{"grype_matches":[{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.99"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-83qj-6fr2-vhqg","versionConstraint":">=9.0.0.M1,<9.0.99 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-83qj-6fr2-vhqg","fix":{"state":"fixed","versions":["9.0.99"],"available":[{"date":"2025-03-18","kind":"first-observed","version":"9.0.99"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24813","cwe":"CWE-44","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-24813","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-24813","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-24813","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-24813","date":"2026-11-02","epss":0.99942,"percentile":0.99972}],"risk":97.125,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-24813","https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq","http://www.openwall.com/lists/oss-security/2025/03/10/5","https://github.com/apache/tomcat/commit/0a668e0c27f2b7ca0cc7c6eea32253b9b5ecb29c","https://github.com/apache/tomcat/commit/eb61aade8f8daccaecabf07d428b877975622f72","https://github.com/apache/tomcat/commit/f6c01d6577cf9a1e06792be47e623d36acc3b5dc","https://github.com/absholi7ly/POC-CVE-2025-24813/blob/main/README.md","https://www.vicarius.io/vsociety/posts/cve-2025-24813-detect-apache-tomcat-rce","https://www.vicarius.io/vsociety/posts/cve-2025-24813-mitigate-apache-tomcat-rce","https://security.netapp.com/advisory/ntap-20250321-0001","https://lists.debian.org/debian-lts-announce/2025/04/msg00003.html","https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-detect-vulnerability","https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-mitigation-vulnerability","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24813"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-83qj-6fr2-vhqg","description":"Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT","knownExploited":[{"cve":"CVE-2025-24813","cwes":["CWE-44","CWE-502"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-24813"],"notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq","dueDate":"2025-04-22","product":"Tomcat","dateAdded":"2025-04-01","vendorProject":"Apache","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2025-24813","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24813","cwe":"CWE-44","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-24813","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-24813","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-24813","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-24813","date":"2026-11-02","epss":0.99942,"percentile":0.99972}],"urls":["https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq","http://www.openwall.com/lists/oss-security/2025/03/10/5","https://lists.debian.org/debian-lts-announce/2025/04/msg00003.html","https://security.netapp.com/advisory/ntap-20250321-0001/","https://www.vicarius.io/vsociety/posts/cve-2025-24813-detect-apache-tomcat-rce","https://www.vicarius.io/vsociety/posts/cve-2025-24813-mitigate-apache-tomcat-rce","https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-detect-vulnerability","https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-mitigation-vulnerability","https://github.com/absholi7ly/POC-CVE-2025-24813/blob/main/README.md","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24813"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-24813","description":"Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view       security sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to       perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.","knownExploited":[{"cve":"CVE-2025-24813","cwes":["CWE-44","CWE-502"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-24813"],"notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq","dueDate":"2025-04-22","product":"Tomcat","dateAdded":"2025-04-01","vendorProject":"Apache","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"2563628601b616c1","cpes":["cpe:2.3:a:apache:tika-core:2.7.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:tika_core:2.7.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:2.7.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:tika:2.7.0:*:*:*:*:*:*:*"],"name":"tika-core","purl":"pkg:maven/org.apache.tika/tika-core@2.7.0","type":"java-archive","version":"2.7.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tika","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tika-core-2.7.0.jar","manifestName":"","pomArtifactID":"tika-core","archiveDigests":[{"value":"e9e8f1a7dc833e633fb2c717e8fa811e3e9dbf4a","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tika-core-2.7.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tika-core-2.7.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f58c-gq56-vjjf","versionConstraint":">=1.13,<=3.2.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tika:tika-core","version":"2.7.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f58c-gq56-vjjf","fix":{"state":"fixed","versions":["3.2.2"],"available":[{"date":"2025-12-06","kind":"first-observed","version":"3.2.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","metrics":{"baseScore":10},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66516","cwe":"CWE-611","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-66516","date":"2026-11-02","epss":0.88976,"percentile":0.99779}],"risk":84.5272,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-66516","https://cve.org/CVERecord?id=CVE-2025-54988","https://lists.apache.org/thread/s5x3k93nhbkqzztp1olxotoyjpdlps9k"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f58c-gq56-vjjf","description":"Apache Tika has XXE vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-66516","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66516","cwe":"CWE-611","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-66516","date":"2026-11-02","epss":0.88976,"percentile":0.99779}],"urls":["https://cve.org/CVERecord?id=CVE-2025-54988","https://lists.apache.org/thread/s5x3k93nhbkqzztp1olxotoyjpdlps9k"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66516","description":"Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. \n\nThis CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. \n\nFirst, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. \n\nSecond, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the \"org.apache.tika:tika-parsers\" module."}]},{"artifact":{"id":"eb8669d49f23afd5","cpes":["cpe:2.3:a:com.atlassian.bitbucket.server:bitbucket-service-api:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:com.atlassian.bitbucket.server:bitbucket_service_api:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:bitbucket-service-api:bitbucket-service-api:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:bitbucket-service-api:bitbucket_service_api:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:bitbucket_service_api:bitbucket-service-api:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:bitbucket_service_api:bitbucket_service_api:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:com.atlassian.bitbucket.server:bitbucket:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:bitbucket-service:bitbucket-service-api:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:bitbucket-service:bitbucket_service_api:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:bitbucket_service:bitbucket-service-api:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:bitbucket_service:bitbucket_service_api:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:atlassian:bitbucket-service-api:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:atlassian:bitbucket_service_api:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:bitbucket-service-api:bitbucket:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:bitbucket:bitbucket-service-api:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:bitbucket:bitbucket_service_api:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:bitbucket_service_api:bitbucket:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:server:bitbucket-service-api:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:server:bitbucket_service_api:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:bitbucket-service:bitbucket:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:bitbucket_service:bitbucket:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:atlassian:bitbucket:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:bitbucket:bitbucket:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:server:bitbucket:8.18.0:*:*:*:*:*:*:*"],"name":"bitbucket-service-api","purl":"pkg:maven/com.atlassian.bitbucket.server/bitbucket-service-api@8.18.0","type":"java-archive","version":"8.18.0","language":"java","licenses":[],"metadata":{"pomGroupID":"com.atlassian.bitbucket.server","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/bitbucket-service-api-8.18.0.jar","manifestName":"","pomArtifactID":"bitbucket-service-api","archiveDigests":[{"value":"fe50dae05bdea484f072c0b85a15c2f97f092341","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/bitbucket-service-api-8.18.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/bitbucket-service-api-8.18.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.4.26"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-21589","versionConstraint":">= 10.3.0, < 10.5.1||>= 7.17.0, < 9.4.26||>= 9.5.0, < 10.2.8 (maven)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.atlassian.bitbucket.server:bitbucket-service-api","version":"8.18.0"},"language":"java","namespace":"nvd:language:java"}}],"vulnerability":{"id":"CVE-2026-21589","fix":{"state":"fixed","versions":["9.4.26","10.2.8","10.5.1"],"available":[{"date":"2026-10-16","kind":"first-observed","version":"10.5.1"},{"date":"2026-10-16","kind":"first-observed","version":"9.4.26"},{"date":"2026-10-16","kind":"first-observed","version":"10.2.8"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@atlassian.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21589","cwe":"CWE-552","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-21589","date":"2026-11-02","epss":0.99477,"percentile":0.99943}],"risk":83.47500000000001,"urls":["https://jira.atlassian.com/browse/BAM-26567","https://jira.atlassian.com/browse/BSERV-20604","https://jira.atlassian.com/browse/CONFSERVER-104488","https://jira.atlassian.com/browse/CRUC-8741","https://jira.atlassian.com/browse/CWD-6610","https://jira.atlassian.com/browse/FE-7583","https://jira.atlassian.com/browse/JRASERVER-79546","https://jira.atlassian.com/browse/JSDSERVER-16809","https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589"],"severity":"High","namespace":"nvd:language:java","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21589","description":"This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.","knownExploited":[{"cve":"CVE-2026-21589","cwes":["CWE-552"],"urls":["https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com","https://nvd.nist.gov/vuln/detail/CVE-2026-21589"],"notes":"BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-10-18","product":"Multiple Products","dateAdded":"2026-10-15","vendorProject":"Atlassian","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[]},{"artifact":{"id":"2ea0ddce9d769b21","cpes":["cpe:2.3:a:libbrotli1:libbrotli1:1.0.9-2build6:*:*:*:*:*:*:*"],"name":"libbrotli1","purl":"pkg:deb/ubuntu/libbrotli1@1.0.9-2build6?arch=amd64&distro=ubuntu-22.04&upstream=brotli","type":"deb","version":"1.0.9-2build6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libbrotli1/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libbrotli1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbrotli1:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libbrotli1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"brotli"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.9-2ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111497","versionConstraint":"< 1.0.9-2ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"brotli","version":"1.0.9-2build6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-111497","fix":{"state":"fixed","versions":["1.0.9-2ubuntu0.1"],"available":[{"date":"2026-10-26","kind":"advisory","version":"1.0.9-2ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-111497","cwe":"CWE-252","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-111497","cwe":"CWE-787","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-111497","date":"2026-11-02","epss":0.82641,"percentile":0.99667}],"risk":78.75000000000001,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-111497","knownExploited":[{"cve":"CVE-2026-111497","cwes":["CWE-252","CWE-787"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-111497"],"notes":"This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/google/brotli/releases/tag/v1.2.1; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-10","product":"Brotli","dateAdded":"2026-10-27","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2026-111497","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111497","cwe":"CWE-252","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-111497","cwe":"CWE-787","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-111497","date":"2026-11-02","epss":0.82641,"percentile":0.99667}],"urls":["https://github.com/andybalholm/brotli/releases/tag/v1.2.7","https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high","http://www.openwall.com/lists/oss-security/2026/10/23/25","http://www.openwall.com/lists/oss-security/2026/10/24/6","http://www.openwall.com/lists/oss-security/2026/10/26/12","http://www.openwall.com/lists/oss-security/2026/10/26/13","http://www.openwall.com/lists/oss-security/2026/10/26/16","https://broccoli2shell.com","https://github.com/advisories/GHSA-9v8h-qqgm-4m35","https://github.com/dotnet/announcements/issues/494","https://github.com/google/brotli/releases/tag/v1.0.10","https://github.com/google/brotli/releases/tag/v1.1.1","https://github.com/google/brotli/releases/tag/v1.2.1","https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html","https://patchtheplanet.org/brotli","https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497","https://cert-portal.siemens.com/productcert/html/ssa-045512.html","https://cert-portal.siemens.com/productcert/html/ssa-443410.html","https://cert-portal.siemens.com/productcert/html/ssa-898633.html","https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","knownExploited":[{"cve":"CVE-2026-111497","cwes":["CWE-252","CWE-787"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-111497"],"notes":"This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/google/brotli/releases/tag/v1.2.1; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-10","product":"Brotli","dateAdded":"2026-10-27","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"19949061aabcc871","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:8.9p1-3ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:8.9p1-3ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:8.9p1-3ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:8.9p1-3ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:8.9p1-3ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:8.9p1-3ubuntu0.6:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A8.9p1-3ubuntu0.6?arch=amd64&distro=ubuntu-22.04&upstream=openssh","type":"deb","version":"1:8.9p1-3ubuntu0.6","language":"","licenses":["BSD-2-clause","BSD-3-clause","Expat-with-advertising-restriction","Mazieres-BSD-style","OpenSSH","Powell-BSD-style","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.preinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.preinst"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:8.9p1-3ubuntu0.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-6387","versionConstraint":"< 1:8.9p1-3ubuntu0.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssh","version":"1:8.9p1-3ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6387","fix":{"state":"fixed","versions":["1:8.9p1-3ubuntu0.10"],"available":[{"date":"2024-07-01","kind":"advisory","version":"1:8.9p1-3ubuntu0.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6387","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-6387","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6387","date":"2026-11-02","epss":0.99506,"percentile":0.99946}],"risk":74.6295,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6387"},"relatedVulnerabilities":[{"id":"CVE-2024-6387","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6387","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-6387","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6387","date":"2026-11-02","epss":0.99506,"percentile":0.99946}],"urls":["https://access.redhat.com/errata/RHSA-2024:4312","https://access.redhat.com/errata/RHSA-2024:4340","https://access.redhat.com/errata/RHSA-2024:4389","https://access.redhat.com/errata/RHSA-2024:4469","https://access.redhat.com/errata/RHSA-2024:4474","https://access.redhat.com/errata/RHSA-2024:4479","https://access.redhat.com/errata/RHSA-2024:4484","https://access.redhat.com/security/cve/CVE-2024-6387","https://bugzilla.redhat.com/show_bug.cgi?id=2294604","https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.openssh.com/txt/release-9.8","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","http://seclists.org/fulldisclosure/2024/Jul/18","http://seclists.org/fulldisclosure/2024/Jul/19","http://seclists.org/fulldisclosure/2024/Jul/20","http://www.openwall.com/lists/oss-security/2024/07/01/12","http://www.openwall.com/lists/oss-security/2024/07/01/13","http://www.openwall.com/lists/oss-security/2024/07/02/1","http://www.openwall.com/lists/oss-security/2024/07/03/1","http://www.openwall.com/lists/oss-security/2024/07/03/11","http://www.openwall.com/lists/oss-security/2024/07/03/2","http://www.openwall.com/lists/oss-security/2024/07/03/3","http://www.openwall.com/lists/oss-security/2024/07/03/4","http://www.openwall.com/lists/oss-security/2024/07/03/5","http://www.openwall.com/lists/oss-security/2024/07/04/1","http://www.openwall.com/lists/oss-security/2024/07/04/2","http://www.openwall.com/lists/oss-security/2024/07/08/2","http://www.openwall.com/lists/oss-security/2024/07/08/3","http://www.openwall.com/lists/oss-security/2024/07/09/2","http://www.openwall.com/lists/oss-security/2024/07/09/5","http://www.openwall.com/lists/oss-security/2024/07/10/1","http://www.openwall.com/lists/oss-security/2024/07/10/2","http://www.openwall.com/lists/oss-security/2024/07/10/3","http://www.openwall.com/lists/oss-security/2024/07/10/4","http://www.openwall.com/lists/oss-security/2024/07/10/6","http://www.openwall.com/lists/oss-security/2024/07/11/1","http://www.openwall.com/lists/oss-security/2024/07/11/3","http://www.openwall.com/lists/oss-security/2024/07/23/4","http://www.openwall.com/lists/oss-security/2024/07/23/6","http://www.openwall.com/lists/oss-security/2024/07/28/2","http://www.openwall.com/lists/oss-security/2024/07/28/3","https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/","https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/","https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server","https://explore.alas.aws.amazon.com/CVE-2024-6387.html","https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132","https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc","https://github.com/AlmaLinux/updates/issues/629","https://github.com/Azure/AKS/issues/4379","https://github.com/PowerShell/Win32-OpenSSH/discussions/2248","https://github.com/PowerShell/Win32-OpenSSH/issues/2249","https://github.com/microsoft/azurelinux/issues/9555","https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09","https://github.com/oracle/oracle-linux/issues/149","https://github.com/rapier1/hpn-ssh/issues/87","https://github.com/zgzhang/cve-2024-6387-poc","https://lists.almalinux.org/archives/list/announce@lists.almalinux.org/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/","https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html","https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html","https://news.ycombinator.com/item?id=40843778","https://packetstorm.news/files/id/190587/","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010","https://security-tracker.debian.org/tracker/CVE-2024-6387","https://security.netapp.com/advisory/ntap-20240701-0001/","https://sig-security.rocky.page/issues/CVE-2024-6387/","https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/","https://support.apple.com/kb/HT214118","https://support.apple.com/kb/HT214119","https://support.apple.com/kb/HT214120","https://ubuntu.com/security/CVE-2024-6387","https://ubuntu.com/security/notices/USN-6859-1","https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do","https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100","https://www.exploit-db.com/exploits/52269","https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc","https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html","https://www.suse.com/security/cve/CVE-2024-6387.html","https://www.theregister.com/2024/07/01/regresshion_openssh/","https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-446545.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6387","description":"A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period."}]},{"artifact":{"id":"02cefa104fb0261b","cpes":["cpe:2.3:a:libfreetype6:libfreetype6:2.11.1\\+dfsg-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libfreetype6","purl":"pkg:deb/ubuntu/libfreetype6@2.11.1%2Bdfsg-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=freetype","type":"deb","version":"2.11.1+dfsg-1ubuntu0.2","language":"","licenses":["BSD-3-Clause","BSL-1.0","FSFAP","FTL","GPL-2","GPL-2+","GPL-3","GPL-3+","MIT","OpenGroup-BSD-like","Public-Domain","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libfreetype6/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libfreetype6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libfreetype6:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libfreetype6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"freetype"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.11.1+dfsg-1ubuntu0.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-27363","versionConstraint":"< 2.11.1+dfsg-1ubuntu0.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"freetype","version":"2.11.1+dfsg-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-27363","fix":{"state":"fixed","versions":["2.11.1+dfsg-1ubuntu0.3"],"available":[{"date":"2025-03-17","kind":"advisory","version":"2.11.1+dfsg-1ubuntu0.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-27363","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-27363","date":"2026-11-02","epss":0.27775,"percentile":0.98092}],"risk":52.5,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-27363","knownExploited":[{"cve":"CVE-2025-27363","cwes":["CWE-787"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-27363"],"notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://source.android.com/docs/security/bulletin/2025-05-01","dueDate":"2025-05-27","product":"FreeType","dateAdded":"2025-05-06","vendorProject":"FreeType","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2025-27363","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve-assign@fb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-27363","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-27363","date":"2026-11-02","epss":0.27775,"percentile":0.98092}],"urls":["https://www.facebook.com/security/advisories/cve-2025-27363","http://www.openwall.com/lists/oss-security/2025/03/13/1","http://www.openwall.com/lists/oss-security/2025/03/13/11","http://www.openwall.com/lists/oss-security/2025/03/13/12","http://www.openwall.com/lists/oss-security/2025/03/13/2","http://www.openwall.com/lists/oss-security/2025/03/13/3","http://www.openwall.com/lists/oss-security/2025/03/13/8","http://www.openwall.com/lists/oss-security/2025/03/14/1","http://www.openwall.com/lists/oss-security/2025/03/14/2","http://www.openwall.com/lists/oss-security/2025/03/14/3","http://www.openwall.com/lists/oss-security/2025/03/14/4","http://www.openwall.com/lists/oss-security/2025/05/06/3","http://www.openwall.com/lists/oss-security/2026/04/16/5","http://www.openwall.com/lists/oss-security/2026/04/19/3","https://lists.debian.org/debian-lts-announce/2025/03/msg00030.html","https://source.android.com/docs/security/bulletin/2025-05-01","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27363"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27363","description":"An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.","knownExploited":[{"cve":"CVE-2025-27363","cwes":["CWE-787"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-27363"],"notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://source.android.com/docs/security/bulletin/2025-05-01","dueDate":"2025-05-27","product":"FreeType","dateAdded":"2025-05-06","vendorProject":"FreeType","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.109"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wmwf-9ccg-fff5","versionConstraint":">=9.0.0-M11,<9.0.109 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wmwf-9ccg-fff5","fix":{"state":"fixed","versions":["9.0.109"],"available":[{"date":"2025-10-29","kind":"first-observed","version":"9.0.109"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55752","cwe":"CWE-23","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-55752","date":"2026-11-02","epss":0.64413,"percentile":0.99236}],"risk":48.631815,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-55752","https://lists.apache.org/thread/n05kjcwyj1s45ovs8ll1qrrojhfb1tog","https://github.com/apache/tomcat/commit/130d36d8492ef9e4eb22952c17c92423cb35fd06","https://github.com/apache/tomcat/commit/b5042622b8b78340ae65403c55dcb9c7416924df","https://github.com/apache/tomcat/commit/fec06c610ed7466b401e29cc567a58aee5ed826a","https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.45","https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.11","https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.109","http://www.openwall.com/lists/oss-security/2025/10/27/4","https://www.vicarius.io/vsociety/posts/cve-2025-55752-detect-apache-tomcat-vulnerability","https://www.vicarius.io/vsociety/posts/cve-2025-55752-mitigate-apache-tomcat-vulnerability","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wmwf-9ccg-fff5","description":"Apache Tomcat Vulnerable to Relative Path Traversal"},"relatedVulnerabilities":[{"id":"CVE-2025-55752","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55752","cwe":"CWE-23","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-55752","date":"2026-11-02","epss":0.64413,"percentile":0.99236}],"urls":["https://lists.apache.org/thread/n05kjcwyj1s45ovs8ll1qrrojhfb1tog","http://www.openwall.com/lists/oss-security/2025/10/27/4","https://www.vicarius.io/vsociety/posts/cve-2025-55752-detect-apache-tomcat-vulnerability","https://www.vicarius.io/vsociety/posts/cve-2025-55752-mitigate-apache-tomcat-vulnerability","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55752","description":"Relative Path Traversal vulnerability in Apache Tomcat.\n\nThe fix for bug 60013 introduced a regression where the       rewritten URL was normalized before it was decoded. This introduced the       possibility that, for rewrite rules that rewrite query parameters to the       URL, an attacker could manipulate the request URI to bypass security       constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue."}]},{"artifact":{"id":"f02275b79327efaf","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2961","versionConstraint":"< 2.35-0ubuntu3.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-2961","fix":{"state":"fixed","versions":["2.35-0ubuntu3.7"],"available":[{"date":"2024-04-18","kind":"advisory","version":"2.35-0ubuntu3.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"risk":44.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2961"},"relatedVulnerabilities":[{"id":"CVE-2024-2961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/17/9","http://www.openwall.com/lists/oss-security/2024/04/18/4","http://www.openwall.com/lists/oss-security/2024/04/24/2","http://www.openwall.com/lists/oss-security/2024/05/27/1","http://www.openwall.com/lists/oss-security/2024/05/27/2","http://www.openwall.com/lists/oss-security/2024/05/27/3","http://www.openwall.com/lists/oss-security/2024/05/27/4","http://www.openwall.com/lists/oss-security/2024/05/27/5","http://www.openwall.com/lists/oss-security/2024/05/27/6","http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/","https://security.netapp.com/advisory/ntap-20240531-0002/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004","https://www.ambionics.io/blog/iconv-cve-2024-2961-p1","https://www.ambionics.io/blog/iconv-cve-2024-2961-p2","https://www.ambionics.io/blog/iconv-cve-2024-2961-p3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."}]},{"artifact":{"id":"91ecf8e0fa5aba51","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/ubuntu/libc-dev-bin@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2961","versionConstraint":"< 2.35-0ubuntu3.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-2961","fix":{"state":"fixed","versions":["2.35-0ubuntu3.7"],"available":[{"date":"2024-04-18","kind":"advisory","version":"2.35-0ubuntu3.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"risk":44.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2961"},"relatedVulnerabilities":[{"id":"CVE-2024-2961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/17/9","http://www.openwall.com/lists/oss-security/2024/04/18/4","http://www.openwall.com/lists/oss-security/2024/04/24/2","http://www.openwall.com/lists/oss-security/2024/05/27/1","http://www.openwall.com/lists/oss-security/2024/05/27/2","http://www.openwall.com/lists/oss-security/2024/05/27/3","http://www.openwall.com/lists/oss-security/2024/05/27/4","http://www.openwall.com/lists/oss-security/2024/05/27/5","http://www.openwall.com/lists/oss-security/2024/05/27/6","http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/","https://security.netapp.com/advisory/ntap-20240531-0002/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004","https://www.ambionics.io/blog/iconv-cve-2024-2961-p1","https://www.ambionics.io/blog/iconv-cve-2024-2961-p2","https://www.ambionics.io/blog/iconv-cve-2024-2961-p3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."}]},{"artifact":{"id":"8da7e53d1801cfa5","cpes":["cpe:2.3:a:libc6:libc6:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2961","versionConstraint":"< 2.35-0ubuntu3.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-2961","fix":{"state":"fixed","versions":["2.35-0ubuntu3.7"],"available":[{"date":"2024-04-18","kind":"advisory","version":"2.35-0ubuntu3.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"risk":44.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2961"},"relatedVulnerabilities":[{"id":"CVE-2024-2961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/17/9","http://www.openwall.com/lists/oss-security/2024/04/18/4","http://www.openwall.com/lists/oss-security/2024/04/24/2","http://www.openwall.com/lists/oss-security/2024/05/27/1","http://www.openwall.com/lists/oss-security/2024/05/27/2","http://www.openwall.com/lists/oss-security/2024/05/27/3","http://www.openwall.com/lists/oss-security/2024/05/27/4","http://www.openwall.com/lists/oss-security/2024/05/27/5","http://www.openwall.com/lists/oss-security/2024/05/27/6","http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/","https://security.netapp.com/advisory/ntap-20240531-0002/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004","https://www.ambionics.io/blog/iconv-cve-2024-2961-p1","https://www.ambionics.io/blog/iconv-cve-2024-2961-p2","https://www.ambionics.io/blog/iconv-cve-2024-2961-p3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."}]},{"artifact":{"id":"5ee048fdc80b241c","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/ubuntu/libc6-dev@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2961","versionConstraint":"< 2.35-0ubuntu3.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-2961","fix":{"state":"fixed","versions":["2.35-0ubuntu3.7"],"available":[{"date":"2024-04-18","kind":"advisory","version":"2.35-0ubuntu3.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"risk":44.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2961"},"relatedVulnerabilities":[{"id":"CVE-2024-2961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/17/9","http://www.openwall.com/lists/oss-security/2024/04/18/4","http://www.openwall.com/lists/oss-security/2024/04/24/2","http://www.openwall.com/lists/oss-security/2024/05/27/1","http://www.openwall.com/lists/oss-security/2024/05/27/2","http://www.openwall.com/lists/oss-security/2024/05/27/3","http://www.openwall.com/lists/oss-security/2024/05/27/4","http://www.openwall.com/lists/oss-security/2024/05/27/5","http://www.openwall.com/lists/oss-security/2024/05/27/6","http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/","https://security.netapp.com/advisory/ntap-20240531-0002/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004","https://www.ambionics.io/blog/iconv-cve-2024-2961-p1","https://www.ambionics.io/blog/iconv-cve-2024-2961-p2","https://www.ambionics.io/blog/iconv-cve-2024-2961-p3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."}]},{"artifact":{"id":"a88b7869c938a730","cpes":["cpe:2.3:a:locales:locales:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/ubuntu/locales@2.35-0ubuntu3.6?arch=all&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2961","versionConstraint":"< 2.35-0ubuntu3.