Armeria

Security incidents tagged Armeria. Newest first.

1 Armeria incident in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

Patched
LINE Armeria 1.43.0 fixes path-scoped decorator auth bypass, Thrift memory DoS, and SAML inflate bomb
LINE's Armeria 1.43.0 security release patches three High issues published Nov 6 2026: GHSA-xqhm-4ph4-423v / CVE-2026-121823 lets attackers bypass path-scoped decorators (for example decoratorUnder("/admin", auth)) by inserting a '.' path segment that FileService, TomcatService and JettyService still resolve; GHSA-2pfv-5p52-crjm / CVE-2026-121824 lets a reachable Thrift endpoint allocate attacker-controlled heap from malformed TBinary/TCompact length fields before the body is verified; and GHSA-6hgp-j5h7-33m3 / CVE-2026-121820 lets an unauthenticated HTTP-Redirect SAMLRequest/SAMLResponse inflate into an unbounded buffer in armeria-saml before any signature check. The same release also fixes Moderate CORS any-origin route ignore (GHSA-386q-mrg6-jfj8 / CVE-2026-121821), Low FileService stored XSS (GHSA-x9vf-hjgg-cq25 / CVE-2026-121822), and Moderate armeria-xds symlink SDS confinement bypass (GHSA-m64h-m6r5-6jrx / CVE-2026-121819). Upgrade to 1.43.0.
Armeria (LINE)Since Nov 6, 2026updated Nov 6, 2026, 09:49 UTC