Activity for Yet Another Java Service Wrapper
-
A Yarborough created ticket #40
Netty & Commons-Configuration2 Vulnerabilities
-
rzo posted a comment on ticket #218
thanks for the feedback. note that this does not affect yajsw. the CVE refers to the spdy codec, which is implemented in the netty-codec-http lib, which is not included in the yajsw download. i will keep this issue open and upgrade netty with the next yajsw release. -- Ron
-
REVATHI V created ticket #218
Upgrade netty to 4.2.18 or later
-
Upgrade netty to 4.2.18 or later to fix CVE-2026-56818, CVE-2026-76816, CVE-2026-75595
-
Hi, the stated CVE do not apply for 4.2.17: https://feedly.com/cve/CVE-2026-75595 https://feedly.com/cve/CVE-2026-76816 https://feedly.com/cve/CVE-2026-56818 The have been patched with 4.2.16 and 4.2.17 which is included in the current stable release 14.01. Pls feel free to correct me, if you have other references. -- Ron
-
Upgrade netty to 4.2.18 or later to fix CVE-2026-56818, CVE-2026-76816, CVE-2026-75595
-
Java ServiceLoader.load() doesn't find any implementations
-
fixed in release 14.01 pls test and let me know if this resolves your issue. -- Ron
-
Yajsw Netty Upgrade to Address CVE-2026-44891
-
release 14.01
-
note: netty is split into multiple libs. yajsw only includes a handfull. these are not affected by the the stated issues. nevertheless release 14.01 has update to netty 4.2.17 -- Ron
-
Yajsw commons-configuration2 Upgrade to Address CVE-2026-45205
-
release 14.01
-
yajsw-stable-14.01 released
-
Yet Another Java Service Wrapper released /yajsw/yajsw-stable-14.01/readme.txt
-
-
yajsw-stable-14.01
-
Niralee Patel posted a comment on ticket #216
Note: Similar in nature to #215 (Netty CVE-2026-44891), which was accepted and fixed within 2 days of reporting. Also raised in the Open Discussion forum on 2026-08-19 with no response
-
Following up on my earlier post about CVE-2026-45205 in commons-configuration2 (bundled by both YAJSW 13.18 and 14.00 — Even latest 14.00 doesn't fix it, since it still ships the vulnerable 2.14.0). Any update on this? I have created a ticket for this https://sourceforge.net/p/yajsw/bugs/216/
-
Yajsw commons-configuration2 Upgrade to Address CVE-2026-45205
-
Following up on my earlier post about CVE-2026-45205 in commons-configuration2 (bundled by both YAJSW 13.18 and 14.00 — Even latest 14.00 doesn't fix it, since it still ships the vulnerable 2.14.0). Any update on this?
-
Hi, We are currently using YAJSW 13.18, which bundles commons-configuration2 version 2.10.1. We noticed that YAJSW 14.00 upgrades this dependency to commons-configuration2 2.14.0. However, Apache Commons Configuration 2.14.0 is affected by CVE-2026-45205, which is fixed in 2.15.0+. Could you please clarify: Is there a planned YAJSW release that upgrades commons-configuration2 to 2.15.x or later? Is there a specific reason YAJSW 14.00 currently uses 2.14.0? Is it safe/supported to replace the bundled...
-
hello, release 13.18 will not be updated. Pls contact paid support if you need an update for this release. next release will be 14.01, which will resolve this issue. i hope to publish it within apprx a week's time. -- Ron
-
Yajsw Netty Upgrade to Address CVE-2026-44891
-
thanks for reporting.
-
Saikeerthan posted a comment on discussion Help
We are facing same security vulnerability for our product that is using YAJSW 14.0 version. Would appreciate a positive response from the Team!
