Athena's second wave

* Twelve silent vulnerabilities were disclosed in the second batch, affecting Java libraries: Apache Kerby, MockServer, WireMock, Javassist, SAAJ, jjwt, java-jwt, libphonenumber, and Apache Qpid Broker-J.
* Two critical vulnerabilities involved authentication bypasses in Apache Kerby and XXE/SSRF flaws in MockServer.
* Fixes were sometimes implemented via deletions rather than repairs, such as in Javassist and Apache Qpid Broker-J.
* Some fixes landed in versions or artifacts that do not affect current dependency coordinates, leaving vulnerabilities exposed in the code.
* Apache Kerby contained a critical authentication bypass affecting versions before 2.1.0, fixed in Kerby 2.1.0 by deleting faulty conditions.
* MockServer had a critical XXE and SSRF flaw in versions 5.5.4 and later related to XML schema validation.
* Javassist contained an embedded HTTP server with arbitrary file read capabilities.
* Apache Qpid Broker-J had file-based authentication providers that leaked credentials via timing side channels, fixed by deletion in version 10.0.0.
* WireMock's legacy standalone coordinate remains vulnerable due to a path traversal vulnerability; the fix is in 3.x and newer artifacts.
* SAAJ left its StAX parser vulnerable to XXE attacks via the lazy StAX parser, fixed in 3.0.0.
* jjwt fixes for signature bypass and denial of service were included in version 0.12.0 of split-module coordinates, while the original artifact remained at 0.9.1.

The disclosure process itself reveals a tension between the ideal state of security—where fixes are immediately visible and actionable—and the reality of dependency management in complex software ecosystems. The fact that many critical fixes were delivered via code deletions, refactorings, or by moving functionality to coordinate changes rather than direct bug patches highlights a systemic disconnect: maintainers fix the underlying issue but fail to broadcast that change through standard vulnerability tracking mechanisms (CVEs). This creates an information asymmetry where downstream users must actively pursue patch files and repository diffs to discover security reality. The existence of vulnerable test infrastructure, like MockServer and WireMock, underscores the risk of overlooking surface-level dependencies; these testing tools are often accessible in CI environments holding high-value credentials, making them prime targets that bypass traditional application-layer security checks. The pattern suggests that when fixing deep code issues is prioritized internally over public disclosure, the burden of discovery shifts entirely onto the consumer, leveraging established versioning systems as blind spots rather than security guarantees.
Bridge Questions: If maintainers prioritize internal refactoring for fixes, what structural changes in dependency management would force such patches to be automatically surfaced via standard security pipelines? How can the industry shift from relying on application-layer audits of code diffs to relying on verifiable artifact provenance for dependency safety? What responsibility does an ecosystem have when critical fixes occur without corresponding external identifiers?