3 / CVE-2026-121820 lets an unauthenticated HTTP-Redirect SAMLRequest/SAMLResponse inflate into an unbounded buffer in armeria-saml before any signature check. The same release also fixes Moderate CORS any-origin route ignore (GHSA-386q-mrg6-jfj8 / CVE-2026-121821), Low FileService stored XSS (GHSA-x9vf-hjgg-cq25 / CVE-2026-121822), and Moderate armeria-xds symlink SDS confinement bypass (GHSA-m64h-m6r5-6jrx / CVE-2026-121819). Upgrade to 1.43.0.

Severity detail: Three High advisories in 1.43.0 (path decorator auth bypass, Thrift memory DoS, SAML inflate DoS) plus Medium/Low CORS, FileService XSS, and xds symlink siblings

- Product: Armeria (LINE)
- CVE / advisory ids: CVE-2026-121823, CVE-2026-121824, CVE-2026-121820, CVE-2026-121821, CVE-2026-121822, CVE-2026-121819

## Affected versions
- com.linecorp.armeria:armeria <= 1.42.0 (path decorator / CORS / FileService XSS ranges vary by advisory; treat all <=1.42.0 as needing 1.43.0)
- com.linecorp.armeria:armeria-thrift / armeria-thrift0.9 / related Thrift artifacts prior to 1.43.0
- com.linecorp.armeria:armeria-saml <= 1.42.0
- com.linecorp.armeria:armeria-xds >= 1.40.0, < 1.43.0

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- com.linecorp.armeria:* 1.43.0

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
Java/Armeria users: upgrade all com.linecorp.armeria artifacts to 1.43.0. Highest urgency for apps using path-scoped decorators with FileService/Tomcat/Jetty, exposed Thrift endpoints, or armeria-saml HTTP-Redirect. Never cite cve.now.

## Latest updates
- Nov 6, 2026: LINE publishes Armeria 1.43.0 and six GitHub security advisories covering path-scoped decorator bypass, Thrift malformed-message memory DoS, armeria-saml HTTP-Redirect decompression bomb, CORS any-origin route ignore, FileService stored XSS, and armeria-xds symlink SDS bypass.

## Advisories
- [GHSA-xqhm-4ph4-423v / CVE-2026-121823: Path-scoped decorators can be bypassed with a . path segment](https://github.com/line/armeria/security/advisories/GHSA-xqhm-4ph4-423v) (line/armeria)
- [GHSA-2pfv-5p52-crjm / CVE-2026-121824: Denial of service through excessive memory allocation when decoding malformed Thrift messages](https://github.com/line/armeria/security/advisories/GHSA-2pfv-5p52-crjm) (line/armeria)
- [GHSA-6hgp-j5h7-33m3 / CVE-2026-121820: Decompression bomb in armeria-saml HTTP-Redirect binding](https://github.com/line/armeria/security/advisories/GHSA-6hgp-j5h7-33m3) (line/armeria)
- [GHSA-386q-mrg6-jfj8 / CVE-2026-121821: Any-origin CorsService ignores route()/pathPatterns](https://github.com/line/armeria/security/advisories/GHSA-386q-mrg6-jfj8) (line/armeria)
- [GHSA-x9vf-hjgg-cq25 / CVE-2026-121822: Stored XSS in FileService directory listing](https://github.com/line/armeria/security/advisories/GHSA-x9vf-hjgg-cq25) (line/armeria)
- [GHSA-m64h-m6r5-6jrx / CVE-2026-121819: armeria-xds symbolic link SDS file confinement bypass](https://github.com/line/armeria/security/advisories/GHSA-m64h-m6r5-6jrx) (line/armeria)
- [Armeria 1.43.0 release](https://github.com/line/armeria/releases/tag/armeria-1.43.0) (line/armeria)
- [Armeria 1.43.0 release notes](https://armeria.dev/release-notes/1.43.0/) (armeria.dev)

---
Machine-readable: https://pwn.watch/i/line-armeria-1-43-0-path-decorator-thrift-saml-fixes-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.