Brian Vermeer on foojay.io - Friends Of OpenJDK

Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478)

Fri, 15 May 2026 15:31:08 +0000

The Thymeleaf vulnerability with a CVSS score of 9.1 grabs your attention, as it should. But before you call the cavalry and claim this as the new Log4shell, read this first.

CVE-2026-40478 is a server-side template injection vulnerability in Thymeleaf discovered by pentester Dawid Bakaj. Thymeleaf is a templating engine in Java that is used for server-side webpage rendering. The sandbox that normally prevents arbitrary code execution got bypassed using a tab character. And yes, this can lead to a remote code execution if exploited.

How Chat Memory Manipulation Can Ruin Your AI System

Thu, 16 Oct 2025 10:45:59 +0000

Do LLMs have any conversational memory?

With the use of ChatGPT, Claude, and Copilot, we are now quite used to chat-based AI assistants that can help us. We’ve all grown accustomed to chatbots that “remember” us and the conversation we had before.

From virtual assistants that recall our preferences to support bots that track our past issues, chat memory feels like a natural part of interacting with digital agents. It’s easy to assume that modern AI models like ChatGPT or other LLM-powered bots possess similar built-in memory.

Ensuring Safe and Reliable AI Interactions with LLM Guardrails

Tue, 17 Jun 2025 07:11:24 +0000

Integrating Large Language Models (LLMs) into our applications is becoming increasingly popular. These models are extremely useful for creating content, searching documentation, and solving more complex problems. However, with great power comes great responsibility.

We know that LLMs can and will make mistakes, and while enriching your prompts with the proper context can help align results with your documents and information, risks still remain. Along with the rise of LLMs, new attack vectors are surfacing. Clever prompt injections can lead to misinformation and‌ escalate privacy-sensitive information.

Foojay Podcast #72: JCon Report, Part 1 - Grow your career, public speaking, 30 years of Java, greener coding,...

Mon, 02 Jun 2025 13:55:37 +0000

On May 13th and 14th, Foojay attended the JCON conference in Köln, Germany, where we did over 30 live-stream interviews. In this episode, we present to you the first set of these interviews, in which we focus on celebrating 30 years of Java, how you can grow your career, become a public speaker and writer, make your code more green, a bit of AI (of course…), and how the connections between open-source contributors can be visualized.

What is RAG, and How to Secure It

Fri, 16 May 2025 11:48:16 +0000

Integrating large language models (LLMs) into your application is more accessible than ever. With a few API calls to OpenAI, Anthropic, or Cohere, you can instantly add ++AI capabilities++ to your stack. Using frameworks and libraries that abstract this away for you makes it even easier to create your own LLM-powered assistant. However, if you’ve shipped any real-world LLM features, you’ve hit the wall where these powerful models confidently make up facts, reference outdated information, or deliver answers that don’t take your context into account.

Path Traversal Vulnerability in Deep Java Library (DJL)

Tue, 11 Mar 2025 12:21:50 +0000

Deep Java Library (++DJL++) is an open source deep learning framework that brings AI capabilities to Java developers without requiring a shift to Python.

It provides an intuitive, high-level API for building, training, and deploying machine learning models, supporting deep learning engines like TensorFlow, PyTorch, and MXNet.

While not as widely adopted as Python-based frameworks, DJL is gaining traction in Java-based AI applications, especially in enterprise software, cloud environments, and financial services.

Creating SBOMs with the Snyk CLI

Fri, 07 Mar 2025 12:25:36 +0000

The software bill of materials (SBOM) is quickly becoming an essential aspect of open source security and compliance. In this post, we’ll delve into what SBOMs are, why they’re necessary, and their role in open source security.

What are SBOMs?

A software Bill of Materials (SBOM) is a comprehensive inventory of all components used in a software product. They include all the necessary details about each component, such as their names, versions, and licensing information. SBOMs can be seen as the ingredients list for software, providing complete transparency into what makes up a software product.

Foojay Podcast #58: How Java Developers Can Secure Their Code

Mon, 30 Sep 2024 07:43:46 +0000

Three years after Log4Shell caused a significant security issue, we still struggle with insecure dependencies and injection problems.