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-2961","fix":{"state":"fixed","versions":["2.35-0ubuntu3.7"],"available":[{"date":"2024-04-18","kind":"advisory","version":"2.35-0ubuntu3.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"risk":44.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2961"},"relatedVulnerabilities":[{"id":"CVE-2024-2961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/17/9","http://www.openwall.com/lists/oss-security/2024/04/18/4","http://www.openwall.com/lists/oss-security/2024/04/24/2","http://www.openwall.com/lists/oss-security/2024/05/27/1","http://www.openwall.com/lists/oss-security/2024/05/27/2","http://www.openwall.com/lists/oss-security/2024/05/27/3","http://www.openwall.com/lists/oss-security/2024/05/27/4","http://www.openwall.com/lists/oss-security/2024/05/27/5","http://www.openwall.com/lists/oss-security/2024/05/27/6","http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/","https://security.netapp.com/advisory/ntap-20240531-0002/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004","https://www.ambionics.io/blog/iconv-cve-2024-2961-p1","https://www.ambionics.io/blog/iconv-cve-2024-2961-p2","https://www.ambionics.io/blog/iconv-cve-2024-2961-p3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."}]},{"artifact":{"id":"8714e648b2fbdcd7","cpes":["cpe:2.3:a:libnghttp2-14:libnghttp2-14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2-14:libnghttp2_14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2_14:libnghttp2-14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2_14:libnghttp2_14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2:libnghttp2-14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2:libnghttp2_14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*"],"name":"libnghttp2-14","purl":"pkg:deb/ubuntu/libnghttp2-14@1.43.0-1ubuntu0.1?arch=amd64&distro=ubuntu-22.04&upstream=nghttp2","type":"deb","version":"1.43.0-1ubuntu0.1","language":"","licenses":["BSD-2-clause","Expat","GPL-3","GPL-3+","MIT","SIL-OFL-1.1","all-permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnghttp2-14/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libnghttp2-14/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnghttp2-14:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libnghttp2-14:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nghttp2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.43.0-1ubuntu0.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-28182","versionConstraint":"< 1.43.0-1ubuntu0.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nghttp2","version":"1.43.0-1ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-28182","fix":{"state":"fixed","versions":["1.43.0-1ubuntu0.2"],"available":[{"date":"2024-04-25","kind":"advisory","version":"1.43.0-1ubuntu0.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-28182","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-28182","date":"2026-11-02","epss":0.8496,"percentile":0.99712}],"risk":42.480000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28182"},"relatedVulnerabilities":[{"id":"CVE-2024-28182","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28182","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-28182","date":"2026-11-02","epss":0.8496,"percentile":0.99712}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/03/16","https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0","https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9","https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q","https://lists.debian.org/debian-lts-announce/2024/04/msg00026.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/","https://lists.debian.org/debian-lts-announce/2024/09/msg00041.html","https://www.kb.cert.org/vuls/id/421644","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-784301.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28182","description":"nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync.  This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability."}]},{"artifact":{"id":"99eab8abc4efa46b","cpes":["cpe:2.3:a:org.springframework:spring-webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring-webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring_webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring-webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring_webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_webmvc:5.3.31:*:*:*:*:*:*:*"],"name":"spring-webmvc","purl":"pkg:maven/org.springframework/spring-webmvc@5.3.31","type":"java-archive","version":"5.3.31","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-webmvc-5.3.31.jar","manifestName":"","pomArtifactID":"spring-webmvc","archiveDigests":[{"value":"45754d056effe8257a012f6b98ed5454cf1e8960","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-webmvc-5.3.31.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-webmvc-5.3.31.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-g5vr-rgqm-vf78","versionConstraint":"<=5.3.40 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-webmvc","version":"5.3.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-g5vr-rgqm-vf78","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38819","cwe":"CWE-22","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2024-38819","date":"2026-11-02","epss":0.56463,"percentile":0.99057}],"risk":42.347249999999995,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-38819","https://spring.io/security/cve-2024-38819","https://github.com/spring-projects/spring-framework/issues/33689","https://github.com/spring-projects/spring-framework/commit/3bfbe30a7814c9ea1556d40df9bd87ddb3ba372d","https://github.com/spring-projects/spring-framework/commit/fb7890d73975a3d9e0763e0926df2bd0a608e87e","https://security.netapp.com/advisory/ntap-20250110-0010"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","description":"Spring Framework Path Traversal vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-38819","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38819","cwe":"CWE-22","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2024-38819","date":"2026-11-02","epss":0.56463,"percentile":0.99057}],"urls":["https://spring.io/security/cve-2024-38819","https://security.netapp.com/advisory/ntap-20250110-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-38819","description":"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running."}]},{"artifact":{"id":"b051bfff7d8ef5fa","cpes":["cpe:2.3:a:apache:kafka-clients:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:kafka_clients:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:kafka:3.5.1:*:*:*:*:*:*:*"],"name":"kafka-clients","purl":"pkg:maven/org.apache.kafka/kafka-clients@3.5.1","type":"java-archive","version":"3.5.1","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.kafka","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/kafka-clients-3.5.1.jar","manifestName":"","pomArtifactID":"kafka-clients","archiveDigests":[{"value":"2675a2dc48735f75d0694ca8bd8d4d3cb3737c17","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/kafka-clients-3.5.1.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/kafka-clients-3.5.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.9.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vgq5-3255-v292","versionConstraint":">=3.1.0,<3.9.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.kafka:kafka-clients","version":"3.5.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vgq5-3255-v292","fix":{"state":"fixed","versions":["3.9.1"],"available":[{"date":"2025-06-11","kind":"first-observed","version":"3.9.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":6.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-27817","cwe":"CWE-918","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-27817","date":"2026-11-02","epss":0.68776,"percentile":0.99345}],"risk":40.74978,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-27817","https://kafka.apache.org/cve-list","http://www.openwall.com/lists/oss-security/2025/06/09/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vgq5-3255-v292","description":"Apache Kafka Client Arbitrary File Read and Server Side Request Forgery Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-27817","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-27817","cwe":"CWE-918","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-27817","date":"2026-11-02","epss":0.68776,"percentile":0.99345}],"urls":["https://kafka.apache.org/cve-list","http://www.openwall.com/lists/oss-security/2025/06/09/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27817","description":"A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including \"sasl.oauthbearer.token.endpoint.url\" and \"sasl.oauthbearer.jwks.endpoint.url\". Apache Kafka allows clients to read an arbitrary file and return the content in the error log, or sending requests to an unintended location. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use the \"sasl.oauthbearer.token.endpoint.url\" and \"sasl.oauthbearer.jwks.endpoint.url\" configuratin to read arbitrary contents of the disk and environment variables or make requests to an unintended location. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment/URL access, which may be undesirable in certain environments, including SaaS products. \n\nSince Apache Kafka 3.9.1/4.0.0, we have added a system property (\"-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls\") to set the allowed urls in SASL JAAS configuration. In 3.9.1, it accepts all urls by default for backward compatibility. However in 4.0.0 and newer, the default value is empty list and users have to set the allowed urls explicitly."}]},{"artifact":{"id":"0fc5ab4c86eb7ea7","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/ubuntu/libssl-dev@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.21"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15467","versionConstraint":"< 3.0.2-0ubuntu1.21 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-15467","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.21"],"available":[{"date":"2026-01-27","kind":"advisory","version":"3.0.2-0ubuntu1.21"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-15467","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-15467","cwe":"CWE-120","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-15467","date":"2026-11-02","epss":0.74793,"percentile":0.99505}],"risk":37.396499999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15467"},"relatedVulnerabilities":[{"id":"CVE-2025-15467","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15467","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-15467","cwe":"CWE-120","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-15467","date":"2026-11-02","epss":0.74793,"percentile":0.99505}],"urls":["https://github.com/openssl/openssl/commit/2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703","https://github.com/openssl/openssl/commit/5f26d4202f5b89664c5c3f3c62086276026ba9a9","https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3","https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e","https://github.com/openssl/openssl/commit/d0071a0799f20cc8101730145349ed4487c268dc","https://openssl-library.org/news/secadv/20260127.txt","http://www.openwall.com/lists/oss-security/2026/01/27/10","http://www.openwall.com/lists/oss-security/2026/02/25/6","https://access.redhat.com/errata/RHSA-2026:1472","https://access.redhat.com/errata/RHSA-2026:1473","https://access.redhat.com/errata/RHSA-2026:1496","https://access.redhat.com/errata/RHSA-2026:1503","https://access.redhat.com/errata/RHSA-2026:1519","https://access.redhat.com/errata/RHSA-2026:1594","https://access.redhat.com/errata/RHSA-2026:1733","https://access.redhat.com/errata/RHSA-2026:1736","https://access.redhat.com/errata/RHSA-2026:2072","https://access.redhat.com/errata/RHSA-2026:2077","https://access.redhat.com/errata/RHSA-2026:2485","https://access.redhat.com/errata/RHSA-2026:2563","https://access.redhat.com/errata/RHSA-2026:2633","https://access.redhat.com/errata/RHSA-2026:2659","https://access.redhat.com/errata/RHSA-2026:2671","https://access.redhat.com/errata/RHSA-2026:2844","https://access.redhat.com/errata/RHSA-2026:2974","https://access.redhat.com/errata/RHSA-2026:2995","https://access.redhat.com/errata/RHSA-2026:3228","https://access.redhat.com/errata/RHSA-2026:3415","https://access.redhat.com/errata/RHSA-2026:3461","https://access.redhat.com/errata/RHSA-2026:3462","https://access.redhat.com/errata/RHSA-2026:4419","https://access.redhat.com/errata/RHSA-2026:4943","https://access.redhat.com/errata/RHSA-2026:6481","https://access.redhat.com/errata/RHSA-2026:7261","https://access.redhat.com/security/cve/CVE-2025-15467","https://bugzilla.redhat.com/show_bug.cgi?id=2430376","https://cert-portal.siemens.com/productcert/html/ssa-434797.html","https://cert-portal.siemens.com/productcert/html/ssa-734552.html","https://github.com/guiimoraes/CVE-2025-15467","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15467.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15467","description":"Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue."}]},{"artifact":{"id":"080c8716011e8bcc","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.21"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15467","versionConstraint":"< 3.0.2-0ubuntu1.21 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-15467","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.21"],"available":[{"date":"2026-01-27","kind":"advisory","version":"3.0.2-0ubuntu1.21"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-15467","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-15467","cwe":"CWE-120","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-15467","date":"2026-11-02","epss":0.74793,"percentile":0.99505}],"risk":37.396499999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15467"},"relatedVulnerabilities":[{"id":"CVE-2025-15467","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15467","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-15467","cwe":"CWE-120","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-15467","date":"2026-11-02","epss":0.74793,"percentile":0.99505}],"urls":["https://github.com/openssl/openssl/commit/2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703","https://github.com/openssl/openssl/commit/5f26d4202f5b89664c5c3f3c62086276026ba9a9","https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3","https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e","https://github.com/openssl/openssl/commit/d0071a0799f20cc8101730145349ed4487c268dc","https://openssl-library.org/news/secadv/20260127.txt","http://www.openwall.com/lists/oss-security/2026/01/27/10","http://www.openwall.com/lists/oss-security/2026/02/25/6","https://access.redhat.com/errata/RHSA-2026:1472","https://access.redhat.com/errata/RHSA-2026:1473","https://access.redhat.com/errata/RHSA-2026:1496","https://access.redhat.com/errata/RHSA-2026:1503","https://access.redhat.com/errata/RHSA-2026:1519","https://access.redhat.com/errata/RHSA-2026:1594","https://access.redhat.com/errata/RHSA-2026:1733","https://access.redhat.com/errata/RHSA-2026:1736","https://access.redhat.com/errata/RHSA-2026:2072","https://access.redhat.com/errata/RHSA-2026:2077","https://access.redhat.com/errata/RHSA-2026:2485","https://access.redhat.com/errata/RHSA-2026:2563","https://access.redhat.com/errata/RHSA-2026:2633","https://access.redhat.com/errata/RHSA-2026:2659","https://access.redhat.com/errata/RHSA-2026:2671","https://access.redhat.com/errata/RHSA-2026:2844","https://access.redhat.com/errata/RHSA-2026:2974","https://access.redhat.com/errata/RHSA-2026:2995","https://access.redhat.com/errata/RHSA-2026:3228","https://access.redhat.com/errata/RHSA-2026:3415","https://access.redhat.com/errata/RHSA-2026:3461","https://access.redhat.com/errata/RHSA-2026:3462","https://access.redhat.com/errata/RHSA-2026:4419","https://access.redhat.com/errata/RHSA-2026:4943","https://access.redhat.com/errata/RHSA-2026:6481","https://access.redhat.com/errata/RHSA-2026:7261","https://access.redhat.com/security/cve/CVE-2025-15467","https://bugzilla.redhat.com/show_bug.cgi?id=2430376","https://cert-portal.siemens.com/productcert/html/ssa-434797.html","https://cert-portal.siemens.com/productcert/html/ssa-734552.html","https://github.com/guiimoraes/CVE-2025-15467","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15467.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15467","description":"Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue."}]},{"artifact":{"id":"e6933be022de0634","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.21"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-15467","versionConstraint":"< 3.0.2-0ubuntu1.21 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-15467","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.21"],"available":[{"date":"2026-01-27","kind":"advisory","version":"3.0.2-0ubuntu1.21"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-15467","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-15467","cwe":"CWE-120","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-15467","date":"2026-11-02","epss":0.74793,"percentile":0.99505}],"risk":37.396499999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15467"},"relatedVulnerabilities":[{"id":"CVE-2025-15467","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15467","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-15467","cwe":"CWE-120","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-15467","date":"2026-11-02","epss":0.74793,"percentile":0.99505}],"urls":["https://github.com/openssl/openssl/commit/2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703","https://github.com/openssl/openssl/commit/5f26d4202f5b89664c5c3f3c62086276026ba9a9","https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3","https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e","https://github.com/openssl/openssl/commit/d0071a0799f20cc8101730145349ed4487c268dc","https://openssl-library.org/news/secadv/20260127.txt","http://www.openwall.com/lists/oss-security/2026/01/27/10","http://www.openwall.com/lists/oss-security/2026/02/25/6","https://access.redhat.com/errata/RHSA-2026:1472","https://access.redhat.com/errata/RHSA-2026:1473","https://access.redhat.com/errata/RHSA-2026:1496","https://access.redhat.com/errata/RHSA-2026:1503","https://access.redhat.com/errata/RHSA-2026:1519","https://access.redhat.com/errata/RHSA-2026:1594","https://access.redhat.com/errata/RHSA-2026:1733","https://access.redhat.com/errata/RHSA-2026:1736","https://access.redhat.com/errata/RHSA-2026:2072","https://access.redhat.com/errata/RHSA-2026:2077","https://access.redhat.com/errata/RHSA-2026:2485","https://access.redhat.com/errata/RHSA-2026:2563","https://access.redhat.com/errata/RHSA-2026:2633","https://access.redhat.com/errata/RHSA-2026:2659","https://access.redhat.com/errata/RHSA-2026:2671","https://access.redhat.com/errata/RHSA-2026:2844","https://access.redhat.com/errata/RHSA-2026:2974","https://access.redhat.com/errata/RHSA-2026:2995","https://access.redhat.com/errata/RHSA-2026:3228","https://access.redhat.com/errata/RHSA-2026:3415","https://access.redhat.com/errata/RHSA-2026:3461","https://access.redhat.com/errata/RHSA-2026:3462","https://access.redhat.com/errata/RHSA-2026:4419","https://access.redhat.com/errata/RHSA-2026:4943","https://access.redhat.com/errata/RHSA-2026:6481","https://access.redhat.com/errata/RHSA-2026:7261","https://access.redhat.com/security/cve/CVE-2025-15467","https://bugzilla.redhat.com/show_bug.cgi?id=2430376","https://cert-portal.siemens.com/productcert/html/ssa-434797.html","https://cert-portal.siemens.com/productcert/html/ssa-734552.html","https://github.com/guiimoraes/CVE-2025-15467","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15467.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15467","description":"Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue."}]},{"artifact":{"id":"01ef732d98327202","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.37.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.37.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.37.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.37.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.37.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.37.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.37.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=sqlite3","type":"deb","version":"3.37.2-2ubuntu0.3","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.37.2-2ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6965","versionConstraint":"< 3.37.2-2ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"sqlite3","version":"3.37.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-6965","fix":{"state":"fixed","versions":["3.37.2-2ubuntu0.5"],"available":[{"date":"2025-07-28","kind":"advisory","version":"3.37.2-2ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-6965","cwe":"CWE-197","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-6965","date":"2026-11-02","epss":0.73452,"percentile":0.99465}],"risk":36.726,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6965"},"relatedVulnerabilities":[{"id":"CVE-2025-6965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L","metrics":{"baseScore":7.7,"impactScore":5.3,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:Green","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6965","cwe":"CWE-197","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-6965","date":"2026-11-02","epss":0.73452,"percentile":0.99465}],"urls":["https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8","http://seclists.org/fulldisclosure/2025/Sep/49","http://seclists.org/fulldisclosure/2025/Sep/53","http://seclists.org/fulldisclosure/2025/Sep/56","http://seclists.org/fulldisclosure/2025/Sep/57","http://seclists.org/fulldisclosure/2025/Sep/58","http://www.openwall.com/lists/oss-security/2025/09/06/1","https://cert-portal.siemens.com/productcert/html/ssa-225816.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-765416.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6965","description":"There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.104"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3p2h-wqq4-wf4h","versionConstraint":">=9.0.76,<=9.0.102 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3p2h-wqq4-wf4h","fix":{"state":"fixed","versions":["9.0.104"],"available":[{"date":"2025-05-15","kind":"first-observed","version":"9.0.104"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-31650","cwe":"CWE-459","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-31650","cwe":"CWE-459","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-31650","date":"2026-11-02","epss":0.61322,"percentile":0.99164}],"risk":35.566759999999995,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-31650","https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826","http://www.openwall.com/lists/oss-security/2025/04/28/2","https://github.com/apache/tomcat/commit/1eef1dc459c45f1e421d8bd25ef340fc1cc34edc","https://github.com/apache/tomcat/commit/40ae788c2e64d018b4e58cd4210bb96434d0100d","https://github.com/apache/tomcat/commit/75554da2fc5574862510ae6f0d7b3d78937f1d40","https://github.com/apache/tomcat/commit/8cc3b8fb3f2d8d4d6a757e014f19d1fafa948a60","https://github.com/apache/tomcat/commit/b7674782679e1514a0d154166b1d04d38aaac4a9","https://github.com/apache/tomcat/commit/b98e74f517b36929f4208506e5adad22cb767baa","https://github.com/apache/tomcat/commit/cba1a0fe1289ee7f5dd46c61c38d1e1ac5437bff","https://github.com/apache/tomcat/commit/ded0285b96b4d3f5560dfc8856ad5ec4a9b50ba9","https://github.com/apache/tomcat/commit/f619e6a05029538886d5a9d987925d573b5bb8c2","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3p2h-wqq4-wf4h","description":"Apache Tomcat Denial of Service via invalid HTTP priority header"},"relatedVulnerabilities":[{"id":"CVE-2025-31650","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-31650","cwe":"CWE-459","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-31650","cwe":"CWE-459","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-31650","date":"2026-11-02","epss":0.61322,"percentile":0.99164}],"urls":["https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826","http://www.openwall.com/lists/oss-security/2025/04/28/2","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-31650","description":"Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.\n\nThis issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.90 though 8.5.100.\n\n\nUsers are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue."}]},{"artifact":{"id":"0fc5ab4c86eb7ea7","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/ubuntu/libssl-dev@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.18"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-6119","versionConstraint":"< 3.0.2-0ubuntu1.18 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6119","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.18"],"available":[{"date":"2024-09-03","kind":"advisory","version":"3.0.2-0ubuntu1.18"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6119","cwe":"CWE-843","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-6119","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6119","date":"2026-11-02","epss":0.66582,"percentile":0.99287}],"risk":33.291,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6119"},"relatedVulnerabilities":[{"id":"CVE-2024-6119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6119","cwe":"CWE-843","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-6119","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6119","date":"2026-11-02","epss":0.66582,"percentile":0.99287}],"urls":["https://github.com/openssl/openssl/commit/05f360d9e849a1b277db628f1f13083a7f8dd04f","https://github.com/openssl/openssl/commit/06d1dc3fa96a2ba5a3e22735a033012aadc9f0d6","https://github.com/openssl/openssl/commit/621f3729831b05ee828a3203eddb621d014ff2b2","https://github.com/openssl/openssl/commit/7dfcee2cd2a63b2c64b9b4b0850be64cb695b0a0","https://openssl-library.org/news/secadv/20240903.txt","http://www.openwall.com/lists/oss-security/2024/09/03/4","https://lists.freebsd.org/archives/freebsd-security/2024-September/000303.html","https://security.netapp.com/advisory/ntap-20240912-0001/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6119","description":"Issue summary: Applications performing certificate name checks (e.g., TLS\nclients checking server certificates) may attempt to read an invalid memory\naddress resulting in abnormal termination of the application process.\n\nImpact summary: Abnormal termination of an application can a cause a denial of\nservice.\n\nApplications performing certificate name checks (e.g., TLS clients checking\nserver certificates) may attempt to read an invalid memory address when\ncomparing the expected name with an `otherName` subject alternative name of an\nX.509 certificate. This may result in an exception that terminates the\napplication program.\n\nNote that basic certificate chain validation (signatures, dates, ...) is not\naffected, the denial of service can occur only when the application also\nspecifies an expected DNS name, Email address or IP address.\n\nTLS servers rarely solicit client certificates, and even when they do, they\ngenerally don't perform a name check against a reference identifier (expected\nidentity), but rather extract the presented identity after checking the\ncertificate chain.  So TLS servers are generally not affected and the severity\nof the issue is Moderate.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"080c8716011e8bcc","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.18"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-6119","versionConstraint":"< 3.0.2-0ubuntu1.18 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6119","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.18"],"available":[{"date":"2024-09-03","kind":"advisory","version":"3.0.2-0ubuntu1.18"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6119","cwe":"CWE-843","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-6119","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6119","date":"2026-11-02","epss":0.66582,"percentile":0.99287}],"risk":33.291,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6119"},"relatedVulnerabilities":[{"id":"CVE-2024-6119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6119","cwe":"CWE-843","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-6119","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6119","date":"2026-11-02","epss":0.66582,"percentile":0.99287}],"urls":["https://github.com/openssl/openssl/commit/05f360d9e849a1b277db628f1f13083a7f8dd04f","https://github.com/openssl/openssl/commit/06d1dc3fa96a2ba5a3e22735a033012aadc9f0d6","https://github.com/openssl/openssl/commit/621f3729831b05ee828a3203eddb621d014ff2b2","https://github.com/openssl/openssl/commit/7dfcee2cd2a63b2c64b9b4b0850be64cb695b0a0","https://openssl-library.org/news/secadv/20240903.txt","http://www.openwall.com/lists/oss-security/2024/09/03/4","https://lists.freebsd.org/archives/freebsd-security/2024-September/000303.html","https://security.netapp.com/advisory/ntap-20240912-0001/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6119","description":"Issue summary: Applications performing certificate name checks (e.g., TLS\nclients checking server certificates) may attempt to read an invalid memory\naddress resulting in abnormal termination of the application process.\n\nImpact summary: Abnormal termination of an application can a cause a denial of\nservice.\n\nApplications performing certificate name checks (e.g., TLS clients checking\nserver certificates) may attempt to read an invalid memory address when\ncomparing the expected name with an `otherName` subject alternative name of an\nX.509 certificate. This may result in an exception that terminates the\napplication program.\n\nNote that basic certificate chain validation (signatures, dates, ...) is not\naffected, the denial of service can occur only when the application also\nspecifies an expected DNS name, Email address or IP address.\n\nTLS servers rarely solicit client certificates, and even when they do, they\ngenerally don't perform a name check against a reference identifier (expected\nidentity), but rather extract the presented identity after checking the\ncertificate chain.  So TLS servers are generally not affected and the severity\nof the issue is Moderate.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"e6933be022de0634","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.18"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-6119","versionConstraint":"< 3.0.2-0ubuntu1.18 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6119","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.18"],"available":[{"date":"2024-09-03","kind":"advisory","version":"3.0.2-0ubuntu1.18"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6119","cwe":"CWE-843","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-6119","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6119","date":"2026-11-02","epss":0.66582,"percentile":0.99287}],"risk":33.291,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6119"},"relatedVulnerabilities":[{"id":"CVE-2024-6119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6119","cwe":"CWE-843","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-6119","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6119","date":"2026-11-02","epss":0.66582,"percentile":0.99287}],"urls":["https://github.com/openssl/openssl/commit/05f360d9e849a1b277db628f1f13083a7f8dd04f","https://github.com/openssl/openssl/commit/06d1dc3fa96a2ba5a3e22735a033012aadc9f0d6","https://github.com/openssl/openssl/commit/621f3729831b05ee828a3203eddb621d014ff2b2","https://github.com/openssl/openssl/commit/7dfcee2cd2a63b2c64b9b4b0850be64cb695b0a0","https://openssl-library.org/news/secadv/20240903.txt","http://www.openwall.com/lists/oss-security/2024/09/03/4","https://lists.freebsd.org/archives/freebsd-security/2024-September/000303.html","https://security.netapp.com/advisory/ntap-20240912-0001/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6119","description":"Issue summary: Applications performing certificate name checks (e.g., TLS\nclients checking server certificates) may attempt to read an invalid memory\naddress resulting in abnormal termination of the application process.\n\nImpact summary: Abnormal termination of an application can a cause a denial of\nservice.\n\nApplications performing certificate name checks (e.g., TLS clients checking\nserver certificates) may attempt to read an invalid memory address when\ncomparing the expected name with an `otherName` subject alternative name of an\nX.509 certificate. This may result in an exception that terminates the\napplication program.\n\nNote that basic certificate chain validation (signatures, dates, ...) is not\naffected, the denial of service can occur only when the application also\nspecifies an expected DNS name, Email address or IP address.\n\nTLS servers rarely solicit client certificates, and even when they do, they\ngenerally don't perform a name check against a reference identifier (expected\nidentity), but rather extract the presented identity after checking the\ncertificate chain.  So TLS servers are generally not affected and the severity\nof the issue is Moderate.