To report a Security issue, you can :

• (Preferred way ⭐) create a new Github Security Advisories, using this form,
• open a gitlab issue,
• send an email to security@eclipse-foundation.org.

For more details, please look at :

• https://www.eclipse.org/security/
• https://www.eclipse.org/projects/handbook/#vulnerability

Only Leshan library is concerned. The demos are not covered.

Note: ℹ️ 1.x version depends on californium 2.x version where support is not clear.
See : https://github.com/eclipse/californium/security/policy

As said previously Leshan demos are not covered by Security Policy.

It is strongly discouraged to use Leshan demos v1.x on public server because they are using no longer maintained javascript/java library like :

• bootstrap.js (pkg:javascript/bootstrap@3.4.1) : Bootstrap before 4.0.0 is end-of-life and no longer maintained.
• jquery-2.2.4.js (pkg:javascript/jquery@2.2.4) : CVE-2015-9251, CVE-2019-11358, CVE-2020-11022, CVE-2020-11023, jQuery 1.x and 2.x are End-of-Life and no longer receiving security updates
• Jetty 9.x : Jetty 9.4 reach End-of-Life and no longer receiving security updates at January 2025.

Concerning Leshan demos v2.x, some minimal efforts are made to update dependencies when vulnerabilities are detected but keep in mind that demos are not production ready tools.

List of version which are not affected by known vulnerability.

This is an exhaustive list of known security issue affecting leshan library :

This is a not exhaustive list of security issue from Leshan dependencies which could affect Leshan :

Note: We strongly encourage you to switch last safe Leshan version, but for vulnerability caused by a dependency :

• if there isn't Leshan release available OR if you want to be very conservative
• AND the concerned library is using semantic versioning

then you could try to just update the dependency to a safe compatible version without upgrading Leshan.

This is a not exhaustive list of JVM security issue which could affect common Leshan usages.