Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478)
The Thymeleaf vulnerability with a CVSS score of 9.1 grabs your attention, as it should. But before you call the cavalry and claim this as …
Brian Vermeer
54 articles
How Chat Memory Manipulation Can Ruin Your AI System
Did you know that by tampering with chat history, you're able to make LLMs respond and execute functions that are out of policy?
Ensuring Safe and Reliable AI Interactions with LLM Guardrails
We know that LLMs can and will make mistakes, and while enriching your prompts with the proper context can help align results with your …
Foojay Podcast #72: JCon Report, Part 1 - Grow your career, public speaking, 30 years of Java, greener coding,...
On May 13th and 14th, Foojay attended the JCON conference in Köln, Germany, where we did over 30 live-stream interviews. In this episode, we …
What is RAG, and How to Secure It
The implementation of RAG introduces security considerations. Risks such as prompt injection, data poisoning, access control gaps, and data …
Path Traversal Vulnerability in Deep Java Library (DJL)
This vulnerability highlights the importance of addressing supply chain security. If you aren't already, consider scanning your applications …
Creating SBOMs with the Snyk CLI
The software bill of materials (SBOM) is quickly becoming an essential aspect of open source security and compliance. In this post, we'll …
Foojay Podcast #58: How Java Developers Can Secure Their Code
Three years after Log4Shell caused a significant security issue, we still struggle with insecure dependencies and injection problems...
The Persistent Threat: Why Major Vulnerabilities Like Log4Shell and Spring4Shell Remain Significant
A lurking issue has been surprisingly overlooked: the continued use of vulnerable Log4j and Spring Framework versions in many projects.
Four Easy Ways to Analyze your Java and Kotlin Code for Security Problems
Nowadays, the security of your applications is just as important as the functionality they provide. Therefore, analyzing your code for …
Securing Symmetric Encryption Algorithms in Java
Encryption is converting readable data or plaintext into unreadable data or ciphertext, ensuring that even if encrypted data is intercepted, …
Handling security vulnerabilities in Spring Boot
Keeping your dependencies in check is crucial to ensure that your Spring Boot projects run smoothly and remain resilient in the face of …
Using JLink to create smaller Docker images for Spring Boot apps
An in-depth exploration of utilizing JLink to optimize Docker image sizes, enhancing application security and performance.
SnakeYaml 2.0: Solving the unsafe deserialization vulnerability
In December of last year, we reported CVE-2022-1471 to you. This unsafe deserialization problem could easily lead to arbitrary code …
Preventing Cross-Site Scripting (XSS) in Java with Snyk Code
By taking a proactive approach to XSS prevention and using the right resources and tools, developers can help ensure the security and …
Mitigating Path Traversal Vulnerabilities in Java
Path traversal vulnerabilities are a serious threat to Java web applications, amongst the top security issues Snyk finds in Java code.
How to create SBOMs in Java with Maven and Gradle
Java is a compiled language, so you should create an SBOM whenever you build a release version of your application. Find out more here!
Unsafe Deserialization Vulnerability in SnakeYaml
org.yaml:snakeyaml package is widely used in the Java ecosystem, in part because it is packaged by default in the spring-boot-starter.
Foojay Podcast #7: Security in Java -- what do we need to know?
We invited Java security experts to dive into the fascinating world of secure coding and detecting vulnerabilities in your Java …
CVE-2022-42889: Apache Commons Text (Text4Shell) Vulnerability
Resolve this issue by upgrading to commons-text version 1.10 (or later), which disables the prefixes URL, DNS, and script by default.
How to Use Java DTOs to Stay Secure
How DTOs are used in modern Java, how your apps can benefit, and how Java DTOs can help you be more secure.
Best Practices for Managing Java Dependencies
Knowing how to select, update, and remove Java dependencies from our application is essential for security.
Controlling your Server with a Reverse Shell Attack
The last thing you need for your happily deployed application is someone to take over your system and fully control it!
Exploring the Apache Commons Configuration RCE Vulnerability
Before we dive into the details of this vulnerability, we want to make it clear that there’s no need for panic!
Secure CI/CD Pipelines with GitHub Actions for Your Java Apps
Learn how to integrate Snyk into your GitHub CI/CD to automate security scanning as part of your build cycle prior to production.
Deserialization exploits in Java: why should I Care?
Deserialization vulnerabilities work natively in Java, how attack chains are created, not restricted to Java's custom serialization …
How to do password hashing in Java applications the right way
The first rule of password hashing algorithms is: Don't write your own password hashing algorithm! Let's learn how we do password hashing.