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"7bccd4346e7df4e4","cpes":["cpe:2.3:a:org.springframework:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring_web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring_web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_web:5.3.31:*:*:*:*:*:*:*"],"name":"spring-web","purl":"pkg:maven/org.springframework/spring-web@5.3.31","type":"java-archive","version":"5.3.31","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-web-5.3.31.jar","manifestName":"","pomArtifactID":"spring-web","archiveDigests":[{"value":"3bf73c385a1f2f4a0d482149d6a205e854cec497","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-web-5.3.31.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-web-5.3.31.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.0.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4wrc-f8pq-fpqp","versionConstraint":"<6.0.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-web","version":"5.3.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4wrc-f8pq-fpqp","fix":{"state":"fixed","versions":["6.0.0"],"available":[{"date":"2022-12-10","kind":"first-observed","version":"6.0.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1000027","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-1000027","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-1000027","date":"2026-11-02","epss":0.33179,"percentile":0.98367}],"risk":31.18826,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-1000027","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027","https://security-tracker.debian.org/tracker/CVE-2016-1000027","https://www.tenable.com/security/research/tra-2016-20","https://github.com/spring-projects/spring-framework/issues/24434","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-1231625331","https://github.com/spring-projects/spring-framework/commit/5cbe90b2cd91b866a5a9586e460f311860e11cfa","https://support.contrastsecurity.com/hc/en-us/articles/4402400830612-Spring-web-Java-Deserialization-CVE-2016-1000027","https://github.com/spring-projects/spring-framework/issues/21680","https://github.com/spring-projects/spring-framework/commit/2b051b8b321768a4cfef83077db65c6328ffd60f","https://jira.spring.io/browse/SPR-17143?redirect=false","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-579669626","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-582313417","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-744519525","https://security.netapp.com/advisory/ntap-20230420-0009/","https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4wrc-f8pq-fpqp","description":"Pivotal Spring Framework contains unsafe Java deserialization methods"},"relatedVulnerabilities":[{"id":"CVE-2016-1000027","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1000027","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-1000027","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-1000027","date":"2026-11-02","epss":0.33179,"percentile":0.98367}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-579669626","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-582313417","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-744519525","https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000027.json","https://security-tracker.debian.org/tracker/CVE-2016-1000027","https://security.netapp.com/advisory/ntap-20230420-0009/","https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now","https://www.tenable.com/security/research/tra-2016-20"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1000027","description":"Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data."}]},{"artifact":{"id":"840aed725228ca26","cpes":["cpe:2.3:a:apache:commons-fileupload:1.5:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_fileupload:1.5:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.5:*:*:*:*:*:*:*"],"name":"commons-fileupload","purl":"pkg:maven/commons-fileupload/commons-fileupload@1.5","type":"java-archive","version":"1.5","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"commons-fileupload","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/commons-fileupload-1.5.jar","manifestName":"","pomArtifactID":"commons-fileupload","archiveDigests":[{"value":"ad4ad2ab2961b4e1891472bd1a33fabefb0385f3","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/commons-fileupload-1.5.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/commons-fileupload-1.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.6.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vv7r-c36w-3prj","versionConstraint":">=1.0,<1.6.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-fileupload:commons-fileupload","version":"1.5"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vv7r-c36w-3prj","fix":{"state":"fixed","versions":["1.6.0"],"available":[{"date":"2025-07-10","kind":"first-observed","version":"1.6.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48976","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-48976","date":"2026-11-02","epss":0.32877,"percentile":0.98355}],"risk":26.63037,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48976","https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12","https://github.com/apache/commons-fileupload/commit/bf68f63cfb312ef4710fb3dfb4d8e4e1665f4497","http://www.openwall.com/lists/oss-security/2025/06/16/4","https://github.com/apache/tomcat/commit/97790a35a27d236fa053e660676c3f8196284d93","https://github.com/apache/commons-fileupload/commit/b247774a72a044f5d5380ae947140ee80af4e78b","https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vv7r-c36w-3prj","description":"Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers"},"relatedVulnerabilities":[{"id":"CVE-2025-48976","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48976","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-48976","date":"2026-11-02","epss":0.32877,"percentile":0.98355}],"urls":["https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12","http://www.openwall.com/lists/oss-security/2025/06/16/4","https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48976","description":"Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.98"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5j33-cvvr-w245","versionConstraint":">=9.0.0.M1,<9.0.98 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5j33-cvvr-w245","fix":{"state":"fixed","versions":["9.0.98"],"available":[{"date":"2024-12-27","kind":"first-observed","version":"9.0.98"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-50379","cwe":"CWE-367","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-50379","date":"2026-11-02","epss":0.31824,"percentile":0.98301}],"risk":25.459200000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-50379","https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r","https://github.com/apache/tomcat/commit/05ddeeaa54df1e2dc427d0164bedd6b79f78d81f","https://github.com/apache/tomcat/commit/43b507ebac9d268b1ea3d908e296cc6e46795c00","https://github.com/apache/tomcat/commit/631500b0c9b2a2a2abb707e3de2e10a5936e5d41","https://github.com/apache/tomcat/commit/684247ae85fa633b9197b32391de59fc54703842","https://github.com/apache/tomcat/commit/8554f6b1722b33a2ce8b0a3fad37825f3a75f2d2","https://github.com/apache/tomcat/commit/cc7a98b57c6dc1df21979fcff94a36e068f4456c","https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.34","https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.2","https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.98","http://www.openwall.com/lists/oss-security/2024/12/17/4","http://www.openwall.com/lists/oss-security/2024/12/18/2","https://security.netapp.com/advisory/ntap-20250103-0003","https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5j33-cvvr-w245","description":"Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-50379","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-50379","cwe":"CWE-367","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-50379","date":"2026-11-02","epss":0.31824,"percentile":0.98301}],"urls":["https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r","http://www.openwall.com/lists/oss-security/2024/12/17/4","http://www.openwall.com/lists/oss-security/2024/12/18/2","https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html","https://security.netapp.com/advisory/ntap-20250103-0003/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-50379","description":"Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.106"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h3gc-qfqq-6h8f","versionConstraint":">=9.0.0.M1,<=9.0.105 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h3gc-qfqq-6h8f","fix":{"state":"fixed","versions":["9.0.106"],"available":[{"date":"2025-06-17","kind":"first-observed","version":"9.0.106"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48988","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48988","date":"2026-11-02","epss":0.30433,"percentile":0.98235}],"risk":23.73774,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48988","https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18","https://github.com/apache/tomcat/commit/2b0ab14fb55d4edc896e5f1817f2ab76f714ae5e","https://github.com/apache/tomcat/commit/cdde8e655bc1c5c60a07efd216251d77c52fd7f6","https://github.com/apache/tomcat/commit/ee8042ffce4cb9324dfd79efda5984f37bbb6910","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html","http://www.openwall.com/lists/oss-security/2025/06/16/1","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h3gc-qfqq-6h8f","description":"Apache Tomcat - DoS in multipart upload"},"relatedVulnerabilities":[{"id":"CVE-2025-48988","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48988","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48988","date":"2026-11-02","epss":0.30433,"percentile":0.98235}],"urls":["https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18","http://www.openwall.com/lists/oss-security/2025/06/16/1","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48988","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue."}]},{"artifact":{"id":"99a1455465a5319f","cpes":["cpe:2.3:a:apache:velocity:1.6.4-atlassian-26:*:*:*:*:*:*:*"],"name":"velocity","purl":"pkg:maven/org.apache.velocity/velocity@1.6.4-atlassian-26","type":"java-archive","version":"1.6.4-atlassian-26","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.velocity","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/velocity-1.6.4-atlassian-26.jar","manifestName":"","pomArtifactID":"velocity","archiveDigests":[{"value":"75227c46da66c80bb88a374eafa21f03927014f0","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/velocity-1.6.4-atlassian-26.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/velocity-1.6.4-atlassian-26.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-59j4-wjwp-mw9m","versionConstraint":"<=1.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.velocity:velocity","version":"1.6.4-atlassian-26"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-59j4-wjwp-mw9m","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-13936","date":"2026-11-02","epss":0.22709,"percentile":0.97727}],"risk":18.507835,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-13936","https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E","https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a@%3Cuser.velocity.apache.org%3E","https://lists.apache.org/thread.html/r3ea4c4c908505b20a4c268330dfe7188b90c84dcf777728d02068ae6@%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6@%3Ccommits.velocity.apache.org%3E","http://www.openwall.com/lists/oss-security/2021/03/10/1","https://lists.apache.org/thread.html/r0bc98e9cd080b4a13b905c571b9bed87e1a0878d44dbf21487c6cca4@%3Cdev.santuario.apache.org%3E","https://lists.apache.org/thread.html/rbee7270556f4172322936b5ecc9fabf0c09f00d4fa56c9de1963c340@%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/rd2a89e17e8a9b451ce655f1a34117752ea1d18a22ce580d8baa824fd@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rd7e865c87f9043c21d9c1fd9d4df866061d9a08cfc322771160d8058@%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/re641197d204765130618086238c73dd2ce5a3f94b33785b587d72726@%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/re8e7482fe54d289fc0229e61cc64947b63b12c3c312e9f25bf6f3b8c@%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/reab5978b54a9f4c078402161e30a89c42807b198814acadbe6c862c7@%3Cdev.ws.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/03/msg00019.html","https://lists.apache.org/thread.html/r17cb932fab14801b14e5b97a7f05192f4f366ef260c10d4a8dba8ac9@%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/r39de20c7e9c808b1f96790875d33e58c9c0aabb44fd9227e7b3dc5da@%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/r4cd59453b65d4ac290fcb3b71fdf32b4f1f8989025e89558deb5a245@%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/r7f209b837217d2a0fe5977fb692e7f15d37fa5de8214bcdc4c21d9a7@%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/r293284c6806c73f51098001ea86a14271c39f72cd76af9e946d9d9ad@%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/rf7d369de88dc88a1347006a3323b3746d849234db40a8edfd5ebc436@%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328@%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882@%3Cusers.activemq.apache.org%3E","https://security.gentoo.org/glsa/202107-52","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-59j4-wjwp-mw9m","description":"Sandbox Bypass in Apache Velocity Engine"},"relatedVulnerabilities":[{"id":"CVE-2020-13936","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-13936","date":"2026-11-02","epss":0.22709,"percentile":0.97727}],"urls":["http://www.openwall.com/lists/oss-security/2021/03/10/1","https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E","https://lists.apache.org/thread.html/r0bc98e9cd080b4a13b905c571b9bed87e1a0878d44dbf21487c6cca4%40%3Cdev.santuario.apache.org%3E","https://lists.apache.org/thread.html/r17cb932fab14801b14e5b97a7f05192f4f366ef260c10d4a8dba8ac9%40%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/r293284c6806c73f51098001ea86a14271c39f72cd76af9e946d9d9ad%40%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/r39de20c7e9c808b1f96790875d33e58c9c0aabb44fd9227e7b3dc5da%40%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/r3ea4c4c908505b20a4c268330dfe7188b90c84dcf777728d02068ae6%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/r4cd59453b65d4ac290fcb3b71fdf32b4f1f8989025e89558deb5a245%40%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/r7f209b837217d2a0fe5977fb692e7f15d37fa5de8214bcdc4c21d9a7%40%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6%40%3Ccommits.velocity.apache.org%3E","https://lists.apache.org/thread.html/rbee7270556f4172322936b5ecc9fabf0c09f00d4fa56c9de1963c340%40%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/rd2a89e17e8a9b451ce655f1a34117752ea1d18a22ce580d8baa824fd%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rd7e865c87f9043c21d9c1fd9d4df866061d9a08cfc322771160d8058%40%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/re641197d204765130618086238c73dd2ce5a3f94b33785b587d72726%40%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/re8e7482fe54d289fc0229e61cc64947b63b12c3c312e9f25bf6f3b8c%40%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/reab5978b54a9f4c078402161e30a89c42807b198814acadbe6c862c7%40%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/rf7d369de88dc88a1347006a3323b3746d849234db40a8edfd5ebc436%40%3Cdev.ws.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/03/msg00019.html","https://security.gentoo.org/glsa/202107-52","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-13936","description":"An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2."}]},{"artifact":{"id":"7f5afd36e2a50847","cpes":["cpe:2.3:a:curl:curl:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.16"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-2398","versionConstraint":"< 7.81.0-1ubuntu1.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-2398","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.16"],"available":[{"date":"2024-03-27","kind":"advisory","version":"7.81.0-1ubuntu1.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-2398","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-2398","date":"2026-11-02","epss":0.36081,"percentile":0.98474}],"risk":18.0405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2398"},"relatedVulnerabilities":[{"id":"CVE-2024-2398","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2398","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-2398","date":"2026-11-02","epss":0.36081,"percentile":0.98474}],"urls":["http://seclists.org/fulldisclosure/2024/Jul/18","http://seclists.org/fulldisclosure/2024/Jul/19","http://seclists.org/fulldisclosure/2024/Jul/20","http://www.openwall.com/lists/oss-security/2024/03/27/3","https://curl.se/docs/CVE-2024-2398.html","https://curl.se/docs/CVE-2024-2398.json","https://hackerone.com/reports/2402845","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/","https://security.netapp.com/advisory/ntap-20240503-0009/","https://support.apple.com/kb/HT214118","https://support.apple.com/kb/HT214119","https://support.apple.com/kb/HT214120","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-417159.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2398","description":"When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory.  Further, this error condition fails silently and is therefore not easily detected by an application."}]},{"artifact":{"id":"f75f86e9282bbba5","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2398","versionConstraint":"< 7.81.0-1ubuntu1.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-2398","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.16"],"available":[{"date":"2024-03-27","kind":"advisory","version":"7.81.0-1ubuntu1.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-2398","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-2398","date":"2026-11-02","epss":0.36081,"percentile":0.98474}],"risk":18.0405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2398"},"relatedVulnerabilities":[{"id":"CVE-2024-2398","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2398","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-2398","date":"2026-11-02","epss":0.36081,"percentile":0.98474}],"urls":["http://seclists.org/fulldisclosure/2024/Jul/18","http://seclists.org/fulldisclosure/2024/Jul/19","http://seclists.org/fulldisclosure/2024/Jul/20","http://www.openwall.com/lists/oss-security/2024/03/27/3","https://curl.se/docs/CVE-2024-2398.html","https://curl.se/docs/CVE-2024-2398.json","https://hackerone.com/reports/2402845","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/","https://security.netapp.com/advisory/ntap-20240503-0009/","https://support.apple.com/kb/HT214118","https://support.apple.com/kb/HT214119","https://support.apple.com/kb/HT214120","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-417159.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2398","description":"When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory.  Further, this error condition fails silently and is therefore not easily detected by an application."}]},{"artifact":{"id":"eebde1772607afd6","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2398","versionConstraint":"< 7.81.0-1ubuntu1.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-2398","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.16"],"available":[{"date":"2024-03-27","kind":"advisory","version":"7.81.0-1ubuntu1.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-2398","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-2398","date":"2026-11-02","epss":0.36081,"percentile":0.98474}],"risk":18.0405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2398"},"relatedVulnerabilities":[{"id":"CVE-2024-2398","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2398","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-2398","date":"2026-11-02","epss":0.36081,"percentile":0.98474}],"urls":["http://seclists.org/fulldisclosure/2024/Jul/18","http://seclists.org/fulldisclosure/2024/Jul/19","http://seclists.org/fulldisclosure/2024/Jul/20","http://www.openwall.com/lists/oss-security/2024/03/27/3","https://curl.se/docs/CVE-2024-2398.html","https://curl.se/docs/CVE-2024-2398.json","https://hackerone.com/reports/2402845","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/","https://security.netapp.com/advisory/ntap-20240503-0009/","https://support.apple.com/kb/HT214118","https://support.apple.com/kb/HT214119","https://support.apple.com/kb/HT214120","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-417159.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2398","description":"When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory.  Further, this error condition fails silently and is therefore not easily detected by an application."}]},{"artifact":{"id":"6c6ae95c8b3d93fb","cpes":["cpe:2.3:a:libcurl4-gnutls-dev:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4-gnutls-dev:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls_dev:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls_dev:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4-gnutls:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4-gnutls:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl4-gnutls-dev","purl":"pkg:deb/ubuntu/libcurl4-gnutls-dev@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4-gnutls-dev/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libcurl4-gnutls-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4-gnutls-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libcurl4-gnutls-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2398","versionConstraint":"< 7.81.0-1ubuntu1.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-2398","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.16"],"available":[{"date":"2024-03-27","kind":"advisory","version":"7.81.0-1ubuntu1.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-2398","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-2398","date":"2026-11-02","epss":0.36081,"percentile":0.98474}],"risk":18.0405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2398"},"relatedVulnerabilities":[{"id":"CVE-2024-2398","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2398","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-2398","date":"2026-11-02","epss":0.36081,"percentile":0.98474}],"urls":["http://seclists.org/fulldisclosure/2024/Jul/18","http://seclists.org/fulldisclosure/2024/Jul/19","http://seclists.org/fulldisclosure/2024/Jul/20","http://www.openwall.com/lists/oss-security/2024/03/27/3","https://curl.se/docs/CVE-2024-2398.html","https://curl.se/docs/CVE-2024-2398.json","https://hackerone.com/reports/2402845","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/","https://security.netapp.com/advisory/ntap-20240503-0009/","https://support.apple.com/kb/HT214118","https://support.apple.com/kb/HT214119","https://support.apple.com/kb/HT214120","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-417159.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2398","description":"When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory.  Further, this error condition fails silently and is therefore not easily detected by an application."}]},{"artifact":{"id":"99eab8abc4efa46b","cpes":["cpe:2.3:a:org.springframework:spring-webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring-webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring_webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring-webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring_webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_webmvc:5.3.31:*:*:*:*:*:*:*"],"name":"spring-webmvc","purl":"pkg:maven/org.springframework/spring-webmvc@5.3.31","type":"java-archive","version":"5.3.31","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-webmvc-5.3.31.jar","manifestName":"","pomArtifactID":"spring-webmvc","archiveDigests":[{"value":"45754d056effe8257a012f6b98ed5454cf1e8960","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-webmvc-5.3.31.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-webmvc-5.3.31.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cx7f-g6mp-7hqm","versionConstraint":">=5.3.0,<=5.3.39 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-webmvc","version":"5.3.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cx7f-g6mp-7hqm","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38816","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-38816","date":"2026-11-02","epss":0.21263,"percentile":0.97597}],"risk":15.947250000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-38816","https://spring.io/security/cve-2024-38816","https://github.com/spring-projects/spring-framework/commit/d86bf8b2056429edf5494456cffcb2b243331c49","https://security.netapp.com/advisory/ntap-20241227-0001"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cx7f-g6mp-7hqm","description":"Path traversal vulnerability in functional web frameworks"},"relatedVulnerabilities":[{"id":"CVE-2024-38816","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38816","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-38816","date":"2026-11-02","epss":0.21263,"percentile":0.97597}],"urls":["https://spring.io/security/cve-2024-38816","https://security.netapp.com/advisory/ntap-20241227-0001/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-38816","description":"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.\n\nSpecifically, an application is vulnerable when both of the following are true:\n\n  *  the web application uses RouterFunctions to serve static resources\n  *  resource handling is explicitly configured with a FileSystemResource location\n\n\nHowever, malicious requests are blocked and rejected when any of the following is true:\n\n  *  the  Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html  is in use\n  *  the application runs on Tomcat or Jetty"}]},{"artifact":{"id":"0fc5ab4c86eb7ea7","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/ubuntu/libssl-dev@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2511","versionConstraint":"< 3.0.2-0ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-2511","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.17"],"available":[{"date":"2024-07-31","kind":"advisory","version":"3.0.2-0ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-11-02","epss":0.52421,"percentile":0.98964}],"risk":15.726299999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2511"},"relatedVulnerabilities":[{"id":"CVE-2024-2511","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-11-02","epss":0.52421,"percentile":0.98964}],"urls":["https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce","https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d","https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08","https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640","https://www.openssl.org/news/secadv/20240408.txt","http://www.openwall.com/lists/oss-security/2024/04/08/5","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240503-0013/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-354112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2511","description":"Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue."}]},{"artifact":{"id":"080c8716011e8bcc","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2511","versionConstraint":"< 3.0.2-0ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-2511","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.17"],"available":[{"date":"2024-07-31","kind":"advisory","version":"3.0.2-0ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-11-02","epss":0.52421,"percentile":0.98964}],"risk":15.726299999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2511"},"relatedVulnerabilities":[{"id":"CVE-2024-2511","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-11-02","epss":0.52421,"percentile":0.98964}],"urls":["https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce","https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d","https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08","https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640","https://www.openssl.org/news/secadv/20240408.txt","http://www.openwall.com/lists/oss-security/2024/04/08/5","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240503-0013/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-354112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2511","description":"Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue."}]},{"artifact":{"id":"e6933be022de0634","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.17"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-2511","versionConstraint":"< 3.0.2-0ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-2511","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.17"],"available":[{"date":"2024-07-31","kind":"advisory","version":"3.0.2-0ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-11-02","epss":0.52421,"percentile":0.98964}],"risk":15.726299999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2511"},"relatedVulnerabilities":[{"id":"CVE-2024-2511","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-11-02","epss":0.52421,"percentile":0.98964}],"urls":["https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce","https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d","https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08","https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640","https://www.openssl.org/news/secadv/20240408.txt","http://www.openwall.com/lists/oss-security/2024/04/08/5","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240503-0013/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-354112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2511","description":"Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.86"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7w75-32cg-r6g2","versionConstraint":">=9.0.0-M1,<=9.0.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7w75-32cg-r6g2","fix":{"state":"fixed","versions":["9.0.86"],"available":[{"date":"2024-03-16","kind":"first-observed","version":"9.0.86"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-24549","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-24549","date":"2026-11-02","epss":0.23072,"percentile":0.97759}],"risk":13.90088,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-24549","https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg","https://github.com/apache/tomcat/commit/0cac540a882220231ba7a82330483cbd5f6b1f96","https://github.com/apache/tomcat/commit/810f49d5ff6d64b704af85d5b8d0aab9ec3c83f5","https://github.com/apache/tomcat/commit/8e03be9f2698f2da9027d40b9e9c0c9429b74dc0","https://github.com/apache/tomcat/commit/d07c82194edb69d99b438828fe2cbfadbb207843","https://security.netapp.com/advisory/ntap-20240402-0002","https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html","http://www.openwall.com/lists/oss-security/2024/03/13/3","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7w75-32cg-r6g2","description":"Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests"},"relatedVulnerabilities":[{"id":"CVE-2024-24549","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-24549","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-24549","date":"2026-11-02","epss":0.23072,"percentile":0.97759}],"urls":["https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg","http://www.openwall.com/lists/oss-security/2024/03/13/3","https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55/","https://security.netapp.com/advisory/ntap-20240402-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-24549","description":"Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue."}]},{"artifact":{"id":"7f5afd36e2a50847","cpes":["cpe:2.3:a:curl:curl:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.17"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-7264","versionConstraint":"< 7.81.0-1ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.17"],"available":[{"date":"2024-08-05","kind":"advisory","version":"7.81.0-1ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-02","epss":0.20217,"percentile":0.97465}],"risk":10.1085,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7264"},"relatedVulnerabilities":[{"id":"CVE-2024-7264","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-02","epss":0.20217,"percentile":0.97465}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."}]},{"artifact":{"id":"f75f86e9282bbba5","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7264","versionConstraint":"< 7.81.0-1ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.17"],"available":[{"date":"2024-08-05","kind":"advisory","version":"7.81.0-1ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-02","epss":0.20217,"percentile":0.97465}],"risk":10.1085,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7264"},"relatedVulnerabilities":[{"id":"CVE-2024-7264","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-02","epss":0.20217,"percentile":0.97465}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."}]},{"artifact":{"id":"eebde1772607afd6","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7264","versionConstraint":"< 7.81.0-1ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.17"],"available":[{"date":"2024-08-05","kind":"advisory","version":"7.81.0-1ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-02","epss":0.20217,"percentile":0.97465}],"risk":10.1085,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7264"},"relatedVulnerabilities":[{"id":"CVE-2024-7264","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-02","epss":0.20217,"percentile":0.97465}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."