-
Vikash Kumar posted a comment on discussion Help
We are using YAJSW 13.18 in our project and security team has identified 8 CVEs ( CVE-2026-42579 (BDSA-2026-9433), CVE-2026-42581 (BDSA-2026-9428), CVE-2026-42584 (BDSA-2026-9440), CVE-2026-33870 (BDSA-2026-5656), CVE-2026-42577 (BDSA-2026-9446), CVE-2026-42578 (BDSA-2026-9442), CVE-2026-42587 (BDSA-2026-9427), CVE-2026-44248 (BDSA-2026-10451))for netty library present inside yajsw-stable-13.18\lib\core\netty. Also, I have checked for latest YAJSW version 14.00, the netty library is in its new version...
-
Yajsw Netty Upgrade to Address CVE-2026-44891
-
Java ServiceLoader.load() doesn't find any implementations
-
thanks for taking the time to debug this.
-
Christoph Seibert posted a comment on ticket #204
We've just encountered this issue with the ServiceLoader not finding any implementations on the application class path, and tracked it down to the following: The WrapperClassLoader does not override the findResource method (only the findClass method). Therefore, it does not delegate the call to the _parent class loader. This means that no META-INF/services/… files can be found on the application class path by the ServiceLoader. Note that the classes pointed to by the META-INF files would be found...
-
released 14.00. tested with JDK25. pls report if you7 find any issues.
-
yajsw-stable-14.00 released
-
-
-
release 14.00
-
update core libs. support jdk 24+. reduce misc logging.
-
Rich DiCroce posted a comment on discussion Open Discussion
@rzorzorzo Is there any progress towards getting Groovy to work on Java 25? I have some applications I'd like to upgrade, but they need the Groovy scripting to work.
-
Juan Marques posted a comment on discussion Open Discussion
I will keep you posted , I will be testing early next week , but honestly not expecting issues.
-
not yet. but i think it should work if you rename the path to groovy in the classpath. if you are having issues, pls let me know. -- Ron
-
Hello @rzorzorzo , Have you tried running with java 25 already?
-
tyoma53 posted a comment on discussion Open Discussion
hello, i can confirm that yajsw 13.18 works fine with OpenJDK 21 from Eclipse on CentOS 9. we're using it with ActiveMQ, and have no problems with it. only issues i see in log messages are below: Unable to classify GarbageCollectorMXBean [ZGC Minor Cycles] Unable to classify GarbageCollectorMXBean [ZGC Minor Pauses] Unable to classify GarbageCollectorMXBean [ZGC Major Cycles] Unable to classify GarbageCollectorMXBean [ZGC Major Pauses] GC configuration is -XX:+UseZGC -XX:+ZGenerational thank you...
-
thanks.
-
yajsw-stable-13.18 released
-
Lutz Bergmann posted a comment on discussion Open Discussion
On the news page https://sourceforge.net/p/yajsw/news/ the Entry for version 13.18 is mislabeled as version 17.17 (I assume). Could you please fix that?
-
xiyz created ticket #63
Unable to classify GarbageCollectorMXBean [G1 Concurrent GC]
-
Rares posted a comment on ticket #34
Thanks to your indication to use runConsole.bat, I was able to get to the root of it: an removed java command line option (-Xnoagent) was crashing the jvm startup. However, this unrooted a bug: the Java startup error was displayed and written to service.log with runConsole.bat, but it is not displayed or written to service.log using service mode. service mode: WARNING|wrapper|Service Test Project|25-10-17 18:23:44|YAJSW: yajsw-stable-13.18 WARNING|wrapper|Service Test Project|25-10-17 18:23:44|OS...
-
Q: 1. are you sure your app can run with the OS and JDK 25 without the wrapper ? 2. before running as service, did you try runConsole.bat ? pls run using runConsole and with pipestreams and wrapper.debug and post the output of the windows console.