Spring4Shell: The zero-day RCE in the Spring Framework explained
We’ll explore how remote code execution (RCE) works, explaining Spring4Shell, a zero-day vulnerability in the Spring framework that could …
Security Warning: Your Java Attack Surface Just Got Bigger
Learn about common threats, vulnerabilities, and misconfiguration including the recently disclosed issues in Log4j.
Java Logging: What To Log & What Not To Log?
A pragmatic guide to Java logging—what should we log, what shouldn’t we log, and how to implement Java logging properly.
Log4Shell: Critical Log4j RCE Vulnerabilty -- Update to Version 2.15.0
On Dec.10, 2021, a new, critical Log4j vulnerability was disclosed: Log4Shell. All current versions of log4j2 up to 2.14.1 are vulnerable.
New Java 17 Features for Improved Security and Serialization
The Java 17 LTS release brings you significant improvements to prevent malicious deserialization in your java applications.
How Social Trends Help Me Fix Essential Vulnerabilities
Our research team found a correlation between socially trending vulnerabilities and the existence of exploits that can harm your …
Discussion: The State of Java 2021
A discussion with some great folks in the Java world about the highlights of the Snyk Java Ecosystem report and current developments in …
Why You Should Upgrade to Maven Version 3.8.1 Today or Very Soon
If you are still running on an old Maven version like 3.6.3 or below, you need to upgrade to version 3.8.1 because of security reasons.
Getting Started with Snyk for Secure Java Development
Learn how to begin with Snyk for secure Java development so that you too can be more secure from the get-go!
New JVM Ecosystem Report 2021 Has Arrived!
JVM Ecosystem Report 2021 presents the results of the largest annual survey on the state of the JVM ecosystem.
Learn All About Java Encryption and Hashing
What is a strong encryption algorithm today, might be a weak algorithm a year from now. Therefore, encryption needs to be reviewed …
Sanitize All Input! Sanitize All Input! Sanitize All Input!
Cross-site scripting (XSS) is a well-known issue and mostly utilized in JavaScript applications. However, Java is not immune to this!
Preventing YAML Parsing Vulnerabilities in Java
With anchors, you can create a YAML bomb! The tremendous amount of (nested) objects will cause a memory overload.
Fix Java Security Issues While Coding in IntelliJ IDEA
Let’s see how we can integrate security and secure development into IntelliJ IDEA using the new Snyk vulnerability scanner plugin!
8 Best Practices to Prevent SQL Injection Attacks
SQL injection, when a user adds untrusted data to a database query, is one of the most dangerous vulnerabilities for online applications.
Participate in the Java Ecosystem Survey 2021
Just like last year, and together with our partner Azul, we would like your input on how you use Java and the JVM ecosystem.
Secure Code Review Best Practices (Part 2)
Code reviews are hard to do well. Particularly when you’re not entirely sure about the errors you should be looking for!
Secure Code Review Best Practices (Part 1)
Code reviews are hard to do well. Particularly when you’re not entirely sure about the errors you should be looking for!
Explaining Java Deserialization Vulnerabilities (Part 2)
In this part, we continue with even more harmful attacks and show you how you can prevent this in your own code.
Explaining Java Deserialization Vulnerabilities (Part 1)
Java serialization—and specifically deserialization—is “the gift that keeps on giving” for the security issues produced over the years.
Hacking Java XML Input via External Entity Injection
In this video, I explain and demonstrate how an XXE injection attack works by extracting system data that should not be exposed.
5 Tips to Create Secure Docker Images for Java Applications
Naively creating custom Docker images for Java apps comes with security concerns. How do we make security an essential part of Docker …
Minimizing Security Risks in Application Development
United by their passion for open source, Payara and IBM recently teamed up for a panel discussion on security in Java application …
Use Query Parameterization to Prevent Injection
Tip: By distinguishing between the SQL code and the parameter data, the query can’t be hijacked by malicious input.
Avoid Java Serialization: The Gift That Keeps On Giving
If you need to Deserialize an inputstream yourself, you should use an ObjectsInputStream with restrictions.
How to Configure Your Java XML Parsers to Prevent XXE Attacks
With XML eXternal Entity (XXE) enabled, it is possible to create a malicious XML, and read the content of an arbitrary file on the machine.
Fixing Vulnerabilities in Maven-Based Projects
In this article, I will explain how you can fix vulnerabilities in third-party libraries when using Maven, even when it is not obvious.