}]},{"artifact":{"id":"6c6ae95c8b3d93fb","cpes":["cpe:2.3:a:libcurl4-gnutls-dev:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4-gnutls-dev:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls_dev:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls_dev:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4-gnutls:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4-gnutls:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl4-gnutls-dev","purl":"pkg:deb/ubuntu/libcurl4-gnutls-dev@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4-gnutls-dev/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libcurl4-gnutls-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4-gnutls-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libcurl4-gnutls-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7264","versionConstraint":"< 7.81.0-1ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.17"],"available":[{"date":"2024-08-05","kind":"advisory","version":"7.81.0-1ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-02","epss":0.20217,"percentile":0.97465}],"risk":10.1085,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7264"},"relatedVulnerabilities":[{"id":"CVE-2024-7264","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-02","epss":0.20217,"percentile":0.97465}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."}]},{"artifact":{"id":"fb7895faf09fd4e5","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.19.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.2-2ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-3596","versionConstraint":"< 1.19.2-2ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-3596","fix":{"state":"fixed","versions":["1.19.2-2ubuntu0.5"],"available":[{"date":"2025-02-05","kind":"advisory","version":"1.19.2-2ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"risk":7.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-3596"},"relatedVulnerabilities":[{"id":"CVE-2024-3596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/09/4","https://cert-portal.siemens.com/productcert/html/ssa-723487.html","https://cert-portal.siemens.com/productcert/html/ssa-794185.html","https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/","https://datatracker.ietf.org/doc/html/rfc2865","https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014","https://www.blastradius.fail/","https://security.netapp.com/advisory/ntap-20240822-0001/","https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol","https://www.kb.cert.org/vuls/id/456537","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-770770.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-3596","description":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature."}]},{"artifact":{"id":"33db6cef15da892e","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.19.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.2-2ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-3596","versionConstraint":"< 1.19.2-2ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-3596","fix":{"state":"fixed","versions":["1.19.2-2ubuntu0.5"],"available":[{"date":"2025-02-05","kind":"advisory","version":"1.19.2-2ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"risk":7.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-3596"},"relatedVulnerabilities":[{"id":"CVE-2024-3596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/09/4","https://cert-portal.siemens.com/productcert/html/ssa-723487.html","https://cert-portal.siemens.com/productcert/html/ssa-794185.html","https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/","https://datatracker.ietf.org/doc/html/rfc2865","https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014","https://www.blastradius.fail/","https://security.netapp.com/advisory/ntap-20240822-0001/","https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol","https://www.kb.cert.org/vuls/id/456537","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-770770.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-3596","description":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature."}]},{"artifact":{"id":"8baf93711e927f68","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.19.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.2-2ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-3596","versionConstraint":"< 1.19.2-2ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-3596","fix":{"state":"fixed","versions":["1.19.2-2ubuntu0.5"],"available":[{"date":"2025-02-05","kind":"advisory","version":"1.19.2-2ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"risk":7.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-3596"},"relatedVulnerabilities":[{"id":"CVE-2024-3596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/09/4","https://cert-portal.siemens.com/productcert/html/ssa-723487.html","https://cert-portal.siemens.com/productcert/html/ssa-794185.html","https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/","https://datatracker.ietf.org/doc/html/rfc2865","https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014","https://www.blastradius.fail/","https://security.netapp.com/advisory/ntap-20240822-0001/","https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol","https://www.kb.cert.org/vuls/id/456537","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-770770.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-3596","description":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature."}]},{"artifact":{"id":"6e90bedd237fee0a","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.19.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.2-2ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-3596","versionConstraint":"< 1.19.2-2ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-3596","fix":{"state":"fixed","versions":["1.19.2-2ubuntu0.5"],"available":[{"date":"2025-02-05","kind":"advisory","version":"1.19.2-2ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"risk":7.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-3596"},"relatedVulnerabilities":[{"id":"CVE-2024-3596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/09/4","https://cert-portal.siemens.com/productcert/html/ssa-723487.html","https://cert-portal.siemens.com/productcert/html/ssa-794185.html","https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/","https://datatracker.ietf.org/doc/html/rfc2865","https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014","https://www.blastradius.fail/","https://security.netapp.com/advisory/ntap-20240822-0001/","https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol","https://www.kb.cert.org/vuls/id/456537","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-770770.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-3596","description":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.98"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-27hp-xhwr-wr2m","versionConstraint":">=9.0.0.M1,<9.0.98 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-27hp-xhwr-wr2m","fix":{"state":"fixed","versions":["9.0.98"],"available":[{"date":"2025-01-09","kind":"first-observed","version":"9.0.98"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56337","cwe":"CWE-367","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-56337","date":"2026-11-02","epss":0.08969,"percentile":0.95259}],"risk":6.5922149999999995,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-56337","https://lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp","https://www.cve.org/CVERecord?id=CVE-2024-50379","https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.34","https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.2","https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.98","https://security.netapp.com/advisory/ntap-20250103-0002","https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-27hp-xhwr-wr2m","description":"Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-56337","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56337","cwe":"CWE-367","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-56337","date":"2026-11-02","epss":0.08969,"percentile":0.95259}],"urls":["https://lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp","https://www.cve.org/CVERecord?id=CVE-2024-50379","https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html","https://security.netapp.com/advisory/ntap-20250103-0002/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56337","description":"Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nThe mitigation for CVE-2024-50379 was incomplete.\n\nUsers running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation \nparameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:\n- running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true)\n- running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false)\n- running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed)\n\nTomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can."}]},{"artifact":{"id":"27734de04ac063af","cpes":["cpe:2.3:a:org.postgresql.osgi.PGBundleActivator:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql-global-development-group:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql_global_development_group:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.osgi.PGBundleActivator:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql-global-development-group:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql_global_development_group:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.osgi.PGBundleActivator:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.osgi.PGBundleActivator:osgi:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql-global-development-group:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql-global-development-group:osgi:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql_global_development_group:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql_global_development_group:osgi:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.jdbc:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle-corporation:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle_corporation:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:PGBundleActivator:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.jdbc:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle-corporation:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle_corporation:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:PGBundleActivator:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.jdbc:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.jdbc:osgi:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle-corporation:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle-corporation:osgi:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle_corporation:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle_corporation:osgi:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:PGBundleActivator:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:PGBundleActivator:osgi:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:osgi:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql:osgi:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:osgi:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql:osgi:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:osgi:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:osgi:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:osgi:osgi:42.6.0:*:*:*:*:*:*:*"],"name":"postgresql","purl":"pkg:maven/org.postgresql/postgresql@42.6.0","type":"java-archive","version":"42.6.0","language":"java","licenses":["BSD-2-Clause"],"metadata":{"pomGroupID":"org.postgresql","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/postgresql-42.6.0.jar","manifestName":"","pomArtifactID":"postgresql","archiveDigests":[{"value":"7614cfce466145b84972781ab0079b8dea49e363","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/postgresql-42.6.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/postgresql-42.6.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"42.6.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-24rp-q3w6-vc56","versionConstraint":">=42.6.0,<42.6.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.postgresql:postgresql","version":"42.6.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-24rp-q3w6-vc56","fix":{"state":"fixed","versions":["42.6.1"],"available":[{"date":"2024-02-22","kind":"first-observed","version":"42.6.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1597","cwe":"CWE-89","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"},{"cve":"CVE-2024-1597","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-1597","date":"2026-11-02","epss":0.0481,"percentile":0.91963}],"risk":4.5695,"urls":["https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56","https://nvd.nist.gov/vuln/detail/CVE-2024-1597","https://github.com/pgjdbc/pgjdbc/commit/06abfb78a627277a580d4df825f210e96a4e14ee","https://github.com/pgjdbc/pgjdbc/commit/93b0fcb2711d9c1e3a2a03134369738a02a58b40"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-24rp-q3w6-vc56","description":"org.postgresql:postgresql vulnerable to SQL Injection via line comment generation"},"relatedVulnerabilities":[{"id":"CVE-2024-1597","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1597","cwe":"CWE-89","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"},{"cve":"CVE-2024-1597","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-1597","date":"2026-11-02","epss":0.0481,"percentile":0.91963}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/02/6","https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56","https://lists.debian.org/debian-lts-announce/2024/05/msg00007.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TZQTSMESZD2RJ5XBPSXH3TIQVUW5DIUU/","https://security.netapp.com/advisory/ntap-20240419-0008/","https://www.enterprisedb.com/docs/jdbc_connector/latest/01_jdbc_rel_notes/","https://www.enterprisedb.com/docs/security/assessments/cve-2024-1597/","https://lists.debian.org/debian-lts-announce/2024/12/msg00017.html","https://www.sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-1597","description":"pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.109"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vfww-5hm6-hx2j","versionConstraint":">=9.0.40,<9.0.109 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vfww-5hm6-hx2j","fix":{"state":"fixed","versions":["9.0.109"],"available":[{"date":"2025-10-29","kind":"first-observed","version":"9.0.109"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55754","cwe":"CWE-150","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-55754","date":"2026-11-02","epss":0.10173,"percentile":0.95662}],"risk":4.5015525,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-55754","https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqd","https://github.com/apache/tomcat/commit/138d7f5cfaae683078948303333c080e6faa75d2","https://github.com/apache/tomcat/commit/5a3db092982c0c58d4855304167ee757fe5e79bb","https://github.com/apache/tomcat/commit/a03cabf3a36a42d27d8d997ed31f034f50ba6cd5","https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.45","https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.11","https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.109","http://www.openwall.com/lists/oss-security/2025/10/27/5","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vfww-5hm6-hx2j","description":"Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences"},"relatedVulnerabilities":[{"id":"CVE-2025-55754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55754","cwe":"CWE-150","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-55754","date":"2026-11-02","epss":0.10173,"percentile":0.95662}],"urls":["https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqd","http://www.openwall.com/lists/oss-security/2025/10/27/5","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55754","description":"Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat.\n\nTomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue."}]},{"artifact":{"id":"19949061aabcc871","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:8.9p1-3ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:8.9p1-3ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:8.9p1-3ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:8.9p1-3ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:8.9p1-3ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:8.9p1-3ubuntu0.6:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A8.9p1-3ubuntu0.6?arch=amd64&distro=ubuntu-22.04&upstream=openssh","type":"deb","version":"1:8.9p1-3ubuntu0.6","language":"","licenses":["BSD-2-clause","BSD-3-clause","Expat-with-advertising-restriction","Mazieres-BSD-style","OpenSSH","Powell-BSD-style","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.preinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.preinst"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:8.9p1-3ubuntu0.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-26465","versionConstraint":"< 1:8.9p1-3ubuntu0.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssh","version":"1:8.9p1-3ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-26465","fix":{"state":"fixed","versions":["1:8.9p1-3ubuntu0.11"],"available":[{"date":"2025-02-18","kind":"advisory","version":"1:8.9p1-3ubuntu0.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-26465","cwe":"CWE-390","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-26465","date":"2026-11-02","epss":0.07723,"percentile":0.94619}],"risk":3.8614999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-26465"},"relatedVulnerabilities":[{"id":"CVE-2025-26465","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-26465","cwe":"CWE-390","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-26465","date":"2026-11-02","epss":0.07723,"percentile":0.94619}],"urls":["https://access.redhat.com/errata/RHSA-2025:16823","https://access.redhat.com/errata/RHSA-2025:3837","https://access.redhat.com/errata/RHSA-2025:6993","https://access.redhat.com/errata/RHSA-2025:8385","https://access.redhat.com/security/cve/CVE-2025-26465","https://access.redhat.com/solutions/7109879","https://bugzilla.redhat.com/show_bug.cgi?id=2344780","https://seclists.org/oss-sec/2025/q1/144","http://seclists.org/fulldisclosure/2025/Feb/18","http://seclists.org/fulldisclosure/2025/May/7","http://seclists.org/fulldisclosure/2025/May/8","https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466","https://bugzilla.suse.com/show_bug.cgi?id=1237040","https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig","https://lists.debian.org/debian-lts-announce/2025/02/msg00020.html","https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-February/000161.html","https://security-tracker.debian.org/tracker/CVE-2025-26465","https://security.netapp.com/advisory/ntap-20250228-0003/","https://ubuntu.com/security/CVE-2025-26465","https://www.openssh.com/releasenotes.html#9.9p2","https://www.openwall.com/lists/oss-security/2025/02/18/1","https://www.openwall.com/lists/oss-security/2025/02/18/4","https://www.theregister.com/2025/02/18/openssh_vulnerabilities_mitm_dos/","https://www.vicarius.io/vsociety/posts/cve-2025-26465-detect-vulnerable-openssh","https://www.vicarius.io/vsociety/posts/cve-2025-26465-mitigate-vulnerable-openssh","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-26465","description":"A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.90"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wm9w-rjj3-j356","versionConstraint":">=9.0.0-M1,<9.0.90 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wm9w-rjj3-j356","fix":{"state":"fixed","versions":["9.0.90"],"available":[{"date":"2024-07-06","kind":"first-observed","version":"9.0.90"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-34750","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2024-34750","cwe":"CWE-755","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-34750","date":"2026-11-02","epss":0.04602,"percentile":0.91667}],"risk":3.58956,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-34750","https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l","https://github.com/apache/tomcat/commit/2344a4c0d03e307ba6b8ab6dc8b894cc8bac63f2","https://github.com/apache/tomcat/commit/2afae300c9ac9c0e516e2e9de580847d925365c3","https://github.com/apache/tomcat/commit/9fec9a82887853402833a80b584e3762c7423f5f","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html","https://security.netapp.com/advisory/ntap-20240816-0004","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wm9w-rjj3-j356","description":"Apache Tomcat - Denial of Service"},"relatedVulnerabilities":[{"id":"CVE-2024-34750","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-34750","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2024-34750","cwe":"CWE-755","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-34750","date":"2026-11-02","epss":0.04602,"percentile":0.91667}],"urls":["https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html","https://security.netapp.com/advisory/ntap-20240816-0004/","https://github.com/apache/tomcat/commit/2344a4c0d03e307ba6b8ab6dc8b894cc8bac63f2","https://github.com/apache/tomcat/commit/2afae300c9ac9c0e516e2e9de580847d925365c3","https://github.com/apache/tomcat/commit/9fec9a82887853402833a80b584e3762c7423f5f"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-34750","description":"Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue."}]},{"artifact":{"id":"7bccd4346e7df4e4","cpes":["cpe:2.3:a:org.springframework:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring_web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring_web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_web:5.3.31:*:*:*:*:*:*:*"],"name":"spring-web","purl":"pkg:maven/org.springframework/spring-web@5.3.31","type":"java-archive","version":"5.3.31","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-web-5.3.31.jar","manifestName":"","pomArtifactID":"spring-web","archiveDigests":[{"value":"3bf73c385a1f2f4a0d482149d6a205e854cec497","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-web-5.3.31.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-web-5.3.31.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.3.32"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-ccgv-vj62-xf9h","versionConstraint":">=5.3.0,<5.3.32 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-web","version":"5.3.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-ccgv-vj62-xf9h","fix":{"state":"fixed","versions":["5.3.32"],"available":[{"date":"2024-02-25","kind":"first-observed","version":"5.3.32"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-22243","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-22243","date":"2026-11-02","epss":0.03967,"percentile":0.90459}],"risk":3.09426,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-22243","https://spring.io/security/cve-2024-22243","https://github.com/spring-projects/spring-framework/blob/main/spring-web/src/main/java/org/springframework/web/util/UriComponentsBuilder.java","https://security.netapp.com/advisory/ntap-20240524-0001","http://seclists.org/fulldisclosure/2024/Sep/24"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-ccgv-vj62-xf9h","description":"Spring Web vulnerable to Open Redirect or Server Side Request Forgery"},"relatedVulnerabilities":[{"id":"CVE-2024-22243","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-22243","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-22243","date":"2026-11-02","epss":0.03967,"percentile":0.90459}],"urls":["https://security.netapp.com/advisory/ntap-20240524-0001/","https://spring.io/security/cve-2024-22243","http://seclists.org/fulldisclosure/2024/Sep/24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-22243","description":"Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a  open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks."}]},{"artifact":{"id":"cfcd897335b16121","cpes":["cpe:2.3:a:apache:avro:1.11.3:*:*:*:*:*:*:*"],"name":"avro","purl":"pkg:maven/org.apache.avro/avro@1.11.3","type":"java-archive","version":"1.11.3","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.avro","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar:org.apache.avro:avro","manifestName":"","pomArtifactID":"avro","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7pg-v2c8-mfg3","versionConstraint":"<1.11.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.avro:avro","version":"1.11.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r7pg-v2c8-mfg3","fix":{"state":"fixed","versions":["1.11.4"],"available":[{"date":"2024-10-09","kind":"first-observed","version":"1.11.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47561","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-47561","date":"2026-11-02","epss":0.03256,"percentile":0.88355}],"risk":3.0199399999999996,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-47561","https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x","https://github.com/apache/avro/pull/2934","https://github.com/apache/avro/pull/2980","https://github.com/apache/avro/commit/8f89868d29272e3afea2ff8de8c85cb81a57d900","https://github.com/apache/avro/commit/f6b3bd7e50e6e09fedddb98c61558c022ba31285","https://issues.apache.org/jira/browse/AVRO-3985","https://thehackernews.com/2024/10/critical-apache-avro-sdk-flaw-allows.html","https://www.openwall.com/lists/oss-security/2024/10/03/1","https://security.netapp.com/advisory/ntap-20241011-0003","http://www.openwall.com/lists/oss-security/2024/10/03/1"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7pg-v2c8-mfg3","description":"Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)"},"relatedVulnerabilities":[{"id":"CVE-2024-47561","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47561","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-47561","date":"2026-11-02","epss":0.03256,"percentile":0.88355}],"urls":["https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x","http://www.openwall.com/lists/oss-security/2024/10/03/1","https://security.netapp.com/advisory/ntap-20241011-0003/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47561","description":"Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code.\nUsers are recommended to upgrade to version 1.11.4  or 1.12.0, which fix this issue."}]},{"artifact":{"id":"0fc5ab4c86eb7ea7","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/ubuntu/libssl-dev@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.25"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45447","versionConstraint":"< 3.0.2-0ubuntu1.25 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-45447","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.25"],"available":[{"date":"2026-06-09","kind":"advisory","version":"3.0.2-0ubuntu1.25"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-11-02","epss":0.04002,"percentile":0.90539}],"risk":3.0015,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45447"},"relatedVulnerabilities":[{"id":"CVE-2026-45447","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-11-02","epss":0.04002,"percentile":0.90539}],"urls":["https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c","https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8","https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54","https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c","https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e","https://openssl-library.org/news/secadv/20260609.txt","https://access.redhat.com/errata/RHSA-2026:25237","https://access.redhat.com/errata/RHSA-2026:25239","https://access.redhat.com/errata/RHSA-2026:26275","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:34102","https://access.redhat.com/errata/RHSA-2026:35869","https://access.redhat.com/errata/RHSA-2026:36215","https://access.redhat.com/errata/RHSA-2026:36217","https://access.redhat.com/errata/RHSA-2026:39009","https://access.redhat.com/errata/RHSA-2026:39012","https://access.redhat.com/errata/RHSA-2026:39981","https://access.redhat.com/errata/RHSA-2026:44438","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:58563","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:66524","https://access.redhat.com/security/cve/CVE-2026-45447","https://bugzilla.redhat.com/show_bug.cgi?id=2481898","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45447","description":"Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"080c8716011e8bcc","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.25"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45447","versionConstraint":"< 3.0.2-0ubuntu1.25 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-45447","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.25"],"available":[{"date":"2026-06-09","kind":"advisory","version":"3.0.2-0ubuntu1.25"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-11-02","epss":0.04002,"percentile":0.90539}],"risk":3.0015,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45447"},"relatedVulnerabilities":[{"id":"CVE-2026-45447","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-11-02","epss":0.04002,"percentile":0.90539}],"urls":["https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c","https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8","https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54","https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c","https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e","https://openssl-library.org/news/secadv/20260609.txt","https://access.redhat.com/errata/RHSA-2026:25237","https://access.redhat.com/errata/RHSA-2026:25239","https://access.redhat.com/errata/RHSA-2026:26275","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:34102","https://access.redhat.com/errata/RHSA-2026:35869","https://access.redhat.com/errata/RHSA-2026:36215","https://access.redhat.com/errata/RHSA-2026:36217","https://access.redhat.com/errata/RHSA-2026:39009","https://access.redhat.com/errata/RHSA-2026:39012","https://access.redhat.com/errata/RHSA-2026:39981","https://access.redhat.com/errata/RHSA-2026:44438","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:58563","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:66524","https://access.redhat.com/security/cve/CVE-2026-45447","https://bugzilla.redhat.com/show_bug.cgi?id=2481898","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45447","description":"Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"e6933be022de0634","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.25"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-45447","versionConstraint":"< 3.0.2-0ubuntu1.25 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-45447","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.25"],"available":[{"date":"2026-06-09","kind":"advisory","version":"3.0.2-0ubuntu1.25"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-11-02","epss":0.04002,"percentile":0.90539}],"risk":3.0015,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45447"},"relatedVulnerabilities":[{"id":"CVE-2026-45447","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-11-02","epss":0.04002,"percentile":0.90539}],"urls":["https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c","https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8","https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54","https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c","https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e","https://openssl-library.org/news/secadv/20260609.txt","https://access.redhat.com/errata/RHSA-2026:25237","https://access.redhat.com/errata/RHSA-2026:25239","https://access.redhat.com/errata/RHSA-2026:26275","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:34102","https://access.redhat.com/errata/RHSA-2026:35869","https://access.redhat.com/errata/RHSA-2026:36215","https://access.redhat.com/errata/RHSA-2026:36217","https://access.redhat.com/errata/RHSA-2026:39009","https://access.redhat.com/errata/RHSA-2026:39012","https://access.redhat.com/errata/RHSA-2026:39981","https://access.redhat.com/errata/RHSA-2026:44438","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:58563","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:66524","https://access.redhat.com/security/cve/CVE-2026-45447","https://bugzilla.redhat.com/show_bug.cgi?id=2481898","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45447","description":"Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.108"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gqp3-2cvr-x8m3","versionConstraint":">=9.0.0.M1,<9.0.108 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gqp3-2cvr-x8m3","fix":{"state":"fixed","versions":["9.0.108"],"available":[{"date":"2025-08-23","kind":"first-observed","version":"9.0.108"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48989","cwe":"CWE-404","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48989","date":"2026-11-02","epss":0.03686,"percentile":0.89695}],"risk":2.7644999999999995,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48989","https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf","https://github.com/apache/tomcat/commit/73c04a10395774bda71a0b37802cf983662ce255","https://github.com/apache/tomcat/commit/f362c8eb3b8ec5b7f312f7f5610731c0fb299a06","https://github.com/apache/tomcat/commit/f36b8a4eea4ce8a0bc035079e1d259d29f5eb7bf","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html","https://www.kb.cert.org/vuls/id/767506","http://www.openwall.com/lists/oss-security/2025/08/13/2","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gqp3-2cvr-x8m3","description":"Apache Tomcat Improper Resource Shutdown or Release vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-48989","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48989","cwe":"CWE-404","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48989","date":"2026-11-02","epss":0.03686,"percentile":0.89695}],"urls":["https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf","http://www.openwall.com/lists/oss-security/2025/08/13/2","https://www.kb.cert.org/vuls/id/767506","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48989","description":"Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue."