Jesse Yang

An issue exists where a truncated HTTP/2 Content-Length value can be used to exhaust the worker pool of an HTTP/1.1 origin.

An authentication bypass issue exists in Apache Shiro. The issue relates to bypassing authentication when accessing static files on case-insensitive filesystems by varying the case of the filename in the request, if only lower-case filters are present in Shiro. The issue only affects static files.

The issue is related to the improper implementation of the PBES2 algorithm in the jose4j component when handling the `p2c` parameter. This can allow a remote attacker to cause a denial of service due to CPU consumption via a large `p2c` (aka PBES2 Count) value.