Oct
20
2026
By dev on
mendelson AS4

New help system, jetty update

  • Fixed OS Command Injection possibilities via inbound Message id, conversion id and log text. The problem was a setup with post processing of messages (which is optional) and injected commands in the used variable content.
  • The help system has been reworked, the help is now rendered directly by your browser
  • Most diagrams and images of the help have been recreated and reworked, as scalable vector graphics
  • Dependencies: Updated jetty to 12.0.40 (integrated web server). This fixes CVE-2026-19863, CVE-2026-77711, CVE-2026-76184, CVE-2026-18660, CVE-2026-18661, CVE-2026-19864, CVE-2026-76182, CVE-2026-18659, CVE-2026-18662
  • The keyagreement algorithm for X25519 used an incorrect URI ("http://w3.org/2021/04/xmldsig-more#x25519") but according to RFC 9231, Section 2.7.1, the correct URI should be "http://www.w3.org/2021/04/xmldsig-more#x25519"
  • Its now possible to define multiple users for the REST API (optional plugin) - means you could set up a user for each application that communicates with the mendelson software via REST