BestHub
Sign in
Tagged articles

Java security

31 articles · Page 1 of 1
Architect's Tech Stack
Architect's Tech Stack
Oct 23, 2026 · Information Security

Java CVE-2026-91403: eMudhra CA Private Keys (4,56,115) Break Trust Chain

A critical Java vulnerability (CVE-2026-91403, CVSS 9.1) stems from three eMudhra intermediate CA private keys with absurdly small values (4, 56, 115) on the P-384 curve, allowing instant private key recovery and forged certificates; browsers blocked them via preloaded revocation lists, but Java's JSSE defaults to skipping revocation checks, requiring JDK upgrades or manual blocked.certs updates and enabling revocation checking.

CVE-2026-91403Java securityPKIX
0 likes · 15 min read
Java CVE-2026-91403: eMudhra CA Private Keys (4,56,115) Break Trust Chain
21CTO
21CTO
Oct 22, 2026 · Information Security

Oracle Emergency Java Alert: CVE-2026-91403 Blocks eMudhra Weak Keys

Oracle issued an emergency Java patch for CVE-2026-91403 (CVSS 9.1) after eMudhra CA issued eight intermediate certificates with trivially weak elliptic-curve private keys, enabling anyone to forge HTTPS certificates; Java's independent trust store and disabled revocation checks require immediate JDK upgrades or manual blacklist updates.

CRLCVE-2026-91403Certificate Authority
0 likes · 10 min read
Oracle Emergency Java Alert: CVE-2026-91403 Blocks eMudhra Weak Keys
Java Architecture Diary
Java Architecture Diary
Oct 22, 2026 · Information Security

AI-Accelerated Vulnerability Wave Hits Java: Oracle JDK Cert Trust & Tomcat Async Flaws Demand Urgent Patches

This week's vulnerability surge, accelerated by AI-powered auditing, struck Java's core with a critical Oracle JDK certificate trust flaw (CVE-2026-91403) and a Tomcat HTTP/2 async request smuggling bug (CVE-2026-101356), forcing immediate JDK upgrades and Tomcat version pins in Spring Boot projects.

AI vulnerability discoveryCVE-2026-101356CVE-2026-91403
0 likes · 8 min read
AI-Accelerated Vulnerability Wave Hits Java: Oracle JDK Cert Trust & Tomcat Async Flaws Demand Urgent Patches
Top Architect
Top Architect
Nov 11, 2024 · Information Security

OAuth 2.0 Overview and Spring Boot Implementation Guide

This article introduces the core concepts and roles of OAuth 2.0, explains its four grant types, and provides a step‑by‑step Spring Boot implementation with complete configuration classes, dependency setup, and testing procedures for both authorization and resource servers.

Java securitySpring Bootauthorization-server
0 likes · 12 min read
OAuth 2.0 Overview and Spring Boot Implementation Guide
Java Architecture Stack
Java Architecture Stack
Nov 6, 2024 · Information Security

Mastering Apache Shiro: Core Concepts, Real‑World Usage, and JWT Microservice Integration

This article explains Apache Shiro’s fundamental components—Subject, SecurityManager, Realm, Session, authentication, authorization, and cryptography—then walks through a complete configuration example, a custom Realm, JWT integration, and a Spring Boot microservice scenario to illustrate secure, stateless authentication and fine‑grained permission control.

Apache ShiroAuthorizationJWT
0 likes · 13 min read
Mastering Apache Shiro: Core Concepts, Real‑World Usage, and JWT Microservice Integration
Architect
Architect
Sep 11, 2024 · Information Security

How to Secure Your Spring Boot JAR Against Decompilation with ClassFinal

This guide explains how to protect a Spring Boot release package from source leakage by comparing code obfuscation and encryption, detailing the configuration of the classfinal‑maven‑plugin, launch commands with and without passwords, and binding the encrypted jar to a specific machine.

ClassFinalCode EncryptionJar Protection
0 likes · 7 min read
How to Secure Your Spring Boot JAR Against Decompilation with ClassFinal
macrozheng
macrozheng
Jan 11, 2024 · Information Security

How to Secure Your SpringBoot Application from Decompilation with ClassFinal

This guide explains how to protect a SpringBoot-based e‑commerce project from source leakage by using code obfuscation or the ClassFinal Maven plugin, detailing configuration, startup options, decompilation results, and machine‑binding to ensure the packaged jar runs only on authorized servers.

ClassFinalJava securitySpringBoot
0 likes · 7 min read
How to Secure Your SpringBoot Application from Decompilation with ClassFinal
Java Backend Technology
Java Backend Technology
Apr 10, 2023 · Information Security

What New Security Features Does JDK 20 Offer? Encryption, TLS, and JFR Highlights

JDK 20, released in March 2023, introduces a suite of security enhancements—including new exception constructors, expanded algorithm service attributes, stricter defaults for DTLS 1.0 and ECDH suites, performance‑boosting intrinsics for ChaCha20, Poly1305, MD5 and ECC, as well as new Java Flight Recorder events for tracking security properties—providing developers with stronger defaults and better observability.