In this podcast, we’ll discuss how developers can secure their code.

I talked with three authors who posted a security and code quality post on Foojay.io.

Video

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

The Persistent Threat: Why Major Vulnerabilities Like Log4Shell and Spring4Shell Remain Significant

Tue, 17 Sep 2024 16:17:07 +0000

This article was originally published at Snyk.io

As developers, we’re constantly juggling features, fixes, and deadlines. Yet, a lurking issue has been surprisingly overlooked: the continued use of vulnerable Log4j and Spring Framework versions in many projects.

Despite the high-profile exposure of Log4Shell and Spring4Shell vulnerabilities, a shocking number of applications are still running on these ticking time bombs. This isn’t just a minor oversight — it’s a major risk. We’re builders at heart, but part of building is ensuring our structures are safe.

Four Easy Ways to Analyze your Java and Kotlin Code for Security Problems

Fri, 30 Aug 2024 09:07:43 +0000

Originally published at Snyk.io .

Nowadays, the security of your applications is just as important as the functionality they provide. Therefore, analyzing your code for security vulnerabilities is a vital part of maintaining the integrity of your applications and protecting your users’ data. As developers, we are at the front lines of this battle. It’s our responsibility to ensure that the code we write is not just functional and efficient but also secure.

Securing Symmetric Encryption Algorithms in Java

Fri, 29 Dec 2023 05:53:50 +0000

In our connected world, securing digital data has become an utmost priority. With the wide spread of Java applications in various sectors, from banking to healthcare, we must emphasize the importance of encryption. Encryption is converting readable data or plaintext into unreadable data or ciphertext, ensuring that even if encrypted data is intercepted, it remains inaccessible to unauthorized individuals.

The first choice you must make as a developer is whether you need encryption. Although this sounds like a strange question, the key principle of encryption is that the ciphertext can be reverted into the original text.

Handling security vulnerabilities in Spring Boot

Fri, 22 Dec 2023 14:59:10 +0000

In the world of software development, managing dependencies is a core part of creating strong and secure applications. Spring Boot, a favorite among Java developers, makes building applications easier, but there’s more to it than meets the eye. Keeping your dependencies in check is crucial to ensure that your Spring Boot projects run smoothly and remain resilient in the face of ever-evolving threats.

One critical aspect of Spring Boot dependency management is security. Software vulnerabilities are discovered frequently, and by keeping your project’s dependencies up to date, you’re essentially putting on your digital security armor. Outdated dependencies can be like unlocked doors, inviting trouble from potential threats, and that’s something we’d like to avoid.

Using JLink to create smaller Docker images for Spring Boot apps

Thu, 21 Sep 2023 11:33:05 +0000

Containers bring new flexibility and agility to software development and deployment. However, they also introduce a new attack surface that malicious actors can exploit. A compromised container can give an attacker access to other containers and even the host system. Smaller images that contain fewer artifacts are already a great help in achieving a smaller attack surface.

In this article, we’ll present an in-depth exploration of utilizing JLink to optimize Docker image sizes, enhancing application security and performance. We’ll showcase how to use JLink and integrate it with Docker to efficiently deploy your Spring Boot or general Java applications.

SnakeYaml 2.0: Solving the unsafe deserialization vulnerability

Thu, 20 Jul 2023 07:17:16 +0000

In December of last year, we reported ++CVE-2022-1471++ to you. This unsafe deserialization problem could easily lead to arbitrary code execution under the right circumstances.

In the deep-dive blog post “++Unsafe deserialization vulnerability in SnakeYaml (CVE-2022-1471)++”, I explained the problems in this library and how it could be executed. The gist of the problem was that by default SnakeYaml parsed the incoming yaml to the generic object type.

This creates an opportunity to deserialize other classes that are available on the class path. Regardless of the ClassCastException that is thrown, if the object has already been loaded, the damage is done.

Preventing Cross-Site Scripting (XSS) in Java with Snyk Code

Fri, 09 Jun 2023 15:23:39 +0000

Java is a powerful backend programming language that can also be used to write HTML pages for web applications. However, developers must know the potential security risks associated with Cross-Site Scripting (XSS) attacks when creating these pages.

