maven package report

Is security-framework safe?

1 known vulnerability.

cvss

not scored

how bad it is if exploited, out of 10

epss

0.70%

chance of exploitation in the next 30 days

xyz score

not scored

CyberXYZ composite, out of 10

fig. 01 — GHSA-jqqr-c2r2-9cvr, the advisory selected below

// advisories

GHSA-jqqr-c2r2-9cvr

UNKNOWNCVE-2017-18588

If custom root certificates were registered with a ClientBuilder, the hostname of the target server would not be validated against its presented leaf certificate. This issue was fixed by properly configuring the trust evaluation logic to perform that check.

Affected: >=0.0.0-0, <0.1.12
Fixed in: 0.1.12
Published: 2021-08-25
Source: github

GHSA NVD MITRE

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.

Checked 2026-09-22 at 01:39 UTC. The most recent advisory here was published 2021-08-25. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is security-framework safe? maven package security report | CyberXYZ