-
Hello, I appreciate your answer. 1. The solution described in https://sourceforge.net/p/yajsw/discussion/810310/thread/d90b30628c/#919a is not sufficient. I got past the groovy problem by renaming the groovy folders and disabled the script, but the wrapped process stopped as soon as it started: WARNING|wrapper|Service Test Project|25-10-16 10:54:37|YAJSW: yajsw-stable-13.18 WARNING|wrapper|Service Test Project|25-10-16 10:54:37|OS : Windows Server 2022/10.0/amd64 WARNING|wrapper|Service Test Project|25-10-16...
-
pls check this out: https://sourceforge.net/p/yajsw/discussion/810310/thread/d90b30628c/#919a for the roadmap pls check the readme.txt.
-
yes, jdk 21 is supported. if you have issues and need help pls provide more details: OS, jdk, conf file, log output.
-
Eason Li posted a comment on discussion Open Discussion
Does the latest version 13.18 support the Java 21? I try it, maybe it not works...
-
Crashes on JDK 25
-
Thank you. My app started normally, and the issue was fixed in release 13.18
-
Could not start the app when upgrading from 13.15 to 13.17
-
release 13.18
-
yajsw-stable-13.17 released
-
-
-
release 13.18
-
Hi, I can reproduce it. These logs are closer to the complete logs and my config my config: # WARNING - Do not modify any of the properties when an application # using this configuration file has been installed as a service or daemon. # Please uninstall the service before modifying this file. The # service must then be reinstalled. #******************************************************************** # Java Executable Properties #********************************************************************...
-
These logs are closer to the complete logs and my config my config: # WARNING - Do not modify any of the properties when an application # using this configuration file has been installed as a service or daemon. # Please uninstall the service before modifying this file. The # service must then be reinstalled. #******************************************************************** # Java Executable Properties #******************************************************************** # Java Application wrapper.java.command=java...
-
These logs are closer to the complete logs and my config my config: WARNING - Do not modify any of the properties when an application using this configuration file has been installed as a service or daemon. Please uninstall the service before modifying this file. The service must then be reinstalled. ********** Java Executable Properties ********** Java Application wrapper.java.command=java ********** @home@ ********** wrapper.working.dir=${myapp_home} Java Main class. YAJSW: default is "org.rzo.yajsw.app.WrapperJVMMain"...
-
Overall, after upgrading to 13.17, the application fails to start.
-
Yes, I saw it too
-
yes
-
OS: ubuntu 20.04 sorry I can't reproduce it no longer
-
ps: however, while testing, i see there is an issue on posix systems: java.lang.NoClassDefFoundError: io/netty/util/internal/logging/InternalLoggerFactory this requires a new release.
-
ps: the exception is only logged in case wrapper.debug is set to true
-
hello, works for me. i am not getting this error. OS ? checking the code: this is just a warning. your application should be starting just fine. if this is not the case: pls provide the full log. and config. remember to remove private data such as passwords from these files before posting. -- Ron
-
Could not start the app when upgrading from 13.15 to 13.17
-
thanks for pointing this out. something went wrong during the packing of the zip file. release 13.17
-
Netty* v4.1.118 vulnerability
-
release 13.17
-
yajsw-stable-13.17 released
-
-
-
13.17 regression test
-
release 13.17
-
release 13.17
-
Hi rzo - Thank you for patching for v13.x. I unzipped release v13.16 but these two libs are not patched still: inflating: yajsw-stable-13.16/lib/core/commons/commons-lang-2.6.jar inflating: yajsw-stable-13.16/lib/core/commons/commons-lang3-3.12.0.jar Thank you agian.
-
https://nvd.nist.gov/vuln/detail/CVE-2025-55163 https://nvd.nist.gov/vuln/detail/CVE-2025-58056 https://nvd.nist.gov/vuln/detail/CVE-2025-58057
-
Netty* v4.1.118 vulnerability
-
netty-common-4.1.114.Final vulnerability
-
commons-vfs2-2.9.0.jar Vulnerabilities
-
YAJSW v13.x: commons-lang3 & commons-lang vulnerability
-
release 13.16
-
yajsw-stable-13.16 released
-
-
-
-
-
-
-
-
-
-
-
-