With the rise of modern templating frameworks, preventing security attacks through proper input validation and encoding techniques has become easier.

However, when developers choose to create their own HTML pages without using a templating framework, there is an increased risk of introducing vulnerabilities.

Mitigating Path Traversal Vulnerabilities in Java

Fri, 24 Mar 2023 07:57:06 +0000

Path traversal is a type of security vulnerability that can occur when a web application or service allows an attacker to access server files or directories that are outside the intended directory structure.

This can lead to the unauthorized reading or modification of sensitive data.

In the context of file uploads, a path traversal vulnerability can occur when an application fails to properly validate the file path specified by the user, which can allow the attacker to upload a malicious file with a filename that gives them access to restricted files on the server.

How to create SBOMs in Java with Maven and Gradle

Fri, 17 Mar 2023 09:08:28 +0000

When building applications in Java, we highly depend on external libraries and frameworks. And each Java package that is imported likely also depends on more libraries. This means that the amount of Java packages included in your application is often not really transparent.

As a developer, these nested (transitive) dependencies create the problem that you probably do not know all the libraries you are actually using.

Recently, we discussed why and how we should maintain our dependencies carefully. In the article Best practices for managing Java dependencies, I discussed the options and tools available for setting up a dependency management strategy.

Unsafe Deserialization Vulnerability in SnakeYaml

Thu, 12 Jan 2023 13:19:29 +0000

SnakeYaml is a well-known YAML 1.1 parser and emitter for Java.

Recently, a vulnerability — CVE-2022-1471 — was reported for this package. This vulnerability can lead to arbitrary code execution.

The org.yaml:snakeyaml package is widely used in the Java ecosystem, in part because it is packaged by default with Spring Boot in the spring-boot-starter.

In this article, we look into the security vulnerability affecting this Java library, discuss the potential hazardous impact it may have on your applications, and weigh the actual risks.

Foojay Podcast #7: Security in Java -- what do we need to know?

Mon, 21 Nov 2022 10:22:14 +0000

For this Foojay Podcast**,** we invited security experts to dive into the fascinating world of secure coding and detecting vulnerabilities in your Java applications.

How can you make and keep your systems safe?

That’s what we want to find out…

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

CVE-2022-42889: Apache Commons Text (Text4Shell) Vulnerability

Thu, 03 Nov 2022 14:56:24 +0000

First things first, let’s be clear that this is NOT a new Log4Shell or Spring4Shell vulnerability.

Although it is a remote code execution issue, the impact is neither as severe nor as easily exploitable as the issue in Log4j from December 2021.

Similar to the Log4j issue, the essence of the problem is that you can perform a lookup that can then be misused.

However, the Log4shell vulnerability was very easy to exploit — which is not necessarily the case this time.

How to Use Java DTOs to Stay Secure

Fri, 21 Oct 2022 07:29:57 +0000

~~This article was orignally posted on Snyk.io and is reused with permission.~~

Data Transfer Objects (DTOs) in Java are objects that transport data between subsystems.

It is an enterprise design pattern to aggregate data.

The main purpose is to reduce the number of system calls needed between the subsystems, reducing the amount of overhead created.

In this article, I will explain how DTOs are used in modern Java applications, ways your application can benefit, and how Java DTOs can help you be more secure by preventing accidental data leaks.

Best Practices for Managing Java Dependencies

Thu, 15 Sep 2022 08:21:10 +0000

Creating Java applications is great, and many resources are available.

To speed up development, many folks use frameworks and libraries that do some of the heavy lifting.

When looking at modern Java applications, almost all of them contain dependencies from libraries developed by someone else.

Dependencies take up about 80 to 90 percent of the binary — so, we should take good care of them when creating a Java project.

Controlling your Server with a Reverse Shell Attack

Thu, 08 Sep 2022 13:00:22 +0000

Creating and running an application in your favorite language is usually pretty simple. After you create your application, deploying it and showing it to the world is also quite straightforward.

The last thing you need is someone to take over your system and fully control your brand new application.

In this article, I’ll explain how this can happen with a remote shell attack.

