Security

SECURITY.md

Security Policy

Supported Versions

Version	Supported
4.x	✅
3.x	✅
2.x	❌
1.x	❌

Reporting a Vulnerability

Open an issue at https://github.com/jooby-project/jooby/issues or
On issue ask for new security advisor. Please don't describe the vulnerability here
Wait until project owners creates a security advisor
Describe the security vulnerability in the security advisor

jooby-pac4j: deserialization of untrusted data
GHSA-7c5v-895v-w4q5 published Mar 31, 2025 by jknack

High
assets: path traversal
GHSA-px9h-x66r-8mpc published May 11, 2020 by jknack

Moderate
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting)
GHSA-gv3v-92v6-m48j published Apr 2, 2020 by jknack

Moderate

Learn more about advisories related to jooby-project/jooby in the GitHub Advisory Database