To report a Security issue, you can :

• (Preferred way ⭐) create a new Github Security Advisories, using this form,
• open a gitlab issue,
• send an email to security@eclipse-foundation.org.

For more details, please look at :

• https://www.eclipse.org/security/
• https://www.eclipse.org/projects/handbook/#vulnerability

Only Leshan library is concerned. The demos are not covered.

Note: ℹ️ 1.x version depends on californium 2.x version where support is not clear.
See : https://github.com/eclipse/californium/security/policy

List of version which are not affected by known vulnerability.

This is an exhaustive list of known security issue affecting leshan library :

This is a not exhaustive list of security issue from Leshan dependencies which could affect Leshan :

Note: We strongly encourage you to switch last safe Leshan version, but for vulnerability caused by a dependency :

• if there isn't Leshan release available OR if you want to be very conservative
• AND the concerned library is using semantic versioning

then you could try to just update the dependency to a safe compatible version without upgrading Leshan.

This is a not exhaustive list of JVM security issue which could affect common Leshan usages.