Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The NumberUtil.toBigDecimal method in hutool-core was discovered to contain a stack overflow.
Recommended action: Upgrade to 5.8.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
hutool-core v5.8.23 was discovered to contain an infinite loop in the StrSplitter.splitByRegex function. This vulnerability allows attackers to cause a Denial of Service (DoS) via manipulation of the first two parameters.
Recommended action: Upgrade to 5.8.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().
Recommended action: Upgrade to 5.8.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/io/FileUtil.java.
Recommended action: Upgrade to 5.8.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability classified as problematic was found in Dromara HuTool up to 5.8.10. This vulnerability affects unknown code of the file cn.hutool.core.util.ZipUtil.java. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.8.11 is able to address this issue. It is recommended to upgrade the affected component.
Recommended action: Upgrade to 5.8.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.
Recommended action: Upgrade to 4.1.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.