back to all blogsSee all blog posts

CVE and notable bug fixes in

image of author
David Mueller on May 21, 2024
Post available in languages:

Open Liberty provides some significant bug fixes, including several that address CVEs. If you’re interested in features and functionality that we have in progress, such as Jakarta EE 11, take a look at our recent beta blog posts.

In Open Liberty

Develop and run your apps using

If you’re using Maven, include the following in your pom.xml file:


Or for Gradle, include the following in your build.gradle file:

buildscript {
    repositories {
    dependencies {
        classpath ''
apply plugin: 'liberty'

Or if you’re using container images:


Or take a look at our Downloads page.

If you’re using IntelliJ IDEA, Visual Studio Code or Eclipse IDE, you can also take advantage of our open source Liberty developer tools to enable effective development, testing, debugging and application management all from within your IDE.

Ask a question on Stack Overflow

Security vulnerability (CVE) fixes in this release

CVE CVSS score by X-Force® Vulnerability assessment Versions affected Version fixed Notes



Denial of service -

Affects the servlet-3.1, servlet-4.0, servlet-5.0, and servlet-6.0 features



Denial of service -

Affects the openidConnectClient-1.0 and socialLogin-1.0 features



Denial of service -

Affects the servlet-3.1, servlet-4.0, servlet-5.0, and servlet-6.0 features

For a list of past security vulnerability fixes, reference the Security vulnerability (CVE) list.

Notable bugs fixed in this release

We’ve spent some time fixing bugs. The following sections describe just some of the issues resolved in this release. If you’re interested, here’s the full list of bugs fixed in

  • FeatureUtility custom repository connection issue

    In some scenarios, the FeatureUtility connection test to a custom repo (base url) returns a 400 response code and fails to recognize it as a working repository. It’s not good to fail fast because there are cases where users do not have appropriate access to the whole repository, but they do have access to certain artifacts in the repository. In such cases, the response code can be 400, 403, etc.

  • Incompatibility reported between sipServlet-1.1 and WebSockets

    The following ClassCastException exception occurs with sipServlet-1.1 and a WebSocket feature.

    java.lang.ClassCastException: incompatible with
  • FeatureUtility prints warning when user repositories doesn’t have authentication

    When users specify Maven repositories without authentication, the featureUtility command prints the following warning in verbose mode:

    CWWKF1374E: The password is not encrypted. Password must be encrypted using the securityUtility command with the AES cryptography algorithm as the recommended --encoding option.

Get Open Liberty now