Yu Bao, PayPal Cyber Security Team

flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys

Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO

Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding

netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount

Objenesis before 3.6 Type Confusion via Class Name Instantiator Cache

netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback

json-smart through 2.6.0 Strict-Mode Validation Bypass via 0x1A Character

OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers

Xerial snappy-java 1.1.7.4 before 1.1.10.10 Double Release of Pooled Buffers in SnappyFramedInputStream

OW2 ASM 5.0 before 9.11 Excessive Memory Allocation via BootstrapMethods Attribute