The Lightwell initiative has found 400 new vulnerabilities in Java libraries and opened a service for customers to submit code for review.
Key points
- IBM and Red Hat identified more than 400 previously unknown vulnerabilities in widely used Java libraries.
- The companies launched Lightwell Clearinghouse to allow customers to submit dependencies for automated review.
- The project aims to backport fixes into production applications to maintain uptime while addressing security issues.
IBM and Red Hat have identified more than 400 previously undiscovered vulnerabilities in common Java libraries through their open-source security initiative, Lightwell. The companies are now inviting customers to submit their code dependencies to a new service called Lightwell Clearinghouse for review.
What happened
IBM and Red Hat announced the discovery of more than 400 novel vulnerabilities in widely used Java libraries, according to reports from InfoWorld and CSO Online. These flaws were found through Lightwell, an open-source security initiative established by the two companies. The initiative combines open-source engineering expertise with AI-assisted workflows.
In May, IBM and Red Hat stated they would commit 20,000 engineers and $5 billion to the Lightwell project. The companies are now offering Lightwell Clearinghouse, a service where customers can submit their own code dependencies for review. This service looks for specific bugs, such as a critical sandbox bypass in the Java template engine Thymeleaf.
The Thymeleaf vulnerability was discovered in April and carries a CVSS score of 9.1. Gunnar Hellekson, vice president and general manager of Lightwell, noted that AI agents have shifted the threat landscape by exploiting old dependencies at machine speed. He emphasized that finding bugs is only half the battle.
Why it matters
The rapid discovery of these vulnerabilities highlights the speed at which attackers can exploit known weaknesses. Hellekson stated that the real work involves backporting fixes directly into active production applications. This approach allows customers to address security issues without sacrificing uptime or stability.
The goal of the Lightwell project is not just to identify security issues but to neutralize them effectively. By using AI-assisted engineering and Red Hat’s community relationships, the initiative aims to streamline the remediation process. This is critical for organizations relying on open-source components that may contain hidden risks.
The fix
- Submit code dependencies to the Lightwell Clearinghouse for automated review.
- Look for backported fixes that integrate directly into production applications.
- Monitor for updates regarding specific vulnerabilities like the Thymeleaf sandbox bypass.
What to do and how to stay safe: IBM
- Audit your Java library dependencies to identify any known high-severity vulnerabilities.
- Monitor official vendor announcements for patches or backported fixes for critical flaws.
- Review your application’s security posture to ensure sandbox environments are properly configured.
- Subscribe to security bulletins from major open-source maintainers for early warnings.
Step-by-step guide: Patch Testing: How to Verify Fixes Without Breaking Your Systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is Lightwell Clearinghouse?
Lightwell Clearinghouse is a new service from IBM and Red Hat that allows customers to submit their code dependencies for review against known vulnerabilities.
How many vulnerabilities were found?
The Lightwell project identified more than 400 previously undiscovered vulnerabilities in widely used Java libraries.
Is there a fix for the Thymeleaf vulnerability?
The source material mentions the discovery of the Thymeleaf vulnerability with a CVSS score of 9.1 but does not confirm a specific public patch has been released yet.