}]},{"artifact":{"id":"27734de04ac063af","cpes":["cpe:2.3:a:org.postgresql.osgi.PGBundleActivator:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql-global-development-group:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql_global_development_group:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.osgi.PGBundleActivator:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql-global-development-group:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql_global_development_group:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.osgi.PGBundleActivator:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.osgi.PGBundleActivator:osgi:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql-global-development-group:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql-global-development-group:osgi:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql_global_development_group:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql_global_development_group:osgi:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.jdbc:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle-corporation:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle_corporation:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:PGBundleActivator:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.jdbc:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle-corporation:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle_corporation:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:PGBundleActivator:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.jdbc:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.jdbc:osgi:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle-corporation:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle-corporation:osgi:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle_corporation:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle_corporation:osgi:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:PGBundleActivator:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:PGBundleActivator:osgi:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:osgi:PGBundleActivator:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql:osgi:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:osgi:postgresql:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql:osgi:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:osgi:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:osgi:jdbc:42.6.0:*:*:*:*:*:*:*","cpe:2.3:a:osgi:osgi:42.6.0:*:*:*:*:*:*:*"],"name":"postgresql","purl":"pkg:maven/org.postgresql/postgresql@42.6.0","type":"java-archive","version":"42.6.0","language":"java","licenses":["BSD-2-Clause"],"metadata":{"pomGroupID":"org.postgresql","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/postgresql-42.6.0.jar","manifestName":"","pomArtifactID":"postgresql","archiveDigests":[{"value":"7614cfce466145b84972781ab0079b8dea49e363","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/postgresql-42.6.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/postgresql-42.6.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"42.7.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-98qh-xjc8-98pq","versionConstraint":">=42.2.0,<42.7.11 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.postgresql:postgresql","version":"42.6.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-98qh-xjc8-98pq","fix":{"state":"fixed","versions":["42.7.11"],"available":[{"date":"2026-05-06","kind":"first-observed","version":"42.7.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42198","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42198","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42198","date":"2026-11-02","epss":0.03261,"percentile":0.88374}],"risk":2.44575,"urls":["https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq","https://nvd.nist.gov/vuln/detail/CVE-2026-42198","https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-98qh-xjc8-98pq","description":"pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42198","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42198","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42198","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42198","date":"2026-11-02","epss":0.03261,"percentile":0.88374}],"urls":["https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11","https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq","https://access.redhat.com/errata/RHSA-2026:19098","https://access.redhat.com/errata/RHSA-2026:22304","https://access.redhat.com/errata/RHSA-2026:24348","https://access.redhat.com/errata/RHSA-2026:25030","https://access.redhat.com/errata/RHSA-2026:52928","https://access.redhat.com/errata/RHSA-2026:52929","https://access.redhat.com/errata/RHSA-2026:52930","https://access.redhat.com/errata/RHSA-2026:52978","https://access.redhat.com/errata/RHSA-2026:54532","https://access.redhat.com/errata/RHSA-2026:59277","https://access.redhat.com/errata/RHSA-2026:59278","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42198","https://bugzilla.redhat.com/show_bug.cgi?id=2463857","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42198.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42198","description":"pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11."}]},{"artifact":{"id":"8ec9b79d1dbc0435","cpes":["cpe:2.3:a:com.google.protobuf:protobuf-java:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:com.google.protobuf:protobuf_java:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:com.google.protobuf:protobuf:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:protobuf-java:protobuf-java:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:protobuf-java:protobuf_java:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:protobuf_java:protobuf-java:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:protobuf_java:protobuf_java:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:protobuf-java:protobuf:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:protobuf:protobuf-java:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:protobuf:protobuf_java:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:protobuf_java:protobuf:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:google:protobuf-java:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:google:protobuf_java:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:protobuf:protobuf:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:google:protobuf:3.23.4:*:*:*:*:*:*:*"],"name":"protobuf-java","purl":"pkg:maven/com.google.protobuf/protobuf-java@3.23.4","type":"java-archive","version":"3.23.4","language":"java","licenses":["https://opensource.org/licenses/BSD-3-Clause"],"metadata":{"pomGroupID":"com.google.protobuf","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/protobuf-java-3.23.4.jar","manifestName":"","pomArtifactID":"protobuf-java","archiveDigests":[{"value":"5cc1be17aed4e1e396c6b5359518f369a42ebc37","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/protobuf-java-3.23.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.25.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-735f-pc8j-v9w8","versionConstraint":"<3.25.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.google.protobuf:protobuf-java","version":"3.23.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-735f-pc8j-v9w8","fix":{"state":"fixed","versions":["3.25.5"],"available":[{"date":"2024-09-20","kind":"first-observed","version":"3.25.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7254","cwe":"CWE-400","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2024-7254","cwe":"CWE-674","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2024-7254","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7254","date":"2026-11-02","epss":0.02772,"percentile":0.86334}],"risk":2.16216,"urls":["https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8","https://nvd.nist.gov/vuln/detail/CVE-2024-7254","https://github.com/protocolbuffers/protobuf/commit/4728531c162f2f9e8c2ca1add713cfee2db6be3b","https://github.com/protocolbuffers/protobuf/commit/850fcce9176e2c9070614dab53537760498c926b","https://github.com/protocolbuffers/protobuf/commit/9a5f5fe752a20cbac2e722b06949ac985abdd534","https://github.com/protocolbuffers/protobuf/commit/ac9fb5b4c71b0dd80985b27684e265d1f03abf46","https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa","https://github.com/protocolbuffers/protobuf/commit/d6c82fc55a76481c676f541a255571e8950bb8c3","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/google-protobuf/CVE-2024-7254.yml","https://security.netapp.com/advisory/ntap-20241213-0010","https://security.netapp.com/advisory/ntap-20250418-0006"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-735f-pc8j-v9w8","description":"protobuf-java has potential Denial of Service issue"},"relatedVulnerabilities":[{"id":"CVE-2024-7254","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7254","cwe":"CWE-400","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2024-7254","cwe":"CWE-674","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2024-7254","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7254","date":"2026-11-02","epss":0.02772,"percentile":0.86334}],"urls":["https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa","https://security.netapp.com/advisory/ntap-20241213-0010/","https://security.netapp.com/advisory/ntap-20250418-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7254","description":"Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker."}]},{"artifact":{"id":"5529979a051a7251","cpes":["cpe:2.3:a:com.google.protobuf:protobuf-java:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:com.google.protobuf:protobuf_java:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:com.google.protobuf:protobuf:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:protobuf-java:protobuf-java:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:protobuf-java:protobuf_java:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:protobuf_java:protobuf-java:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:protobuf_java:protobuf_java:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:protobuf-java:protobuf:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:protobuf:protobuf-java:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:protobuf:protobuf_java:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:protobuf_java:protobuf:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:google:protobuf-java:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:google:protobuf_java:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:protobuf:protobuf:3.23.4:*:*:*:*:*:*:*","cpe:2.3:a:google:protobuf:3.23.4:*:*:*:*:*:*:*"],"name":"protobuf-java","purl":"pkg:maven/com.google.protobuf/protobuf-java@3.23.4","type":"java-archive","version":"3.23.4","language":"java","licenses":["https://opensource.org/licenses/BSD-3-Clause"],"metadata":{"pomGroupID":"com.google.protobuf","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/protobuf-java-3.23.4.jar","manifestName":"","pomArtifactID":"protobuf-java","archiveDigests":[{"value":"5cc1be17aed4e1e396c6b5359518f369a42ebc37","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/protobuf-java-3.23.4.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/protobuf-java-3.23.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.25.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-735f-pc8j-v9w8","versionConstraint":"<3.25.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.google.protobuf:protobuf-java","version":"3.23.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-735f-pc8j-v9w8","fix":{"state":"fixed","versions":["3.25.5"],"available":[{"date":"2024-09-20","kind":"first-observed","version":"3.25.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7254","cwe":"CWE-400","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2024-7254","cwe":"CWE-674","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2024-7254","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7254","date":"2026-11-02","epss":0.02772,"percentile":0.86334}],"risk":2.16216,"urls":["https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8","https://nvd.nist.gov/vuln/detail/CVE-2024-7254","https://github.com/protocolbuffers/protobuf/commit/4728531c162f2f9e8c2ca1add713cfee2db6be3b","https://github.com/protocolbuffers/protobuf/commit/850fcce9176e2c9070614dab53537760498c926b","https://github.com/protocolbuffers/protobuf/commit/9a5f5fe752a20cbac2e722b06949ac985abdd534","https://github.com/protocolbuffers/protobuf/commit/ac9fb5b4c71b0dd80985b27684e265d1f03abf46","https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa","https://github.com/protocolbuffers/protobuf/commit/d6c82fc55a76481c676f541a255571e8950bb8c3","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/google-protobuf/CVE-2024-7254.yml","https://security.netapp.com/advisory/ntap-20241213-0010","https://security.netapp.com/advisory/ntap-20250418-0006"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-735f-pc8j-v9w8","description":"protobuf-java has potential Denial of Service issue"},"relatedVulnerabilities":[{"id":"CVE-2024-7254","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7254","cwe":"CWE-400","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2024-7254","cwe":"CWE-674","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2024-7254","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7254","date":"2026-11-02","epss":0.02772,"percentile":0.86334}],"urls":["https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa","https://security.netapp.com/advisory/ntap-20241213-0010/","https://security.netapp.com/advisory/ntap-20250418-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7254","description":"Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker."}]},{"artifact":{"id":"7bccd4346e7df4e4","cpes":["cpe:2.3:a:org.springframework:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring_web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring_web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_web:5.3.31:*:*:*:*:*:*:*"],"name":"spring-web","purl":"pkg:maven/org.springframework/spring-web@5.3.31","type":"java-archive","version":"5.3.31","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-web-5.3.31.jar","manifestName":"","pomArtifactID":"spring-web","archiveDigests":[{"value":"3bf73c385a1f2f4a0d482149d6a205e854cec497","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-web-5.3.31.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-web-5.3.31.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.3.33"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hgjh-9rj2-g67j","versionConstraint":"<5.3.33 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-web","version":"5.3.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hgjh-9rj2-g67j","fix":{"state":"fixed","versions":["5.3.33"],"available":[{"date":"2024-03-19","kind":"first-observed","version":"5.3.33"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-22259","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-22259","date":"2026-11-02","epss":0.02573,"percentile":0.85177}],"risk":2.00694,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-22259","https://spring.io/security/cve-2024-22259","https://github.com/spring-projects/spring-framework/commit/297cbae2990e1413537c55845a7e0ea0ffd9f9bb","https://github.com/spring-projects/spring-framework/commit/381f790329a48b74c2a49fc1384dd68ca9153501","https://github.com/spring-projects/spring-framework/commit/f2fd2f12269c6a781c5b2c20b3c24141055a3d68","https://security.netapp.com/advisory/ntap-20240524-0002"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hgjh-9rj2-g67j","description":"Spring Framework URL Parsing with Host Validation Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-22259","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-22259","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-22259","date":"2026-11-02","epss":0.02573,"percentile":0.85177}],"urls":["https://security.netapp.com/advisory/ntap-20240524-0002/","https://spring.io/security/cve-2024-22259"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-22259","description":"Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a  open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.\n\nThis is the same as  CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.106"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wc4r-xq3c-5cf3","versionConstraint":">=9.0.0.M1,<=9.0.105 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wc4r-xq3c-5cf3","fix":{"state":"fixed","versions":["9.0.106"],"available":[{"date":"2025-06-17","kind":"first-observed","version":"9.0.106"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-49125","cwe":"CWE-288","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-49125","date":"2026-11-02","epss":0.03437,"percentile":0.88966}],"risk":1.9419049999999998,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-49125","https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk","https://github.com/apache/tomcat/commit/7617b9c247bc77ed0444dd69adcd8aa48777886c","https://github.com/apache/tomcat/commit/9418e3ff9f1f4c006b4661311ae9376c52d162b9","https://github.com/apache/tomcat/commit/d94bd36fb7eb32e790dae0339bc249069649a637","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html","http://www.openwall.com/lists/oss-security/2025/06/16/2","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wc4r-xq3c-5cf3","description":"Apache Tomcat - Security constraint bypass for pre/post-resources"},"relatedVulnerabilities":[{"id":"CVE-2025-49125","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-49125","cwe":"CWE-288","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-49125","date":"2026-11-02","epss":0.03437,"percentile":0.88966}],"urls":["https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk","http://www.openwall.com/lists/oss-security/2025/06/16/2","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-49125","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue."}]},{"artifact":{"id":"0fc5ab4c86eb7ea7","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/ubuntu/libssl-dev@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.19"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-9143","versionConstraint":"< 3.0.2-0ubuntu1.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-9143","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.19"],"available":[{"date":"2025-02-20","kind":"advisory","version":"3.0.2-0ubuntu1.19"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-9143","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-9143","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-9143","date":"2026-11-02","epss":0.05842,"percentile":0.93174}],"risk":1.7526,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9143"},"relatedVulnerabilities":[{"id":"CVE-2024-9143","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9143","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-9143","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-9143","date":"2026-11-02","epss":0.05842,"percentile":0.93174}],"urls":["https://github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712","https://github.com/openssl/openssl/commit/bc7e04d7c8d509fb78fc0e285aa948fb0da04700","https://github.com/openssl/openssl/commit/c0d3e4d32d2805f49bec30547f225bc4d092e1f4","https://github.com/openssl/openssl/commit/fdf6723362ca51bd883295efe206cb5b1cfa5154","https://github.openssl.org/openssl/extended-releases/commit/8efc0cbaa8ebba8e116f7b81a876a4123594d86a","https://github.openssl.org/openssl/extended-releases/commit/9d576994cec2b7aa37a91740ea7e680810957e41","https://openssl-library.org/news/secadv/20241016.txt","http://www.openwall.com/lists/oss-security/2024/10/16/1","http://www.openwall.com/lists/oss-security/2024/10/23/1","http://www.openwall.com/lists/oss-security/2024/10/24/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20241101-0001/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9143","description":"Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted\nexplicit values for the field polynomial can lead to out-of-bounds memory reads\nor writes.\n\nImpact summary: Out of bound memory writes can lead to an application crash or\neven a possibility of a remote code execution, however, in all the protocols\ninvolving Elliptic Curve Cryptography that we're aware of, either only \"named\ncurves\" are supported, or, if explicit curve parameters are supported, they\nspecify an X9.62 encoding of binary (GF(2^m)) curves that can't represent\nproblematic input values. Thus the likelihood of existence of a vulnerable\napplication is low.\n\nIn particular, the X9.62 encoding is used for ECC keys in X.509 certificates,\nso problematic inputs cannot occur in the context of processing X.509\ncertificates.  Any problematic use-cases would have to be using an \"exotic\"\ncurve encoding.\n\nThe affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(),\nand various supporting BN_GF2m_*() functions.\n\nApplications working with \"exotic\" explicit binary (GF(2^m)) curve parameters,\nthat make it possible to represent invalid field polynomials with a zero\nconstant term, via the above or similar APIs, may terminate abruptly as a\nresult of reading or writing outside of array bounds.  Remote code execution\ncannot easily be ruled out.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"080c8716011e8bcc","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.19"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-9143","versionConstraint":"< 3.0.2-0ubuntu1.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-9143","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.19"],"available":[{"date":"2025-02-20","kind":"advisory","version":"3.0.2-0ubuntu1.19"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-9143","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-9143","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-9143","date":"2026-11-02","epss":0.05842,"percentile":0.93174}],"risk":1.7526,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9143"},"relatedVulnerabilities":[{"id":"CVE-2024-9143","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9143","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-9143","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-9143","date":"2026-11-02","epss":0.05842,"percentile":0.93174}],"urls":["https://github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712","https://github.com/openssl/openssl/commit/bc7e04d7c8d509fb78fc0e285aa948fb0da04700","https://github.com/openssl/openssl/commit/c0d3e4d32d2805f49bec30547f225bc4d092e1f4","https://github.com/openssl/openssl/commit/fdf6723362ca51bd883295efe206cb5b1cfa5154","https://github.openssl.org/openssl/extended-releases/commit/8efc0cbaa8ebba8e116f7b81a876a4123594d86a","https://github.openssl.org/openssl/extended-releases/commit/9d576994cec2b7aa37a91740ea7e680810957e41","https://openssl-library.org/news/secadv/20241016.txt","http://www.openwall.com/lists/oss-security/2024/10/16/1","http://www.openwall.com/lists/oss-security/2024/10/23/1","http://www.openwall.com/lists/oss-security/2024/10/24/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20241101-0001/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9143","description":"Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted\nexplicit values for the field polynomial can lead to out-of-bounds memory reads\nor writes.\n\nImpact summary: Out of bound memory writes can lead to an application crash or\neven a possibility of a remote code execution, however, in all the protocols\ninvolving Elliptic Curve Cryptography that we're aware of, either only \"named\ncurves\" are supported, or, if explicit curve parameters are supported, they\nspecify an X9.62 encoding of binary (GF(2^m)) curves that can't represent\nproblematic input values. Thus the likelihood of existence of a vulnerable\napplication is low.\n\nIn particular, the X9.62 encoding is used for ECC keys in X.509 certificates,\nso problematic inputs cannot occur in the context of processing X.509\ncertificates.  Any problematic use-cases would have to be using an \"exotic\"\ncurve encoding.\n\nThe affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(),\nand various supporting BN_GF2m_*() functions.\n\nApplications working with \"exotic\" explicit binary (GF(2^m)) curve parameters,\nthat make it possible to represent invalid field polynomials with a zero\nconstant term, via the above or similar APIs, may terminate abruptly as a\nresult of reading or writing outside of array bounds.  Remote code execution\ncannot easily be ruled out.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"e6933be022de0634","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.19"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-9143","versionConstraint":"< 3.0.2-0ubuntu1.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-9143","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.19"],"available":[{"date":"2025-02-20","kind":"advisory","version":"3.0.2-0ubuntu1.19"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-9143","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-9143","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-9143","date":"2026-11-02","epss":0.05842,"percentile":0.93174}],"risk":1.7526,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9143"},"relatedVulnerabilities":[{"id":"CVE-2024-9143","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9143","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-9143","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-9143","date":"2026-11-02","epss":0.05842,"percentile":0.93174}],"urls":["https://github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712","https://github.com/openssl/openssl/commit/bc7e04d7c8d509fb78fc0e285aa948fb0da04700","https://github.com/openssl/openssl/commit/c0d3e4d32d2805f49bec30547f225bc4d092e1f4","https://github.com/openssl/openssl/commit/fdf6723362ca51bd883295efe206cb5b1cfa5154","https://github.openssl.org/openssl/extended-releases/commit/8efc0cbaa8ebba8e116f7b81a876a4123594d86a","https://github.openssl.org/openssl/extended-releases/commit/9d576994cec2b7aa37a91740ea7e680810957e41","https://openssl-library.org/news/secadv/20241016.txt","http://www.openwall.com/lists/oss-security/2024/10/16/1","http://www.openwall.com/lists/oss-security/2024/10/23/1","http://www.openwall.com/lists/oss-security/2024/10/24/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20241101-0001/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9143","description":"Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted\nexplicit values for the field polynomial can lead to out-of-bounds memory reads\nor writes.\n\nImpact summary: Out of bound memory writes can lead to an application crash or\neven a possibility of a remote code execution, however, in all the protocols\ninvolving Elliptic Curve Cryptography that we're aware of, either only \"named\ncurves\" are supported, or, if explicit curve parameters are supported, they\nspecify an X9.62 encoding of binary (GF(2^m)) curves that can't represent\nproblematic input values. Thus the likelihood of existence of a vulnerable\napplication is low.\n\nIn particular, the X9.62 encoding is used for ECC keys in X.509 certificates,\nso problematic inputs cannot occur in the context of processing X.509\ncertificates.  Any problematic use-cases would have to be using an \"exotic\"\ncurve encoding.\n\nThe affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(),\nand various supporting BN_GF2m_*() functions.\n\nApplications working with \"exotic\" explicit binary (GF(2^m)) curve parameters,\nthat make it possible to represent invalid field polynomials with a zero\nconstant term, via the above or similar APIs, may terminate abruptly as a\nresult of reading or writing outside of array bounds.  Remote code execution\ncannot easily be ruled out.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"0fc5ab4c86eb7ea7","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/ubuntu/libssl-dev@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-5535","versionConstraint":"< 3.0.2-0ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-5535","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.17"],"available":[{"date":"2024-07-31","kind":"advisory","version":"3.0.2-0ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-5535","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-5535","date":"2026-11-02","epss":0.05582,"percentile":0.92889}],"risk":1.6746,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-5535"},"relatedVulnerabilities":[{"id":"CVE-2024-5535","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-5535","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-5535","date":"2026-11-02","epss":0.05582,"percentile":0.92889}],"urls":["https://github.com/openssl/openssl/commit/4ada436a1946cbb24db5ab4ca082b69c1bc10f37","https://github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e","https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c","https://github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c","https://github.openssl.org/openssl/extended-releases/commit/9947251413065a05189a63c9b7a6c1d4e224c21c","https://github.openssl.org/openssl/extended-releases/commit/b78ec0824da857223486660177d3b1f255c65d87","https://www.openssl.org/news/secadv/20240627.txt","http://www.openwall.com/lists/oss-security/2024/06/27/1","http://www.openwall.com/lists/oss-security/2024/06/28/4","http://www.openwall.com/lists/oss-security/2024/08/15/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240712-0005/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-5535","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available."}]},{"artifact":{"id":"080c8716011e8bcc","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-5535","versionConstraint":"< 3.0.2-0ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-5535","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.17"],"available":[{"date":"2024-07-31","kind":"advisory","version":"3.0.2-0ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-5535","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-5535","date":"2026-11-02","epss":0.05582,"percentile":0.92889}],"risk":1.6746,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-5535"},"relatedVulnerabilities":[{"id":"CVE-2024-5535","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-5535","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-5535","date":"2026-11-02","epss":0.05582,"percentile":0.92889}],"urls":["https://github.com/openssl/openssl/commit/4ada436a1946cbb24db5ab4ca082b69c1bc10f37","https://github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e","https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c","https://github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c","https://github.openssl.org/openssl/extended-releases/commit/9947251413065a05189a63c9b7a6c1d4e224c21c","https://github.openssl.org/openssl/extended-releases/commit/b78ec0824da857223486660177d3b1f255c65d87","https://www.openssl.org/news/secadv/20240627.txt","http://www.openwall.com/lists/oss-security/2024/06/27/1","http://www.openwall.com/lists/oss-security/2024/06/28/4","http://www.openwall.com/lists/oss-security/2024/08/15/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240712-0005/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-5535","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available."}]},{"artifact":{"id":"e6933be022de0634","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.17"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-5535","versionConstraint":"< 3.0.2-0ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-5535","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.17"],"available":[{"date":"2024-07-31","kind":"advisory","version":"3.0.2-0ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-5535","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-5535","date":"2026-11-02","epss":0.05582,"percentile":0.92889}],"risk":1.6746,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-5535"},"relatedVulnerabilities":[{"id":"CVE-2024-5535","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-5535","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-5535","date":"2026-11-02","epss":0.05582,"percentile":0.92889}],"urls":["https://github.com/openssl/openssl/commit/4ada436a1946cbb24db5ab4ca082b69c1bc10f37","https://github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e","https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c","https://github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c","https://github.openssl.org/openssl/extended-releases/commit/9947251413065a05189a63c9b7a6c1d4e224c21c","https://github.openssl.org/openssl/extended-releases/commit/b78ec0824da857223486660177d3b1f255c65d87","https://www.openssl.org/news/secadv/20240627.txt","http://www.openwall.com/lists/oss-security/2024/06/27/1","http://www.openwall.com/lists/oss-security/2024/06/28/4","http://www.openwall.com/lists/oss-security/2024/08/15/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240712-0005/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-5535","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.107"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wr62-c79q-cv37","versionConstraint":">=9.0.0.M1,<9.0.107 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wr62-c79q-cv37","fix":{"state":"fixed","versions":["9.0.107"],"available":[{"date":"2026-03-07","kind":"first-observed","version":"9.0.107"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52520","cwe":"CWE-190","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-52520","date":"2026-11-02","epss":0.02198,"percentile":0.825}],"risk":1.6484999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-52520","https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5","https://github.com/apache/tomcat/commit/927d66fbc294cb65242102b817a45fd80834e040","https://github.com/apache/tomcat/commit/a51e4bedccfafd35b7cdd0ee3e22267dee9f90db","https://github.com/apache/tomcat/commit/fc42bbccb9041fafd194fbfdf3eab1d44cb5c45c","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html","http://www.openwall.com/lists/oss-security/2025/07/10/12"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wr62-c79q-cv37","description":"Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits"},"relatedVulnerabilities":[{"id":"CVE-2025-52520","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52520","cwe":"CWE-190","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-52520","date":"2026-11-02","epss":0.02198,"percentile":0.825}],"urls":["https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5","http://www.openwall.com/lists/oss-security/2025/07/10/12","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52520","description":"For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue."}]},{"artifact":{"id":"eaaf707db378cc79","cpes":["cpe:2.3:a:apache:cxf-core:3.5.5:*:*:*:*:*:*:*","cpe:2.3:a:apache:cxf_core:3.5.5:*:*:*:*:*:*:*","cpe:2.3:a:apache:cxf:3.5.5:*:*:*:*:*:*:*"],"name":"cxf-core","purl":"pkg:maven/org.apache.cxf/cxf-core@3.5.5","type":"java-archive","version":"3.5.5","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.cxf","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/cxf-core-3.5.5.jar","manifestName":"","pomArtifactID":"cxf-core","archiveDigests":[{"value":"6920f145ab2e1b4a539da1658dcd26385b73564b","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/cxf-core-3.5.5.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/cxf-core-3.5.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fh5r-crhr-qrrq","versionConstraint":"<3.5.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.cxf:cxf-core","version":"3.5.5"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fh5r-crhr-qrrq","fix":{"state":"fixed","versions":["3.5.10"],"available":[{"date":"2025-01-22","kind":"first-observed","version":"3.5.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-23184","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-23184","date":"2026-11-02","epss":0.02194,"percentile":0.82468}],"risk":1.6455000000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-23184","https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122","http://www.openwall.com/lists/oss-security/2025/01/20/3","https://github.com/apache/cxf/pull/2048","https://github.com/apache/cxf/pull/2111","https://issues.apache.org/jira/browse/CXF-7396","https://security.netapp.com/advisory/ntap-20250214-0003","https://www.vicarius.io/vsociety/posts/cve-2025-23184-detect-apache-cxf-vulnerability","https://www.vicarius.io/vsociety/posts/cve-2025-23184-mitigate-apache-cxf-vulnerability"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fh5r-crhr-qrrq","description":"Apache CXF: Denial of Service vulnerability with temporary files"},"relatedVulnerabilities":[{"id":"CVE-2025-23184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-23184","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-23184","date":"2026-11-02","epss":0.02194,"percentile":0.82468}],"urls":["https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122","http://www.openwall.com/lists/oss-security/2025/01/20/3","https://security.netapp.com/advisory/ntap-20250214-0003/","https://www.vicarius.io/vsociety/posts/cve-2025-23184-detect-apache-cxf-vulnerability","https://www.vicarius.io/vsociety/posts/cve-2025-23184-mitigate-apache-cxf-vulnerability"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-23184","description":"A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients)."}]},{"artifact":{"id":"970cde6a7490edee","cpes":["cpe:2.3:a:apache:commons-beanutils:1.9.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_beanutils:1.9.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.9.4:*:*:*:*:*:*:*"],"name":"commons-beanutils","purl":"pkg:maven/commons-beanutils/commons-beanutils@1.9.4","type":"java-archive","version":"1.9.4","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"commons-beanutils","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar:META-INF/lib/commons-beanutils-1.9.4.jar","manifestName":"","pomArtifactID":"commons-beanutils","archiveDigests":[{"value":"d52b9abcd97f38c81342bb7e7ae1eee9b73cba51","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar:META-INF/lib/commons-beanutils-1.9.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wxr5-93ph-8wr9","versionConstraint":">=1.0,<=1.10.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-beanutils:commons-beanutils","version":"1.9.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wxr5-93ph-8wr9","fix":{"state":"fixed","versions":["1.11.0"],"available":[{"date":"2025-05-29","kind":"first-observed","version":"1.11.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48734","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-48734","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-48734","date":"2026-11-02","epss":0.02018,"percentile":0.80932}],"risk":1.64467,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48734","https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9","https://github.com/apache/commons-beanutils/commit/bd20740da25b69552ddef8523beec0837297eaf9","http://www.openwall.com/lists/oss-security/2025/05/28/6","https://lists.debian.org/debian-lts-announce/2025/06/msg00027.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wxr5-93ph-8wr9","description":"Apache Commons Improper Access Control vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-48734","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48734","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-48734","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-48734","date":"2026-11-02","epss":0.02018,"percentile":0.80932}],"urls":["https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9","http://www.openwall.com/lists/oss-security/2025/05/28/6","https://lists.debian.org/debian-lts-announce/2025/06/msg00027.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48734","description":"Improper Access Control vulnerability in Apache Commons.\n\n\n\nA special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.\n\n\n\n\n\nReleases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().\nStarting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.\n\nThis issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils\n\n 1.x are recommended to upgrade to version 1.11.0, which fixes the issue.\n\n\nUsers of the artifact org.apache.commons:commons-beanutils2\n\n 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue."}]},{"artifact":{"id":"d32395ec67746974","cpes":["cpe:2.3:a:apache:commons-beanutils:1.9.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_beanutils:1.9.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.9.4:*:*:*:*:*:*:*"],"name":"commons-beanutils","purl":"pkg:maven/commons-beanutils/commons-beanutils@1.9.4","type":"java-archive","version":"1.9.4","language":"java","licenses":[],"metadata":{"pomGroupID":"commons-beanutils","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/embedded-crowd-admin-plugin-5.2.1.jar:commons-beanutils:commons-beanutils","manifestName":"","pomArtifactID":"commons-beanutils","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/embedded-crowd-admin-plugin-5.2.1.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/embedded-crowd-admin-plugin-5.2.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wxr5-93ph-8wr9","versionConstraint":">=1.0,<=1.10.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-beanutils:commons-beanutils","version":"1.9.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wxr5-93ph-8wr9","fix":{"state":"fixed","versions":["1.11.0"],"available":[{"date":"2025-05-29","kind":"first-observed","version":"1.11.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48734","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-48734","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-48734","date":"2026-11-02","epss":0.02018,"percentile":0.80932}],"risk":1.64467,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48734","https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9","https://github.com/apache/commons-beanutils/commit/bd20740da25b69552ddef8523beec0837297eaf9","http://www.openwall.com/lists/oss-security/2025/05/28/6","https://lists.debian.org/debian-lts-announce/2025/06/msg00027.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wxr5-93ph-8wr9","description":"Apache Commons Improper Access Control vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-48734","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48734","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-48734","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-48734","date":"2026-11-02","epss":0.02018,"percentile":0.80932}],"urls":["https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9","http://www.openwall.com/lists/oss-security/2025/05/28/6","https://lists.debian.org/debian-lts-announce/2025/06/msg00027.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48734","description":"Improper Access Control vulnerability in Apache Commons.\n\n\n\nA special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.\n\n\n\n\n\nReleases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().\nStarting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.\n\nThis issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils\n\n 1.x are recommended to upgrade to version 1.11.0, which fixes the issue.\n\n\nUsers of the artifact org.apache.commons:commons-beanutils2\n\n 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue."}]},{"artifact":{"id":"5ce895bd6c0ff2e4","cpes":["cpe:2.3:a:apache:commons-beanutils:1.9.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_beanutils:1.9.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.9.4:*:*:*:*:*:*:*"],"name":"commons-beanutils","purl":"pkg:maven/commons-beanutils/commons-beanutils@1.9.4","type":"java-archive","version":"1.9.4","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"commons-beanutils","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/commons-beanutils-1.9.4.jar","manifestName":"","pomArtifactID":"commons-beanutils","archiveDigests":[{"value":"d52b9abcd97f38c81342bb7e7ae1eee9b73cba51","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/commons-beanutils-1.9.4.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/commons-beanutils-1.9.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wxr5-93ph-8wr9","versionConstraint":">=1.0,<=1.10.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-beanutils:commons-beanutils","version":"1.9.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wxr5-93ph-8wr9","fix":{"state":"fixed","versions":["1.11.0"],"available":[{"date":"2025-05-29","kind":"first-observed","version":"1.11.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48734","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-48734","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-48734","date":"2026-11-02","epss":0.02018,"percentile":0.80932}],"risk":1.64467,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48734","https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9","https://github.com/apache/commons-beanutils/commit/bd20740da25b69552ddef8523beec0837297eaf9","http://www.openwall.com/lists/oss-security/2025/05/28/6","https://lists.debian.org/debian-lts-announce/2025/06/msg00027.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wxr5-93ph-8wr9","description":"Apache Commons Improper Access Control vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-48734","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48734","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-48734","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-48734","date":"2026-11-02","epss":0.02018,"percentile":0.80932}],"urls":["https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9","http://www.openwall.com/lists/oss-security/2025/05/28/6","https://lists.debian.org/debian-lts-announce/2025/06/msg00027.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48734","description":"Improper Access Control vulnerability in Apache Commons.\n\n\n\nA special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.\n\n\n\n\n\nReleases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().\nStarting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.\n\nThis issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils\n\n 1.x are recommended to upgrade to version 1.11.0, which fixes the issue.\n\n\nUsers of the artifact org.apache.commons:commons-beanutils2\n\n 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue."}]},{"artifact":{"id":"e23b3db52150d31e","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-handler-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"4c0acdb8bb73647ebb3847ac2d503d53d72c02b4","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-handler-4.1.100.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-handler-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.118.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4g8c-wm8x-jfhw","versionConstraint":">=4.1.91.Final,<=4.1.117.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4g8c-wm8x-jfhw","fix":{"state":"fixed","versions":["4.1.118.Final"],"available":[{"date":"2025-02-11","kind":"first-observed","version":"4.1.118.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24970","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24970","date":"2026-11-02","epss":0.02192,"percentile":0.82448}],"risk":1.644,"urls":["https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","https://nvd.nist.gov/vuln/detail/CVE-2025-24970","https://security.netapp.com/advisory/ntap-20250221-0005","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4g8c-wm8x-jfhw","description":"SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine"},"relatedVulnerabilities":[{"id":"CVE-2025-24970","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24970","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24970","date":"2026-11-02","epss":0.02192,"percentile":0.82448}],"urls":["https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","https://security.netapp.com/advisory/ntap-20250221-0005/","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-24970","description":"Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually."}]},{"artifact":{"id":"89fd601f024d673b","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-handler-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"4c0acdb8bb73647ebb3847ac2d503d53d72c02b4","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-handler-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.118.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4g8c-wm8x-jfhw","versionConstraint":">=4.1.91.Final,<=4.1.117.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4g8c-wm8x-jfhw","fix":{"state":"fixed","versions":["4.1.118.Final"],"available":[{"date":"2025-02-11","kind":"first-observed","version":"4.1.118.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24970","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24970","date":"2026-11-02","epss":0.02192,"percentile":0.82448}],"risk":1.644,"urls":["https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","https://nvd.nist.gov/vuln/detail/CVE-2025-24970","https://security.netapp.com/advisory/ntap-20250221-0005","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4g8c-wm8x-jfhw","description":"SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine"},"relatedVulnerabilities":[{"id":"CVE-2025-24970","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24970","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24970","date":"2026-11-02","epss":0.02192,"percentile":0.82448}],"urls":["https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","https://security.netapp.com/advisory/ntap-20250221-0005/","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-24970","description":"Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually."}]},{"artifact":{"id":"fb59295dfaa83cc8","cpes":["cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:io.netty:netty-handler","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.118.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4g8c-wm8x-jfhw","versionConstraint":">=4.1.91.Final,<=4.1.117.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4g8c-wm8x-jfhw","fix":{"state":"fixed","versions":["4.1.118.Final"],"available":[{"date":"2025-02-11","kind":"first-observed","version":"4.1.118.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24970","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24970","date":"2026-11-02","epss":0.02192,"percentile":0.82448}],"risk":1.644,"urls":["https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","https://nvd.nist.gov/vuln/detail/CVE-2025-24970","https://security.netapp.com/advisory/ntap-20250221-0005","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4g8c-wm8x-jfhw","description":"SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine"},"relatedVulnerabilities":[{"id":"CVE-2025-24970","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24970","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24970","date":"2026-11-02","epss":0.02192,"percentile":0.82448}],"urls":["https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","https://security.netapp.com/advisory/ntap-20250221-0005/","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-24970","description":"Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually."}]},{"artifact":{"id":"c157d2710f492255","cpes":["cpe:2.3:a:netty-handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/micrometer-registry-statsd-1.11.6.jar:io.netty:netty-handler","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/micrometer-registry-statsd-1.11.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.118.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4g8c-wm8x-jfhw","versionConstraint":">=4.1.91.Final,<=4.1.117.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4g8c-wm8x-jfhw","fix":{"state":"fixed","versions":["4.1.118.Final"],"available":[{"date":"2025-02-11","kind":"first-observed","version":"4.1.118.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24970","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24970","date":"2026-11-02","epss":0.02192,"percentile":0.82448}],"risk":1.644,"urls":["https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","https://nvd.nist.gov/vuln/detail/CVE-2025-24970","https://security.netapp.com/advisory/ntap-20250221-0005","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4g8c-wm8x-jfhw","description":"SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine"},"relatedVulnerabilities":[{"id":"CVE-2025-24970","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24970","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24970","date":"2026-11-02","epss":0.02192,"percentile":0.82448}],"urls":["https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","https://security.netapp.com/advisory/ntap-20250221-0005/","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-24970","description":"Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually."}]},{"artifact":{"id":"76376ee746ecb41b","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-handler-4.1.101.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"7800aea949bf95f63df73166d144e49405b279dd","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-handler-4.1.101.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-handler-4.1.101.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.118.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4g8c-wm8x-jfhw","versionConstraint":">=4.1.91.Final,<=4.1.117.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4g8c-wm8x-jfhw","fix":{"state":"fixed","versions":["4.1.118.Final"],"available":[{"date":"2025-02-11","kind":"first-observed","version":"4.1.118.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24970","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24970","date":"2026-11-02","epss":0.02192,"percentile":0.82448}],"risk":1.644,"urls":["https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","https://nvd.nist.gov/vuln/detail/CVE-2025-24970","https://security.netapp.com/advisory/ntap-20250221-0005","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4g8c-wm8x-jfhw","description":"SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine"},"relatedVulnerabilities":[{"id":"CVE-2025-24970","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24970","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24970","date":"2026-11-02","epss":0.02192,"percentile":0.82448}],"urls":["https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","https://security.netapp.com/advisory/ntap-20250221-0005/","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-24970","description":"Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually."}]},{"artifact":{"id":"5491f3e702333e3e","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-handler-4.1.101.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"7800aea949bf95f63df73166d144e49405b279dd","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-handler-4.1.101.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-handler-4.1.101.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.118.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4g8c-wm8x-jfhw","versionConstraint":">=4.1.91.Final,<=4.1.117.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4g8c-wm8x-jfhw","fix":{"state":"fixed","versions":["4.1.118.Final"],"available":[{"date":"2025-02-11","kind":"first-observed","version":"4.1.118.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24970","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24970","date":"2026-11-02","epss":0.02192,"percentile":0.82448}],"risk":1.644,"urls":["https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","https://nvd.nist.gov/vuln/detail/CVE-2025-24970","https://security.netapp.com/advisory/ntap-20250221-0005","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4g8c-wm8x-jfhw","description":"SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine"},"relatedVulnerabilities":[{"id":"CVE-2025-24970","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24970","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24970","date":"2026-11-02","epss":0.02192,"percentile":0.82448}],"urls":["https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","https://security.netapp.com/advisory/ntap-20250221-0005/","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-24970","description":"Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.118"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r29c-68gh-xp6x","versionConstraint":">=8.5.0,<9.0.118 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r29c-68gh-xp6x","fix":{"state":"fixed","versions":["9.0.118"],"available":[{"date":"2026-05-19","kind":"first-observed","version":"9.0.118"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41293","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-41293","date":"2026-11-02","epss":0.01705,"percentile":0.77283}],"risk":1.6027,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41293","https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r","http://www.openwall.com/lists/oss-security/2026/05/12/13","https://github.com/apache/tomcat/commit/19f17a257797e8d139b33ff9c88d362a273be148","https://github.com/apache/tomcat/commit/1c70480466572c9192ed412ebefcd43fc63137fd","https://github.com/apache/tomcat/commit/2a2476460e823789f530a22207873ea8cd6eff3b","https://github.com/apache/tomcat/commit/3915fd27e6810b14ccd21e3d900bd8faef44d3df","https://github.com/apache/tomcat/commit/57c2b3bfd62792631e1df24cf4237b990a0b36fa","https://github.com/apache/tomcat/commit/c2925554c677da57390f940d856871e18daaacab","https://github.com/apache/tomcat/commit/cf9452443bcbf3b1a4b435ef7d624364f1b65ca3","https://github.com/apache/tomcat/commit/e5cef9618c3f4fd31bd6fb1e83f0f18022280dac","https://github.com/apache/tomcat/commit/f72a6174ab1f0f5a053435f80448b4f6837fe6d7","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r29c-68gh-xp6x","description":"Apache Tomcat - HTTP/2 request headers not validated"},"relatedVulnerabilities":[{"id":"CVE-2026-41293","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41293","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-41293","date":"2026-11-02","epss":0.01705,"percentile":0.77283}],"urls":["https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r","http://www.openwall.com/lists/oss-security/2026/05/12/13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41293","description":"Improper Input Validation vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27.\nOlder, end of support versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.107"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-25xr-qj8w-c4vf","versionConstraint":">=9.0.0.M1,<9.0.107 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-25xr-qj8w-c4vf","fix":{"state":"fixed","versions":["9.0.107"],"available":[{"date":"2026-03-07","kind":"first-observed","version":"9.0.107"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53506","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-53506","date":"2026-11-02","epss":0.02129,"percentile":0.81946}],"risk":1.59675,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-53506","https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0","https://github.com/apache/tomcat/commit/2aa6261276ebe50b99276953591e3a2be7898bdb","https://github.com/apache/tomcat/commit/434772930f362145516dd60681134e7f0cf8115b","https://github.com/apache/tomcat/commit/be8f330f83ceddaf3baeed57522e571572b6b99b","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html","http://www.openwall.com/lists/oss-security/2025/07/10/13"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-25xr-qj8w-c4vf","description":"Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams"},"relatedVulnerabilities":[{"id":"CVE-2025-53506","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53506","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-53506","date":"2026-11-02","epss":0.02129,"percentile":0.81946}],"urls":["https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0","http://www.openwall.com/lists/oss-security/2025/07/10/13","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53506","description":"Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue."}]},{"artifact":{"id":"1a5a42fb71782e42","cpes":["cpe:2.3:a:org.springframework.security:spring-security-web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:spring-security-web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:spring_security_web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:spring-security-web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:spring_security_web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:security:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:5.8.9:*:*:*:*:*:*:*"],"name":"spring-security-web","purl":"pkg:maven/org.springframework.security/spring-security-web@5.8.9","type":"java-archive","version":"5.8.9","language":"java","licenses":[],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-security-web-5.8.9.jar","manifestName":"","pomArtifactID":"spring-security-web","archiveDigests":[{"value":"241ebc4e7e14c56550ca58694d572fe11e103f59","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-security-web-5.8.9.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-security-web-5.8.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.8.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c4q5-6c82-3qpw","versionConstraint":">=5.8.0,<5.8.15 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-web","version":"5.8.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c4q5-6c82-3qpw","fix":{"state":"fixed","versions":["5.8.15"],"available":[{"date":"2024-10-29","kind":"first-observed","version":"5.8.15"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38821","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-38821","date":"2026-11-02","epss":0.01741,"percentile":0.77749}],"risk":1.5843099999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-38821","https://spring.io/security/cve-2024-38821","https://github.com/spring-projects/spring-security/commit/0e257b56ce35402558a260ffa6b368982f9a7934","https://github.com/spring-projects/spring-security/commit/4ce7cde15599c0447163fd46bac616e03318bf5b","https://security.netapp.com/advisory/ntap-20250124-0006","https://github.com/spring-projects/spring-security/commit/b4f27777556c157ec5689c0769322c90be984514"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c4q5-6c82-3qpw","description":"Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications"},"relatedVulnerabilities":[{"id":"CVE-2024-38821","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38821","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-38821","date":"2026-11-02","epss":0.01741,"percentile":0.77749}],"urls":["https://spring.io/security/cve-2024-38821","https://security.netapp.com/advisory/ntap-20250124-0006/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-38821","description":"Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.\n\nFor this to impact an application, all of the following must be true:\n\n  *  It must be a WebFlux application\n  *  It must be using Spring's static resources support\n  *  It must have a non-permitAll authorization rule applied to the static resources support"}]},{"artifact":{"id":"7a6a94d060d4895f","cpes":["cpe:2.3:a:apache:commons-lang:2.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_lang:2.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:2.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:lang:2.4:*:*:*:*:*:*:*"],"name":"commons-lang","purl":"pkg:maven/commons-lang/commons-lang@2.4","type":"java-archive","version":"2.4","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"commons-lang","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/commons-lang-2.4.jar","manifestName":"","pomArtifactID":"commons-lang","archiveDigests":[{"value":"16313e02a793435009f1e458fa4af5d879f6fb11","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/commons-lang-2.4.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/commons-lang-2.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j288-q9x7-2f5v","versionConstraint":">=2.0,<=2.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-lang:commons-lang","version":"2.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j288-q9x7-2f5v","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"risk":1.5133999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48924","https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html","http://www.openwall.com/lists/oss-security/2025/07/11/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j288-q9x7-2f5v","description":"Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs"},"relatedVulnerabilities":[{"id":"CVE-2025-48924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"urls":["https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","http://www.openwall.com/lists/oss-security/2025/07/11/1","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue."}]},{"artifact":{"id":"910427d528811432","cpes":["cpe:2.3:a:apache:commons-lang:2.6:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_lang:2.6:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:2.6:*:*:*:*:*:*:*","cpe:2.3:a:apache:lang:2.6:*:*:*:*:*:*:*"],"name":"commons-lang","purl":"pkg:maven/commons-lang/commons-lang@2.6","type":"java-archive","version":"2.6","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"commons-lang","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/commons-lang-2.6.jar","manifestName":"","pomArtifactID":"commons-lang","archiveDigests":[{"value":"0ce1edb914c94ebc388f086c6827e8bdeec71ac2","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/commons-lang-2.6.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/commons-lang-2.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j288-q9x7-2f5v","versionConstraint":">=2.0,<=2.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-lang:commons-lang","version":"2.6"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j288-q9x7-2f5v","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"risk":1.5133999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48924","https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html","http://www.openwall.com/lists/oss-security/2025/07/11/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j288-q9x7-2f5v","description":"Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs"},"relatedVulnerabilities":[{"id":"CVE-2025-48924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"urls":["https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","http://www.openwall.com/lists/oss-security/2025/07/11/1","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue."}]},{"artifact":{"id":"0cfe0300eed71435","cpes":["cpe:2.3:a:apache:commons-lang:2.6:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_lang:2.6:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:2.6:*:*:*:*:*:*:*","cpe:2.3:a:apache:lang:2.6:*:*:*:*:*:*:*"],"name":"commons-lang","purl":"pkg:maven/commons-lang/commons-lang@2.6","type":"java-archive","version":"2.6","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"commons-lang","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/osgi-framework-bundles/commons-lang-2.6.jar","manifestName":"","pomArtifactID":"commons-lang","archiveDigests":[{"value":"0ce1edb914c94ebc388f086c6827e8bdeec71ac2","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/osgi-framework-bundles/commons-lang-2.6.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/osgi-framework-bundles/commons-lang-2.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j288-q9x7-2f5v","versionConstraint":">=2.0,<=2.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-lang:commons-lang","version":"2.6"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j288-q9x7-2f5v","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"risk":1.5133999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48924","https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html","http://www.openwall.com/lists/oss-security/2025/07/11/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j288-q9x7-2f5v","description":"Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs"},"relatedVulnerabilities":[{"id":"CVE-2025-48924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"urls":["https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","http://www.openwall.com/lists/oss-security/2025/07/11/1","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue."}]},{"artifact":{"id":"356a7dd5cff50c0c","cpes":["cpe:2.3:a:apache:commons-lang3:3.12.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_lang3:3.12.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:3.12.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:lang3:3.12.0:*:*:*:*:*:*:*"],"name":"commons-lang3","purl":"pkg:maven/org.apache.commons/commons-lang3@3.12.0","type":"java-archive","version":"3.12.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/commons-lang3-3.12.0.jar","manifestName":"","pomArtifactID":"commons-lang3","archiveDigests":[{"value":"c6842c86792ff03b9f1d1fe2aab8dc23aa6c6f0e","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/commons-lang3-3.12.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.18.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j288-q9x7-2f5v","versionConstraint":">=3.0,<3.18.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-lang3","version":"3.12.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j288-q9x7-2f5v","fix":{"state":"fixed","versions":["3.18.0"],"available":[{"date":"2025-07-12","kind":"first-observed","version":"3.18.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"risk":1.5133999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48924","https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html","http://www.openwall.com/lists/oss-security/2025/07/11/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j288-q9x7-2f5v","description":"Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs"},"relatedVulnerabilities":[{"id":"CVE-2025-48924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"urls":["https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","http://www.openwall.com/lists/oss-security/2025/07/11/1","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue."}]},{"artifact":{"id":"0998f6672a1a5b59","cpes":["cpe:2.3:a:apache:commons-lang3:3.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_lang3:3.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:3.13.0:*:*:*:*:*:*:*"],"name":"commons-lang3","purl":"pkg:maven/org.apache.commons/commons-lang3@3.13.0","type":"java-archive","version":"3.13.0","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/signalfx-java-1.0.36.jar:org.apache.commons:commons-lang3","manifestName":"","pomArtifactID":"commons-lang3","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/signalfx-java-1.0.36.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.18.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j288-q9x7-2f5v","versionConstraint":">=3.0,<3.18.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-lang3","version":"3.13.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j288-q9x7-2f5v","fix":{"state":"fixed","versions":["3.18.0"],"available":[{"date":"2025-07-12","kind":"first-observed","version":"3.18.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"risk":1.5133999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48924","https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html","http://www.openwall.com/lists/oss-security/2025/07/11/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j288-q9x7-2f5v","description":"Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs"},"relatedVulnerabilities":[{"id":"CVE-2025-48924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"urls":["https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","http://www.openwall.com/lists/oss-security/2025/07/11/1","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue."}]},{"artifact":{"id":"70b074de40bac677","cpes":["cpe:2.3:a:apache:commons-lang3:3.14.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_lang3:3.14.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:3.14.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:lang3:3.14.0:*:*:*:*:*:*:*"],"name":"commons-lang3","purl":"pkg:maven/org.apache.commons/commons-lang3@3.14.0","type":"java-archive","version":"3.14.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/commons-lang3-3.14.0.jar","manifestName":"","pomArtifactID":"commons-lang3","archiveDigests":[{"value":"1ed471194b02f2c6cb734a0cd6f6f107c673afae","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/commons-lang3-3.14.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/commons-lang3-3.14.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.18.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j288-q9x7-2f5v","versionConstraint":">=3.0,<3.18.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-lang3","version":"3.14.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j288-q9x7-2f5v","fix":{"state":"fixed","versions":["3.18.0"],"available":[{"date":"2025-07-12","kind":"first-observed","version":"3.18.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"risk":1.5133999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48924","https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html","http://www.openwall.com/lists/oss-security/2025/07/11/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j288-q9x7-2f5v","description":"Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs"},"relatedVulnerabilities":[{"id":"CVE-2025-48924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"urls":["https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","http://www.openwall.com/lists/oss-security/2025/07/11/1","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue."}]},{"artifact":{"id":"cd406683db00ffc0","cpes":["cpe:2.3:a:apache:commons-lang3:3.14.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_lang3:3.14.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:3.14.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:lang3:3.14.0:*:*:*:*:*:*:*"],"name":"commons-lang3","purl":"pkg:maven/org.apache.commons/commons-lang3@3.14.0","type":"java-archive","version":"3.14.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/commons-lang3.jar","manifestName":"","pomArtifactID":"commons-lang3","archiveDigests":[{"value":"1ed471194b02f2c6cb734a0cd6f6f107c673afae","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/commons-lang3.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/commons-lang3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.18.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j288-q9x7-2f5v","versionConstraint":">=3.0,<3.18.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-lang3","version":"3.14.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j288-q9x7-2f5v","fix":{"state":"fixed","versions":["3.18.0"],"available":[{"date":"2025-07-12","kind":"first-observed","version":"3.18.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"risk":1.5133999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48924","https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html","http://www.openwall.com/lists/oss-security/2025/07/11/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j288-q9x7-2f5v","description":"Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs"},"relatedVulnerabilities":[{"id":"CVE-2025-48924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"urls":["https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","http://www.openwall.com/lists/oss-security/2025/07/11/1","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue."}]},{"artifact":{"id":"1059657301837847","cpes":["cpe:2.3:a:apache:commons-lang3:3.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_lang3:3.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:3.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:lang3:3.4:*:*:*:*:*:*:*"],"name":"commons-lang3","purl":"pkg:maven/org.apache.commons/commons-lang3@3.4","type":"java-archive","version":"3.4","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/commons-lang3-3.4.jar","manifestName":"","pomArtifactID":"commons-lang3","archiveDigests":[{"value":"5fe28b9518e58819180a43a850fbc0dd24b7c050","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/commons-lang3-3.4.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/commons-lang3-3.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.18.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j288-q9x7-2f5v","versionConstraint":">=3.0,<3.18.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-lang3","version":"3.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j288-q9x7-2f5v","fix":{"state":"fixed","versions":["3.18.0"],"available":[{"date":"2025-07-12","kind":"first-observed","version":"3.18.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"risk":1.5133999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48924","https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html","http://www.openwall.com/lists/oss-security/2025/07/11/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j288-q9x7-2f5v","description":"Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs"},"relatedVulnerabilities":[{"id":"CVE-2025-48924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"urls":["https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","http://www.openwall.com/lists/oss-security/2025/07/11/1","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue."}]},{"artifact":{"id":"9cdb74e8a6079ff0","cpes":["cpe:2.3:a:com.thoughtworks.xstream:xstream:1.4.20:*:*:*:*:*:*:*","cpe:2.3:a:thoughtworks:xstream:1.4.20:*:*:*:*:*:*:*","cpe:2.3:a:xstream:xstream:1.4.20:*:*:*:*:*:*:*"],"name":"xstream","purl":"pkg:maven/com.thoughtworks.xstream/xstream@1.4.20","type":"java-archive","version":"1.4.20","language":"java","licenses":[],"metadata":{"pomGroupID":"com.thoughtworks.xstream","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/plugin-bitbucket-1.54.1.jar:com.thoughtworks.xstream:xstream","manifestName":"","pomArtifactID":"xstream","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/plugin-bitbucket-1.54.1.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/plugin-bitbucket-1.54.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.4.21"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hfq9-hggm-c56q","versionConstraint":"<1.4.21 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.thoughtworks.xstream:xstream","version":"1.4.20"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hfq9-hggm-c56q","fix":{"state":"fixed","versions":["1.4.21"],"available":[{"date":"2024-11-08","kind":"first-observed","version":"1.4.21"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47072","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-47072","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-47072","date":"2026-11-02","epss":0.02001,"percentile":0.80769}],"risk":1.510755,"urls":["https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q","https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266","https://github.com/x-stream/xstream/commit/fdd9f7d3de0d7ccf2f9979bcd09fbf3e6a0c881a","https://x-stream.github.io/CVE-2024-47072.html","https://nvd.nist.gov/vuln/detail/CVE-2024-47072","https://lists.debian.org/debian-lts-announce/2024/12/msg00023.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hfq9-hggm-c56q","description":"XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream"},"relatedVulnerabilities":[{"id":"CVE-2024-47072","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47072","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-47072","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-47072","date":"2026-11-02","epss":0.02001,"percentile":0.80769}],"urls":["https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266","https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q","https://x-stream.github.io/CVE-2024-47072.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00023.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47072","description":"XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.90"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7jqf-v358-p8g7","versionConstraint":">=9.0.13,<9.0.90 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7jqf-v358-p8g7","fix":{"state":"fixed","versions":["9.0.90"],"available":[{"date":"2026-07-01","kind":"first-observed","version":"9.0.90"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38286","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-38286","date":"2026-11-02","epss":0.0169,"percentile":0.77072}],"risk":1.3224249999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-38286","https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s","https://github.com/apache/tomcat/commit/3197862639732e16ec1164557bcd289ebc116c93","https://github.com/apache/tomcat/commit/3344c17cef094da4bb616f4186ed32039627b543","https://github.com/apache/tomcat/commit/76c5cce6f0bcef14b0c21c38910371ca7d322d13","https://security.netapp.com/advisory/ntap-20241101-0010","http://www.openwall.com/lists/oss-security/2024/09/23/2","https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7jqf-v358-p8g7","description":"Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-38286","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38286","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-38286","date":"2026-11-02","epss":0.0169,"percentile":0.77072}],"urls":["https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s","http://www.openwall.com/lists/oss-security/2024/09/23/2","https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html","https://security.netapp.com/advisory/ntap-20241101-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-38286","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89.\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue.\n\n\n\nApache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process."}]},{"artifact":{"id":"0fc5ab4c86eb7ea7","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/ubuntu/libssl-dev@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-40735","versionConstraint":"< 3.0.2-0ubuntu1.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-40735","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.16"],"available":[{"date":"2024-06-27","kind":"advisory","version":"3.0.2-0ubuntu1.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2022-40735","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-40735","date":"2026-11-02","epss":0.02635,"percentile":0.85551}],"risk":1.3175,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-40735"},"relatedVulnerabilities":[{"id":"CVE-2022-40735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-40735","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-40735","date":"2026-11-02","epss":0.02635,"percentile":0.85551}],"urls":["https://dheatattack.gitlab.io/","https://gist.github.com/c0r0n3r/9455ddcab985c50fd1912eabf26e058b","https://github.com/mozilla/ssl-config-generator/issues/162","https://ieeexplore.ieee.org/document/10374117","https://link.springer.com/content/pdf/10.1007/3-540-68339-9_29.pdf","https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf","https://raw.githubusercontent.com/CVEProject/cvelist/9d7fbbcabd3f44cfedc9e8807757d31ece85a2c6/2022/40xxx/CVE-2022-40735.json","https://www.researchgate.net/profile/Anton-Stiglic-2/publication/2401745_Security_Issues_in_the_Diffie-Hellman_Key_Agreement_Protocol/links/546c144f0cf20dedafd53e7e/Security-Issues-in-the-Diffie-Hellman-Key-Agreement-Protocol.pdf","https://www.rfc-editor.org/rfc/rfc3526","https://www.rfc-editor.org/rfc/rfc4419","https://www.rfc-editor.org/rfc/rfc5114#section-4","https://www.rfc-editor.org/rfc/rfc7919#section-5.2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-40735","description":"The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van Oorschot and Wiener paper found that \"(appropriately) short exponents\" can be used when there are adequate subgroup constraints, and these short exponents can lead to less expensive calculations than for long exponents. This issue is different from CVE-2002-20001 because it is based on an observation about exponent size, rather than an observation about numbers that are not public keys. The specific situations in which calculation expense would constitute a server-side vulnerability depend on the protocol (e.g., TLS, SSH, or IKE) and the DHE implementation details. In general, there might be an availability concern because of server-side resource consumption from DHE modular-exponentiation calculations. Finally, it is possible for an attacker to exploit this vulnerability and CVE-2002-20001 together."}]},{"artifact":{"id":"080c8716011e8bcc","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-40735","versionConstraint":"< 3.0.2-0ubuntu1.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-40735","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.16"],"available":[{"date":"2024-06-27","kind":"advisory","version":"3.0.2-0ubuntu1.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2022-40735","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-40735","date":"2026-11-02","epss":0.02635,"percentile":0.85551}],"risk":1.3175,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-40735"},"relatedVulnerabilities":[{"id":"CVE-2022-40735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-40735","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-40735","date":"2026-11-02","epss":0.02635,"percentile":0.85551}],"urls":["https://dheatattack.gitlab.io/","https://gist.github.com/c0r0n3r/9455ddcab985c50fd1912eabf26e058b","https://github.com/mozilla/ssl-config-generator/issues/162","https://ieeexplore.ieee.org/document/10374117","https://link.springer.com/content/pdf/10.1007/3-540-68339-9_29.pdf","https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf","https://raw.githubusercontent.com/CVEProject/cvelist/9d7fbbcabd3f44cfedc9e8807757d31ece85a2c6/2022/40xxx/CVE-2022-40735.json","https://www.researchgate.net/profile/Anton-Stiglic-2/publication/2401745_Security_Issues_in_the_Diffie-Hellman_Key_Agreement_Protocol/links/546c144f0cf20dedafd53e7e/Security-Issues-in-the-Diffie-Hellman-Key-Agreement-Protocol.pdf","https://www.rfc-editor.org/rfc/rfc3526","https://www.rfc-editor.org/rfc/rfc4419","https://www.rfc-editor.org/rfc/rfc5114#section-4","https://www.rfc-editor.org/rfc/rfc7919#section-5.2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-40735","description":"The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van Oorschot and Wiener paper found that \"(appropriately) short exponents\" can be used when there are adequate subgroup constraints, and these short exponents can lead to less expensive calculations than for long exponents. This issue is different from CVE-2002-20001 because it is based on an observation about exponent size, rather than an observation about numbers that are not public keys. The specific situations in which calculation expense would constitute a server-side vulnerability depend on the protocol (e.g., TLS, SSH, or IKE) and the DHE implementation details. In general, there might be an availability concern because of server-side resource consumption from DHE modular-exponentiation calculations. Finally, it is possible for an attacker to exploit this vulnerability and CVE-2002-20001 together."}]},{"artifact":{"id":"e6933be022de0634","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.16"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-40735","versionConstraint":"< 3.0.2-0ubuntu1.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-40735","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.16"],"available":[{"date":"2024-06-27","kind":"advisory","version":"3.0.2-0ubuntu1.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2022-40735","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-40735","date":"2026-11-02","epss":0.02635,"percentile":0.85551}],"risk":1.3175,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-40735"},"relatedVulnerabilities":[{"id":"CVE-2022-40735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-40735","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-40735","date":"2026-11-02","epss":0.02635,"percentile":0.85551}],"urls":["https://dheatattack.gitlab.io/","https://gist.github.com/c0r0n3r/9455ddcab985c50fd1912eabf26e058b","https://github.com/mozilla/ssl-config-generator/issues/162","https://ieeexplore.ieee.org/document/10374117","https://link.springer.com/content/pdf/10.1007/3-540-68339-9_29.pdf","https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf","https://raw.githubusercontent.com/CVEProject/cvelist/9d7fbbcabd3f44cfedc9e8807757d31ece85a2c6/2022/40xxx/CVE-2022-40735.json","https://www.researchgate.net/profile/Anton-Stiglic-2/publication/2401745_Security_Issues_in_the_Diffie-Hellman_Key_Agreement_Protocol/links/546c144f0cf20dedafd53e7e/Security-Issues-in-the-Diffie-Hellman-Key-Agreement-Protocol.pdf","https://www.rfc-editor.org/rfc/rfc3526","https://www.rfc-editor.org/rfc/rfc4419","https://www.rfc-editor.org/rfc/rfc5114#section-4","https://www.rfc-editor.org/rfc/rfc7919#section-5.2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-40735","description":"The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van Oorschot and Wiener paper found that \"(appropriately) short exponents\" can be used when there are adequate subgroup constraints, and these short exponents can lead to less expensive calculations than for long exponents. This issue is different from CVE-2002-20001 because it is based on an observation about exponent size, rather than an observation about numbers that are not public keys. The specific situations in which calculation expense would constitute a server-side vulnerability depend on the protocol (e.g., TLS, SSH, or IKE) and the DHE implementation details. In general, there might be an availability concern because of server-side resource consumption from DHE modular-exponentiation calculations. Finally, it is possible for an attacker to exploit this vulnerability and CVE-2002-20001 together."}]},{"artifact":{"id":"f295fa9fe5a6266b","cpes":["cpe:2.3:a:apache:tomcat-embed-websocket:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_websocket:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-websocket","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-websocket-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-websocket","archiveDigests":[{"value":"9af4b7450296bb4eff93b2ee3e52ab69d07512e4","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-websocket-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-websocket-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.86"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v682-8vv8-vpwr","versionConstraint":">=9.0.0-M1,<=9.0.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-websocket","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-v682-8vv8-vpwr","fix":{"state":"fixed","versions":["9.0.86"],"available":[{"date":"2024-04-12","kind":"first-observed","version":"9.0.86"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-23672","cwe":"CWE-459","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-23672","date":"2026-11-02","epss":0.02313,"percentile":0.83405}],"risk":1.3068449999999998,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-23672","https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f","https://github.com/apache/tomcat/commit/0052b374684b613b0c849899b325ebe334ac6501","https://github.com/apache/tomcat/commit/3631adb1342d8bbd8598802a12b63ad02c37d591","https://github.com/apache/tomcat/commit/52d6650e062d880704898d7d8c1b2b7a3efe8068","https://github.com/apache/tomcat/commit/b0e3b1bd78de270d53e319d7cb79eb282aa53cb9","https://security.netapp.com/advisory/ntap-20240402-0002","https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html","http://www.openwall.com/lists/oss-security/2024/03/13/4","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v682-8vv8-vpwr","description":"Denial of Service via incomplete cleanup vulnerability in Apache Tomcat"},"relatedVulnerabilities":[{"id":"CVE-2024-23672","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-23672","cwe":"CWE-459","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-23672","date":"2026-11-02","epss":0.02313,"percentile":0.83405}],"urls":["https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f","http://www.openwall.com/lists/oss-security/2024/03/13/4","https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55/","https://security.netapp.com/advisory/ntap-20240402-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-23672","description":"Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\n\nOlder, EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue."}]},{"artifact":{"id":"e3420c6beccb7277","cpes":["cpe:2.3:a:org.sonatype.oss:json:20220320:*:*:*:*:*:*:*","cpe:2.3:a:org.json:json:20220320:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:json:20220320:*:*:*:*:*:*:*","cpe:2.3:a:json:json:20220320:*:*:*:*:*:*:*","cpe:2.3:a:oss:json:20220320:*:*:*:*:*:*:*"],"name":"json","purl":"pkg:maven/org.json/json@20220320","type":"java-archive","version":"20220320","language":"java","licenses":["The JSON License"],"metadata":{"pomGroupID":"org.json","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar:org.json:json","manifestName":"","pomArtifactID":"json","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"20231013"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4jq9-2xhw-jpx7","versionConstraint":"<=20230618 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.json:json","version":"20220320"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4jq9-2xhw-jpx7","fix":{"state":"fixed","versions":["20231013"],"available":[{"date":"2023-11-15","kind":"first-observed","version":"20231013"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-5072","cwe":"CWE-770","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2023-5072","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-5072","date":"2026-11-02","epss":0.01741,"percentile":0.77739}],"risk":1.30575,"urls":["https://github.com/google/security-research/security/advisories/GHSA-4jq9-2xhw-jpx7","https://nvd.nist.gov/vuln/detail/CVE-2023-5072","https://github.com/stleary/JSON-java/issues/758","https://github.com/stleary/JSON-java/issues/771","https://github.com/stleary/JSON-java/pull/759","https://github.com/stleary/JSON-java/commit/60662e2f8384d3449822a3a1179bfe8de67b55bb"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4jq9-2xhw-jpx7","description":"Java: DoS Vulnerability in JSON-JAVA"},"relatedVulnerabilities":[{"id":"CVE-2023-5072","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-5072","cwe":"CWE-770","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2023-5072","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-5072","date":"2026-11-02","epss":0.01741,"percentile":0.77739}],"urls":["http://www.openwall.com/lists/oss-security/2023/12/13/4","https://github.com/stleary/JSON-java/issues/758","https://github.com/stleary/JSON-java/issues/771","https://security.netapp.com/advisory/ntap-20240621-0007/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-5072","description":"Denial of Service  in JSON-Java versions up to and including 20230618.  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-27043","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-27043","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-11-02","epss":0.02527,"percentile":0.84897}],"risk":1.2635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-27043"},"relatedVulnerabilities":[{"id":"CVE-2023-27043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-11-02","epss":0.02527,"percentile":0.84897}],"urls":["http://python.org","https://github.com/python/cpython/issues/102988","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOX7BCN6YL7B3RFPEEXPIU5CMTEHJOKR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://python-security.readthedocs.io/vuln/email-parseaddr-realname.html","https://security.netapp.com/advisory/ntap-20230601-0003/","http://seclists.org/fulldisclosure/2025/Apr/8","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27043","description":"The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-27043","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-27043","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-11-02","epss":0.02527,"percentile":0.84897}],"risk":1.2635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-27043"},"relatedVulnerabilities":[{"id":"CVE-2023-27043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-11-02","epss":0.02527,"percentile":0.84897}],"urls":["http://python.org","https://github.com/python/cpython/issues/102988","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOX7BCN6YL7B3RFPEEXPIU5CMTEHJOKR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://python-security.readthedocs.io/vuln/email-parseaddr-realname.html","https://security.netapp.com/advisory/ntap-20230601-0003/","http://seclists.org/fulldisclosure/2025/Apr/8","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27043","description":"The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-27043","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-27043","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-11-02","epss":0.02527,"percentile":0.84897}],"risk":1.2635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-27043"},"relatedVulnerabilities":[{"id":"CVE-2023-27043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-11-02","epss":0.02527,"percentile":0.84897}],"urls":["http://python.org","https://github.com/python/cpython/issues/102988","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOX7BCN6YL7B3RFPEEXPIU5CMTEHJOKR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://python-security.readthedocs.io/vuln/email-parseaddr-realname.html","https://security.netapp.com/advisory/ntap-20230601-0003/","http://seclists.org/fulldisclosure/2025/Apr/8","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27043","description":"The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-27043","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-27043","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-11-02","epss":0.02527,"percentile":0.84897}],"risk":1.2635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-27043"},"relatedVulnerabilities":[{"id":"CVE-2023-27043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-11-02","epss":0.02527,"percentile":0.84897}],"urls":["http://python.org","https://github.com/python/cpython/issues/102988","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOX7BCN6YL7B3RFPEEXPIU5CMTEHJOKR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://python-security.readthedocs.io/vuln/email-parseaddr-realname.html","https://security.netapp.com/advisory/ntap-20230601-0003/","http://seclists.org/fulldisclosure/2025/Apr/8","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27043","description":"The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.118"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h6fc-48rj-7qqh","versionConstraint":"<9.0.118 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h6fc-48rj-7qqh","fix":{"state":"fixed","versions":["9.0.118"],"available":[{"date":"2026-05-19","kind":"first-observed","version":"9.0.118"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43512","cwe":"CWE-592","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-43512","date":"2026-11-02","epss":0.01326,"percentile":0.7098}],"risk":1.24644,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-43512","https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73","http://www.openwall.com/lists/oss-security/2026/05/12/8","https://github.com/apache/tomcat/commit/3d4d3fae07a6cd9c2eb193c5491001740ec64448","https://github.com/apache/tomcat/commit/6565a6cb6499e56fe2f34457cec99f9d1c4f39e9","https://github.com/apache/tomcat/commit/a99c355e8199adbfd67c9a1fffbd85b810b196cd","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h6fc-48rj-7qqh","description":"Apache Tomcat - Digest authenticator will authenticate any unknown user"},"relatedVulnerabilities":[{"id":"CVE-2026-43512","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43512","cwe":"CWE-592","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-43512","date":"2026-11-02","epss":0.01326,"percentile":0.7098}],"urls":["https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73","http://www.openwall.com/lists/oss-security/2026/05/12/8"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-43512","description":"DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0.