JFRJava securityTLS
0 likes · 8 min read
What New Security Features Does JDK 20 Offer? Encryption, TLS, and JFR Highlights
Java Architect Essentials
Java Architect Essentials
Jun 1, 2022 · Information Security

Fastjson 1.2.80 and Earlier Vulnerability: Risks, Affected Versions, and Upgrade Recommendations

Fastjson versions up to 1.2.80 contain a deserialization vulnerability that can bypass autoType restrictions, posing significant remote attack risk; users are advised to upgrade to the latest 1.2.83 release, enable safeMode or use the noneautotype builds, and consider migrating to Fastjson 2.0 for enhanced security.

FastjsonJava securityLibrary Upgrade
0 likes · 5 min read
Fastjson 1.2.80 and Earlier Vulnerability: Risks, Affected Versions, and Upgrade Recommendations
Programmer DD
Programmer DD
May 25, 2022 · Information Security

Critical Fastjson Deserialization Flaw Fixed – What You Need to Know

Fastjson versions up to 1.2.80 contain a deserialization flaw that can bypass the default autoType restriction, but the issue is mitigated by safeMode; the Fastjson team has released patches, recommending upgrades to 1.2.83, enabling safeMode, or migrating to Fastjson v2 for enhanced security.

FastjsonJava securitySafeMode
0 likes · 4 min read
Critical Fastjson Deserialization Flaw Fixed – What You Need to Know
Programmer DD
Programmer DD
Dec 20, 2021 · Information Security

How to Safely Upgrade to Log4j2 2.17.0 and Mitigate CVE‑2021‑45105

Log4j2 2.17.0 fixes the critical CVE‑2021‑45105 vulnerability affecting versions up to 2.16.0, and the article explains the flaw, provides Maven upgrade instructions, and offers temporary mitigation steps for environments that cannot upgrade immediately.

CVE-2021-45105Java securityPatternLayout
0 likes · 4 min read
How to Safely Upgrade to Log4j2 2.17.0 and Mitigate CVE‑2021‑45105
macrozheng
macrozheng
Dec 12, 2021 · Information Security

Unpacking the Log4j2 Log4Shell Vulnerability: How JNDI Injection Works

This article breaks down the widely publicized Log4j2 (Log4Shell) flaw, explaining the underlying JNDI and LDAP lookup mechanisms, how malicious payloads are executed through log messages, the massive impact across Java ecosystems, and the steps needed to remediate the issue.

JNDI injectionJava securityRemote Code Execution
0 likes · 10 min read
Unpacking the Log4j2 Log4Shell Vulnerability: How JNDI Injection Works
21CTO
21CTO
Dec 11, 2021 · Information Security

Critical Apache Log4j2 Remote Code Execution Vulnerability: Risks and Fixes

Google delays its office‑return plan and grants US staff a $1,600 bonus, while a severe Apache Log4j2 remote‑code‑execution flaw affecting many Java projects is disclosed with mitigation steps, and IntelliJ IDEA introduces built‑in audio‑video chat for collaborative coding.

Audio Video CollaborationGoogle BonusIntelliJ IDEA
0 likes · 5 min read
Critical Apache Log4j2 Remote Code Execution Vulnerability: Risks and Fixes
Java High-Performance Architecture
Java High-Performance Architecture
Dec 2, 2021 · Information Security

Mastering Spring Boot Security: A Minimalist Guide to Integrating Apache Shiro

This tutorial walks through building a Spring Boot application with Apache Shiro, covering core concepts, database schema design, Maven dependencies, configuration files, entity and DAO layers, service implementations, Shiro realm and security configuration, login handling, role and permission testing, and future extension ideas.

Apache ShiroAuthorizationJava security
0 likes · 19 min read
Mastering Spring Boot Security: A Minimalist Guide to Integrating Apache Shiro
Programmer DD
Programmer DD
Nov 24, 2021 · Information Security

Shiro vs Spring Security: Which Java Security Framework Fits Your Project?

This article compares Apache Shiro and Spring Security, outlining their core concepts, execution flows, key features, and practical guidance to help developers choose the most suitable Java security framework based on project requirements and team expertise.

AuthorizationJava securitySpring Security
0 likes · 5 min read
Shiro vs Spring Security: Which Java Security Framework Fits Your Project?
Full-Stack Internet Architecture
Full-Stack Internet Architecture
Nov 8, 2021 · Information Security

Comprehensive Apache Shiro Tutorial: Introduction, Configuration, Realms, Authentication Strategies, Encryption, Salt, Authorization, Spring Integration, and Caching

This extensive guide explains Apache Shiro's core concepts, demonstrates how to set up simple authentication, configure various Realm types, apply multi‑realm authentication strategies, encrypt passwords with hashing and salting, implement custom authorization, integrate Shiro with Spring MVC, explore different login methods, use JSP tags for UI control, and enable caching with Ehcache, providing complete code examples throughout.

