Markus Magnuson

An issue exists where the system does not fail securely, known as failing open. This allows an unauthorized attacker to bypass a security feature, specifically Extended Protection, over a network.

An issue exists when coalescing adjacent text nodes in `addText` and `fosterParent` functions. Appending to an existing TextNode's `Data` via string concatenation causes the accumulated string to be reallocated and copied on every token. This leads to O(n^2) allocations and byte copies when processing inputs containing numerous short text runs separated by ignored end tags.

A flaw exists where hostname verification is ignored when configured through the `verifyHostName` attribute of the '<Ssl>' element. This occurs even if the attribute is explicitly set, leaving TLS connections susceptible to interception. A network-based attacker could perform a man-in-the-middle attack if an SMTP, Socket, or Syslog appender is used, TLS is configured via a nested '<Ssl>' element, and the attacker possesses a certificate issued by a CA trusted by the configured or default Java trust store.