Note: The code examples in this article are for educational purposes only. I mainly try to explain what a remote shell attack is and how it can occur in your applications. Using this or any other example to hack someone is not advised. In most countries, hacking without the consent of the target is illegal, even if you have the best intentions.

Exploring the Apache Commons Configuration RCE Vulnerability

Thu, 18 Aug 2022 10:10:37 +0000

This article was originally posted on Snyk.io and is co-written by Kyle Suero and Brian Vermeer

Before we dive into the details of this vulnerability, we want to make it clear that there’s no need for panic.

Many systems permit the use of various types of code in configuration files, and there are legitimate use cases to include string and variable interpolation in the configuration of applications and systems.

This is not Log4Shell all over again.

Secure CI/CD Pipelines with GitHub Actions for Your Java Apps

Thu, 11 Aug 2022 06:28:38 +0000

This article was originally post atSnyk.io and is used with permission

GitHub Actions has made it easier than ever to build a secure continuous integration and continuous delivery (CI/CD) pipeline for your GitHub projects.

By integrating your CI/CD pipeline and GitHub repository, GitHub Actions allows you to automate your build, test, and deployment pipeline.

You can create workflows that build and test every pull request to your repository or deploy merged pull requests to production.

Deserialization exploits in Java: why should I Care?

Thu, 14 Jul 2022 07:39:03 +0000

Hackers refer to deserialization in Java as “the gift that keeps on giving”. But what is actually the problem? In most cases, it is not even your own code that creates this security vulnerability. This problem is also not restricted to Java’s custom serialization framework. When deserializing JSON, XML, or YAML, similar issues can occur as well.

I recently gave a talk about this during Devoxx UK, the largest and most prestigious Java community conference in the United Kingdom. In this talk, I explain how deserialization vulnerabilities work natively in Java and how attack chains are created. This was loosely based on my blog post: “Serialization and deserialization in Java: explaining the Java deserialize vulnerability”.

How to do password hashing in Java applications the right way

Thu, 12 May 2022 15:04:55 +0000

There are multiple ways to store sensitive passwords. And while having choices can be great, in the context of password storage, picking wrong can be a security nightmare. With that in mind, let’s hash out some of your options 🥁🥁.In this article we’ll discuss how you should hash passwords in your Java applications. While you can apply these principles to any ecosystem, we’ll specifically showcase the best way to handle password hashing in Java.

Spring4Shell: The zero-day RCE in the Spring Framework explained

Fri, 08 Apr 2022 04:17:45 +0000

On March 30, 2022, a critical remote code execution (RCE) vulnerability was found in the Spring Framework. More specifically, it is part of the spring-beans package, a transitive dependency in both spring-webmvc and spring-webflux. This vulnerability is another example of why securing the software supply chain is important to open source.

Security resources like Lunasec, Rapid7 and Praetorian confirmed that the vulnerability is real, and in the meantime, Spring has already released a new version that mitigates this problem, so we recommend updating. While Spring4Shell does not appear to have the same impact as the recent Log4Shell vulnerability, it should still be evaluated and prioritized by every organization using the Spring Framework. In this post, we’ll explore how the RCE works.

Security Warning: Your Java Attack Surface Just Got Bigger

Thu, 17 Mar 2022 16:35:38 +0000

Building cloud-native Java applications is undoubtedly awesome.

However, it comes with undeniable new risks. Next to your own code, you are relying on so many other things.

Blindly depending on open-source libraries and Docker images can form a massive risk for your application. The wrong package can introduce severe vulnerabilities into your application, exposing your application and your user’s data.

In the talk below we’ll show common threats, vulnerabilities, and misconfiguration including the recently disclosed issues in Log4j. Most importantly, you’ll learn how to protect your application with actionable remediation and best practices.

Java Logging: What To Log & What Not To Log?

Sat, 18 Dec 2021 11:29:33 +0000

Logs are a handy tool to spot mistakes and debug code. For engineers and, specifically, in a DevOps environment, the logs are a very valuable tool.

In addition to the functional aspect of logging, logs are also critical from a Java security perspective. When a security breach occurs, your log files are the first place to look for clues about what happened. But with a large number of different frameworks available for logging in Java applications, how do you pick the right one? More importantly, how to do Java logging right?