Apache ShiroAuthorizationJava security
0 likes · 47 min read
Comprehensive Apache Shiro Tutorial: Introduction, Configuration, Realms, Authentication Strategies, Encryption, Salt, Authorization, Spring Integration, and Caching
Senior Brother's Insights
Senior Brother's Insights
Jan 20, 2021 · Information Security

Understanding Apache Shiro: Core Concepts, Architecture, and Features

This article introduces Apache Shiro, a lightweight Java security framework, covering its authentication, authorization, cryptography, session management, core components, module functions, and overall architecture to help developers grasp its practical use in permission management.

Apache ShiroAuthorizationJava security
0 likes · 10 min read
Understanding Apache Shiro: Core Concepts, Architecture, and Features
Programmer DD
Programmer DD
Aug 22, 2020 · Information Security

Why You Must Upgrade to Apache Shiro 1.6.0 to Patch Critical Auth Bypass

Apache Shiro 1.6.0 has been released, fixing a high‑risk authentication bypass vulnerability (CVE‑2020‑13933), updating several components, and providing Maven coordinates, so developers should upgrade immediately to secure their Java applications.

Apache ShiroCVE-2020-13933Java security
0 likes · 3 min read
Why You Must Upgrade to Apache Shiro 1.6.0 to Patch Critical Auth Bypass
Programmer DD
Programmer DD
Nov 8, 2019 · Information Security

How to Exploit Apache Commons FileUpload Deserialization: Payloads, Code Walkthrough, and Fixes

This article dissects the Apache Commons FileUpload DiskFileItem deserialization flaw, explains how readObject can be abused to write arbitrary files or directories depending on FileUpload and JDK versions, demonstrates payload construction with ysoserial, provides full Java code analysis, and outlines mitigation strategies.

Apache Commons FileUploadFile Upload VulnerabilityJava security
0 likes · 9 min read
How to Exploit Apache Commons FileUpload Deserialization: Payloads, Code Walkthrough, and Fixes
Programmer DD
Programmer DD
Aug 10, 2019 · Information Security

Secure Your Spring Boot App with Apache Shiro: Auth, Authz, and Redis

This article walks through integrating Apache Shiro into a Spring Boot project to handle authentication, authorization, session management, and caching, including custom realms, Redis-backed sessions, and cache managers, while providing detailed code examples and configuration guidance.

Apache ShiroAuthorizationJava security
0 likes · 20 min read
Secure Your Spring Boot App with Apache Shiro: Auth, Authz, and Redis
Alibaba Cloud Native
Alibaba Cloud Native
Jan 3, 2019 · Fundamentals

Uncovering Hidden JVM Bugs with Classfuzz and Classming Bytecode Mutations

This article explains how bytecode‑level fuzzing techniques—Classfuzz for syntax mutation and Classming for semantic mutation—are used to generate executable Java class variants, run differential tests across multiple JVM implementations, and systematically expose JVM defects and security vulnerabilities.

ClassfuzzClassmingJVM testing
0 likes · 20 min read
Uncovering Hidden JVM Bugs with Classfuzz and Classming Bytecode Mutations
Java Captain
Java Captain
Oct 14, 2018 · Information Security

Apache Shiro Java Security Framework Overview and Integration Guide

This article introduces Apache Shiro as a powerful Java security framework, explains its core components such as Subject, SecurityManager, Authenticator, Authorizer, Realm, SessionManager, CacheManager and Cryptography, and provides step‑by‑step integration instructions with Maven, XML configuration, custom realm code, controller logic and JSP tag usage.

Apache ShiroAuthorizationJava security
0 likes · 10 min read
Apache Shiro Java Security Framework Overview and Integration Guide
Big Data and Microservices
Big Data and Microservices
Jul 23, 2018 · Information Security

Understanding Apache Shiro: Core Concepts and Architecture Explained

This article introduces Apache Shiro, a lightweight Java security framework, and explains its three core concepts—Subject, SecurityManager, and Realms—while detailing the full system architecture including authenticators, authorizers, session management, caching, and cryptography components.

Apache ShiroAuthorizationJava security
0 likes · 5 min read
Understanding Apache Shiro: Core Concepts and Architecture Explained
Java Captain
Java Captain
Apr 27, 2018 · Information Security

Integrating Apache Shiro with Spring MVC: Detailed Example and Configuration Guide

This article provides a step‑by‑step tutorial on using Apache Shiro for authentication, authorization, session management and encryption in a Java web project, covering Maven dependencies, custom Realm implementation, Spring XML configuration, servlet filter setup, controller logic, JSP login page, demo screenshots and common pitfalls.

Apache ShiroAuthorizationJava security
0 likes · 17 min read
Integrating Apache Shiro with Spring MVC: Detailed Example and Configuration Guide