\nOlder unsupported versions any also be affect\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.107"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4j3c-42xv-3f84","versionConstraint":">=9.0.0.M1,<9.0.107 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4j3c-42xv-3f84","fix":{"state":"fixed","versions":["9.0.107"],"available":[{"date":"2026-07-01","kind":"first-observed","version":"9.0.107"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52434","cwe":"CWE-362","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-52434","date":"2026-11-02","epss":0.02074,"percentile":0.81465}],"risk":1.23403,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-52434","https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030","https://github.com/apache/tomcat/commit/8a83c3c42d20762782678932c14005cd3397a018","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html","http://www.openwall.com/lists/oss-security/2025/07/10/11"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4j3c-42xv-3f84","description":"Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector"},"relatedVulnerabilities":[{"id":"CVE-2025-52434","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52434","cwe":"CWE-362","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-52434","date":"2026-11-02","epss":0.02074,"percentile":0.81465}],"urls":["https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030","http://www.openwall.com/lists/oss-security/2025/07/10/11","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52434","description":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.\n\nThis issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 9.0.107, which fixes the issue."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.104"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-ff77-26x5-69cr","versionConstraint":">=9.0.76,<=9.0.102 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-ff77-26x5-69cr","fix":{"state":"fixed","versions":["9.0.104"],"available":[{"date":"2025-05-15","kind":"first-observed","version":"9.0.104"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-31651","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-31651","cwe":"CWE-116","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-31651","date":"2026-11-02","epss":0.04263,"percentile":0.91075}],"risk":1.2149550000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-31651","https://lists.apache.org/list.html?announce@tomcat.apache.org","http://www.openwall.com/lists/oss-security/2025/04/28/3","https://github.com/apache/tomcat/commit/066bf6b6a15a4e7e0941d4acf096841165b97098","https://github.com/apache/tomcat/commit/175dc75fc428930034a6c93fb52f830d955d8e64","https://github.com/apache/tomcat/commit/ee3ab548e92345eca0cbd1f01649eb36c6f29454","https://github.com/apache/tomcat/commit/fbecc915a10c5a3d634c5e2c6ced4ff479ce9953","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-ff77-26x5-69cr","description":"Apache Tomcat Rewrite rule bypass"},"relatedVulnerabilities":[{"id":"CVE-2025-31651","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-31651","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-31651","cwe":"CWE-116","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-31651","date":"2026-11-02","epss":0.04263,"percentile":0.91075}],"urls":["https://lists.apache.org/list.html?announce@tomcat.apache.org","http://www.openwall.com/lists/oss-security/2025/04/28/3","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-31651","description":"Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible \nfor a specially crafted request to bypass some rewrite rules. If those \nrewrite rules effectively enforced security constraints, those \nconstraints could be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue."}]},{"artifact":{"id":"99eab8abc4efa46b","cpes":["cpe:2.3:a:org.springframework:spring-webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring-webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring_webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring-webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring_webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_webmvc:5.3.31:*:*:*:*:*:*:*"],"name":"spring-webmvc","purl":"pkg:maven/org.springframework/spring-webmvc@5.3.31","type":"java-archive","version":"5.3.31","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-webmvc-5.3.31.jar","manifestName":"","pomArtifactID":"spring-webmvc","archiveDigests":[{"value":"45754d056effe8257a012f6b98ed5454cf1e8960","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-webmvc-5.3.31.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-webmvc-5.3.31.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r936-gwx5-v52f","versionConstraint":">=5.3.0,<=5.3.43 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-webmvc","version":"5.3.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r936-gwx5-v52f","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-41242","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-41242","date":"2026-11-02","epss":0.02127,"percentile":0.81935}],"risk":1.159215,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-41242","http://spring.io/security/cve-2025-41242"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r936-gwx5-v52f","description":"Spring Framework MVC Applications Path Traversal Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-41242","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-41242","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-41242","date":"2026-11-02","epss":0.02127,"percentile":0.81935}],"urls":["http://spring.io/security/cve-2025-41242"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-41242","description":"Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.\n\nAn application can be vulnerable when all the following are true:\n\n  *  the application is deployed as a WAR or with an embedded Servlet container\n  *  the Servlet container  does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization \n  *  the application  serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with Spring resource handling\n\n\nWe have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application."}]},{"artifact":{"id":"19949061aabcc871","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:8.9p1-3ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:8.9p1-3ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:8.9p1-3ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:8.9p1-3ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:8.9p1-3ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:8.9p1-3ubuntu0.6:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A8.9p1-3ubuntu0.6?arch=amd64&distro=ubuntu-22.04&upstream=openssh","type":"deb","version":"1:8.9p1-3ubuntu0.6","language":"","licenses":["BSD-2-clause","BSD-3-clause","Expat-with-advertising-restriction","Mazieres-BSD-style","OpenSSH","Powell-BSD-style","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.preinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.preinst"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:8.9p1-3ubuntu0.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3497","versionConstraint":"< 1:8.9p1-3ubuntu0.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssh","version":"1:8.9p1-3ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-3497","fix":{"state":"fixed","versions":["1:8.9p1-3ubuntu0.14"],"available":[{"date":"2026-03-12","kind":"advisory","version":"1:8.9p1-3ubuntu0.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-3497","cwe":"CWE-908","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-3497","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-3497","date":"2026-11-02","epss":0.02268,"percentile":0.83036}],"risk":1.134,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3497"},"relatedVulnerabilities":[{"id":"CVE-2026-3497","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3497","cwe":"CWE-908","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-3497","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-3497","date":"2026-11-02","epss":0.02268,"percentile":0.83036}],"urls":["https://ubuntu.com/security/CVE-2026-3497","https://www.openwall.com/lists/oss-security/2026/03/12/3","http://www.openwall.com/lists/oss-security/2026/03/12/3","http://www.openwall.com/lists/oss-security/2026/03/14/3","http://www.openwall.com/lists/oss-security/2026/03/14/4","http://www.openwall.com/lists/oss-security/2026/03/18/2","http://www.openwall.com/lists/oss-security/2026/03/18/4","http://www.openwall.com/lists/oss-security/2026/03/18/5","http://www.openwall.com/lists/oss-security/2026/03/18/7","https://lists.debian.org/debian-lts-announce/2026/04/msg00014.html","https://access.redhat.com/errata/RHSA-2026:10065","https://access.redhat.com/errata/RHSA-2026:10714","https://access.redhat.com/errata/RHSA-2026:12071","https://access.redhat.com/errata/RHSA-2026:13750","https://access.redhat.com/errata/RHSA-2026:13812","https://access.redhat.com/errata/RHSA-2026:14773","https://access.redhat.com/errata/RHSA-2026:14924","https://access.redhat.com/errata/RHSA-2026:15087","https://access.redhat.com/errata/RHSA-2026:15891","https://access.redhat.com/errata/RHSA-2026:15893","https://access.redhat.com/errata/RHSA-2026:16008","https://access.redhat.com/errata/RHSA-2026:16009","https://access.redhat.com/errata/RHSA-2026:16030","https://access.redhat.com/errata/RHSA-2026:16174","https://access.redhat.com/errata/RHSA-2026:17596","https://access.redhat.com/errata/RHSA-2026:19724","https://access.redhat.com/errata/RHSA-2026:19725","https://access.redhat.com/errata/RHSA-2026:20040","https://access.redhat.com/errata/RHSA-2026:20087","https://access.redhat.com/errata/RHSA-2026:21690","https://access.redhat.com/errata/RHSA-2026:21695","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:5475","https://access.redhat.com/errata/RHSA-2026:6461","https://access.redhat.com/errata/RHSA-2026:6462","https://access.redhat.com/errata/RHSA-2026:6463","https://access.redhat.com/errata/RHSA-2026:7107","https://access.redhat.com/errata/RHSA-2026:9415","https://access.redhat.com/errata/RHSA-2026:9732","https://access.redhat.com/security/cve/CVE-2026-3497","https://bugzilla.redhat.com/show_bug.cgi?id=2447085","https://cert-portal.siemens.com/productcert/html/ssa-019113.html","https://cert-portal.siemens.com/productcert/html/ssa-457936.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3497.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3497","description":"Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration."}]},{"artifact":{"id":"5d2b2dbb02428e35","cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.37.2-4ubuntu3:*:*:*:*:*:*:*"],"name":"bsdutils","purl":"pkg:deb/ubuntu/bsdutils@1%3A2.37.2-4ubuntu3?arch=amd64&distro=ubuntu-22.04&upstream=util-linux%402.37.2-4ubuntu3","type":"deb","version":"1:2.37.2-4ubuntu3","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"upstreams":[{"name":"util-linux","version":"2.37.2-4ubuntu3"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.2-4ubuntu3.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-28085","versionConstraint":"< 2.37.2-4ubuntu3.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-28085","fix":{"state":"fixed","versions":["2.37.2-4ubuntu3.4"],"available":[{"date":"2024-04-10","kind":"advisory","version":"2.37.2-4ubuntu3.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"risk":1.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28085"},"relatedVulnerabilities":[{"id":"CVE-2024-28085","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/27/5","http://www.openwall.com/lists/oss-security/2024/03/27/6","http://www.openwall.com/lists/oss-security/2024/03/27/7","http://www.openwall.com/lists/oss-security/2024/03/27/8","http://www.openwall.com/lists/oss-security/2024/03/27/9","http://www.openwall.com/lists/oss-security/2024/03/28/1","http://www.openwall.com/lists/oss-security/2024/03/28/2","http://www.openwall.com/lists/oss-security/2024/03/28/3","https://github.com/skyler-ferrante/CVE-2024-28085","https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq","https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html","https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/","https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt","https://security.netapp.com/advisory/ntap-20240531-0003/","https://www.openwall.com/lists/oss-security/2024/03/27/5","http://seclists.org/fulldisclosure/2024/Mar/35","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://github.com/util-linux/util-linux/discussions/2868"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28085","description":"wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover."}]},{"artifact":{"id":"d4145cf2c4ff445c","cpes":["cpe:2.3:a:libblkid1:libblkid1:2.37.2-4ubuntu3:*:*:*:*:*:*:*"],"name":"libblkid1","purl":"pkg:deb/ubuntu/libblkid1@2.37.2-4ubuntu3?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","type":"deb","version":"2.37.2-4ubuntu3","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.2-4ubuntu3.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-28085","versionConstraint":"< 2.37.2-4ubuntu3.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-28085","fix":{"state":"fixed","versions":["2.37.2-4ubuntu3.4"],"available":[{"date":"2024-04-10","kind":"advisory","version":"2.37.2-4ubuntu3.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"risk":1.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28085"},"relatedVulnerabilities":[{"id":"CVE-2024-28085","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/27/5","http://www.openwall.com/lists/oss-security/2024/03/27/6","http://www.openwall.com/lists/oss-security/2024/03/27/7","http://www.openwall.com/lists/oss-security/2024/03/27/8","http://www.openwall.com/lists/oss-security/2024/03/27/9","http://www.openwall.com/lists/oss-security/2024/03/28/1","http://www.openwall.com/lists/oss-security/2024/03/28/2","http://www.openwall.com/lists/oss-security/2024/03/28/3","https://github.com/skyler-ferrante/CVE-2024-28085","https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq","https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html","https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/","https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt","https://security.netapp.com/advisory/ntap-20240531-0003/","https://www.openwall.com/lists/oss-security/2024/03/27/5","http://seclists.org/fulldisclosure/2024/Mar/35","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://github.com/util-linux/util-linux/discussions/2868"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28085","description":"wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover."}]},{"artifact":{"id":"5a046a4c49dd48e5","cpes":["cpe:2.3:a:libmount1:libmount1:2.37.2-4ubuntu3:*:*:*:*:*:*:*"],"name":"libmount1","purl":"pkg:deb/ubuntu/libmount1@2.37.2-4ubuntu3?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","type":"deb","version":"2.37.2-4ubuntu3","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.2-4ubuntu3.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-28085","versionConstraint":"< 2.37.2-4ubuntu3.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-28085","fix":{"state":"fixed","versions":["2.37.2-4ubuntu3.4"],"available":[{"date":"2024-04-10","kind":"advisory","version":"2.37.2-4ubuntu3.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"risk":1.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28085"},"relatedVulnerabilities":[{"id":"CVE-2024-28085","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/27/5","http://www.openwall.com/lists/oss-security/2024/03/27/6","http://www.openwall.com/lists/oss-security/2024/03/27/7","http://www.openwall.com/lists/oss-security/2024/03/27/8","http://www.openwall.com/lists/oss-security/2024/03/27/9","http://www.openwall.com/lists/oss-security/2024/03/28/1","http://www.openwall.com/lists/oss-security/2024/03/28/2","http://www.openwall.com/lists/oss-security/2024/03/28/3","https://github.com/skyler-ferrante/CVE-2024-28085","https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq","https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html","https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/","https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt","https://security.netapp.com/advisory/ntap-20240531-0003/","https://www.openwall.com/lists/oss-security/2024/03/27/5","http://seclists.org/fulldisclosure/2024/Mar/35","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://github.com/util-linux/util-linux/discussions/2868"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28085","description":"wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover."}]},{"artifact":{"id":"7a54b06f57bd70b8","cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.37.2-4ubuntu3:*:*:*:*:*:*:*"],"name":"libsmartcols1","purl":"pkg:deb/ubuntu/libsmartcols1@2.37.2-4ubuntu3?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","type":"deb","version":"2.37.2-4ubuntu3","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.2-4ubuntu3.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-28085","versionConstraint":"< 2.37.2-4ubuntu3.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-28085","fix":{"state":"fixed","versions":["2.37.2-4ubuntu3.4"],"available":[{"date":"2024-04-10","kind":"advisory","version":"2.37.2-4ubuntu3.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"risk":1.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28085"},"relatedVulnerabilities":[{"id":"CVE-2024-28085","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/27/5","http://www.openwall.com/lists/oss-security/2024/03/27/6","http://www.openwall.com/lists/oss-security/2024/03/27/7","http://www.openwall.com/lists/oss-security/2024/03/27/8","http://www.openwall.com/lists/oss-security/2024/03/27/9","http://www.openwall.com/lists/oss-security/2024/03/28/1","http://www.openwall.com/lists/oss-security/2024/03/28/2","http://www.openwall.com/lists/oss-security/2024/03/28/3","https://github.com/skyler-ferrante/CVE-2024-28085","https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq","https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html","https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/","https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt","https://security.netapp.com/advisory/ntap-20240531-0003/","https://www.openwall.com/lists/oss-security/2024/03/27/5","http://seclists.org/fulldisclosure/2024/Mar/35","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://github.com/util-linux/util-linux/discussions/2868"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28085","description":"wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover."}]},{"artifact":{"id":"20bf0434cc67ede0","cpes":["cpe:2.3:a:libuuid1:libuuid1:2.37.2-4ubuntu3:*:*:*:*:*:*:*"],"name":"libuuid1","purl":"pkg:deb/ubuntu/libuuid1@2.37.2-4ubuntu3?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","type":"deb","version":"2.37.2-4ubuntu3","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.2-4ubuntu3.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-28085","versionConstraint":"< 2.37.2-4ubuntu3.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-28085","fix":{"state":"fixed","versions":["2.37.2-4ubuntu3.4"],"available":[{"date":"2024-04-10","kind":"advisory","version":"2.37.2-4ubuntu3.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"risk":1.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28085"},"relatedVulnerabilities":[{"id":"CVE-2024-28085","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/27/5","http://www.openwall.com/lists/oss-security/2024/03/27/6","http://www.openwall.com/lists/oss-security/2024/03/27/7","http://www.openwall.com/lists/oss-security/2024/03/27/8","http://www.openwall.com/lists/oss-security/2024/03/27/9","http://www.openwall.com/lists/oss-security/2024/03/28/1","http://www.openwall.com/lists/oss-security/2024/03/28/2","http://www.openwall.com/lists/oss-security/2024/03/28/3","https://github.com/skyler-ferrante/CVE-2024-28085","https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq","https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html","https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/","https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt","https://security.netapp.com/advisory/ntap-20240531-0003/","https://www.openwall.com/lists/oss-security/2024/03/27/5","http://seclists.org/fulldisclosure/2024/Mar/35","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://github.com/util-linux/util-linux/discussions/2868"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28085","description":"wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover."}]},{"artifact":{"id":"ba61e29b519f7c0e","cpes":["cpe:2.3:a:mount:mount:2.37.2-4ubuntu3:*:*:*:*:*:*:*"],"name":"mount","purl":"pkg:deb/ubuntu/mount@2.37.2-4ubuntu3?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","type":"deb","version":"2.37.2-4ubuntu3","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/mount.list"}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.2-4ubuntu3.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-28085","versionConstraint":"< 2.37.2-4ubuntu3.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-28085","fix":{"state":"fixed","versions":["2.37.2-4ubuntu3.4"],"available":[{"date":"2024-04-10","kind":"advisory","version":"2.37.2-4ubuntu3.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"risk":1.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28085"},"relatedVulnerabilities":[{"id":"CVE-2024-28085","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/27/5","http://www.openwall.com/lists/oss-security/2024/03/27/6","http://www.openwall.com/lists/oss-security/2024/03/27/7","http://www.openwall.com/lists/oss-security/2024/03/27/8","http://www.openwall.com/lists/oss-security/2024/03/27/9","http://www.openwall.com/lists/oss-security/2024/03/28/1","http://www.openwall.com/lists/oss-security/2024/03/28/2","http://www.openwall.com/lists/oss-security/2024/03/28/3","https://github.com/skyler-ferrante/CVE-2024-28085","https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq","https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html","https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/","https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt","https://security.netapp.com/advisory/ntap-20240531-0003/","https://www.openwall.com/lists/oss-security/2024/03/27/5","http://seclists.org/fulldisclosure/2024/Mar/35","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://github.com/util-linux/util-linux/discussions/2868"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28085","description":"wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover."}]},{"artifact":{"id":"8c791e651ad0ce02","cpes":["cpe:2.3:a:util-linux:util-linux:2.37.2-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.37.2-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.37.2-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.37.2-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.37.2-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.37.2-4ubuntu3:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/ubuntu/util-linux@2.37.2-4ubuntu3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"2.37.2-4ubuntu3","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.preinst","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/util-linux.preinst"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.2-4ubuntu3.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-28085","versionConstraint":"< 2.37.2-4ubuntu3.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-28085","fix":{"state":"fixed","versions":["2.37.2-4ubuntu3.4"],"available":[{"date":"2024-04-10","kind":"advisory","version":"2.37.2-4ubuntu3.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"risk":1.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28085"},"relatedVulnerabilities":[{"id":"CVE-2024-28085","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/27/5","http://www.openwall.com/lists/oss-security/2024/03/27/6","http://www.openwall.com/lists/oss-security/2024/03/27/7","http://www.openwall.com/lists/oss-security/2024/03/27/8","http://www.openwall.com/lists/oss-security/2024/03/27/9","http://www.openwall.com/lists/oss-security/2024/03/28/1","http://www.openwall.com/lists/oss-security/2024/03/28/2","http://www.openwall.com/lists/oss-security/2024/03/28/3","https://github.com/skyler-ferrante/CVE-2024-28085","https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq","https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html","https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/","https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt","https://security.netapp.com/advisory/ntap-20240531-0003/","https://www.openwall.com/lists/oss-security/2024/03/27/5","http://seclists.org/fulldisclosure/2024/Mar/35","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://github.com/util-linux/util-linux/discussions/2868"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28085","description":"wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.118"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5m62-pw8w-7w9f","versionConstraint":"<9.0.118 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5m62-pw8w-7w9f","fix":{"state":"fixed","versions":["9.0.118"],"available":[{"date":"2026-05-19","kind":"first-observed","version":"9.0.118"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43515","cwe":"CWE-285","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-43515","date":"2026-11-02","epss":0.01221,"percentile":0.68712}],"risk":1.105005,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-43515","https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb","http://www.openwall.com/lists/oss-security/2026/05/12/11","https://github.com/apache/tomcat/commit/276087d9c7abbcecc6c4fb4e4b08cf64780c6e36","https://github.com/apache/tomcat/commit/c621317382682206fb58ab92ebd3e1b6fdd10ce9","https://github.com/apache/tomcat/commit/db919ff9912b4d61d1b702a1342b8bde39270031","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5m62-pw8w-7w9f","description":"Apache Tomcat - Security constraints not correctly applied"},"relatedVulnerabilities":[{"id":"CVE-2026-43515","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43515","cwe":"CWE-285","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-43515","date":"2026-11-02","epss":0.01221,"percentile":0.68712}],"urls":["https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb","http://www.openwall.com/lists/oss-security/2026/05/12/11"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-43515","description":"Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-6232","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6232","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6232","date":"2026-11-02","epss":0.02203,"percentile":0.82547}],"risk":1.1015000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6232"},"relatedVulnerabilities":[{"id":"CVE-2024-6232","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6232","date":"2026-11-02","epss":0.02203,"percentile":0.82547}],"urls":["https://github.com/python/cpython/commit/34ddb64d088dd7ccc321f6103d23153256caa5d4","https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06","https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4","https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d","https://github.com/python/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877","https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf","https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373","https://github.com/python/cpython/issues/121285","https://github.com/python/cpython/pull/121286","https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/","http://www.openwall.com/lists/oss-security/2024/09/03/5","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0007/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6232","description":"There is a MEDIUM severity vulnerability affecting CPython.\n\n\n\n\n\nRegular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-6232","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6232","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6232","date":"2026-11-02","epss":0.02203,"percentile":0.82547}],"risk":1.1015000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6232"},"relatedVulnerabilities":[{"id":"CVE-2024-6232","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6232","date":"2026-11-02","epss":0.02203,"percentile":0.82547}],"urls":["https://github.com/python/cpython/commit/34ddb64d088dd7ccc321f6103d23153256caa5d4","https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06","https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4","https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d","https://github.com/python/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877","https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf","https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373","https://github.com/python/cpython/issues/121285","https://github.com/python/cpython/pull/121286","https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/","http://www.openwall.com/lists/oss-security/2024/09/03/5","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0007/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6232","description":"There is a MEDIUM severity vulnerability affecting CPython.\n\n\n\n\n\nRegular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-6232","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6232","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6232","date":"2026-11-02","epss":0.02203,"percentile":0.82547}],"risk":1.1015000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6232"},"relatedVulnerabilities":[{"id":"CVE-2024-6232","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6232","date":"2026-11-02","epss":0.02203,"percentile":0.82547}],"urls":["https://github.com/python/cpython/commit/34ddb64d088dd7ccc321f6103d23153256caa5d4","https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06","https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4","https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d","https://github.com/python/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877","https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf","https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373","https://github.com/python/cpython/issues/121285","https://github.com/python/cpython/pull/121286","https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/","http://www.openwall.com/lists/oss-security/2024/09/03/5","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0007/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6232","description":"There is a MEDIUM severity vulnerability affecting CPython.\n\n\n\n\n\nRegular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-6232","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6232","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6232","date":"2026-11-02","epss":0.02203,"percentile":0.82547}],"risk":1.1015000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6232"},"relatedVulnerabilities":[{"id":"CVE-2024-6232","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6232","date":"2026-11-02","epss":0.02203,"percentile":0.82547}],"urls":["https://github.com/python/cpython/commit/34ddb64d088dd7ccc321f6103d23153256caa5d4","https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06","https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4","https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d","https://github.com/python/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877","https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf","https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373","https://github.com/python/cpython/issues/121285","https://github.com/python/cpython/pull/121286","https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/","http://www.openwall.com/lists/oss-security/2024/09/03/5","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0007/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6232","description":"There is a MEDIUM severity vulnerability affecting CPython.\n\n\n\n\n\nRegular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives."}]},{"artifact":{"id":"af534de498eed696","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52425","versionConstraint":"< 2.4.7-1ubuntu0.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-52425","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.3"],"available":[{"date":"2024-03-14","kind":"advisory","version":"2.4.7-1ubuntu0.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2023-52425","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-52425","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52425","date":"2026-11-02","epss":0.02149,"percentile":0.82121}],"risk":1.0745,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52425"},"relatedVulnerabilities":[{"id":"CVE-2023-52425","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52425","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-52425","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52425","date":"2026-11-02","epss":0.02149,"percentile":0.82121}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/20/5","https://github.com/libexpat/libexpat/pull/789","https://lists.debian.org/debian-lts-announce/2024/04/msg00006.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/","https://security.netapp.com/advisory/ntap-20240614-0003/","https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-784301.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52425","description":"libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed."}]},{"artifact":{"id":"23731e55f78e12a9","cpes":["cpe:2.3:a:libexpat1-dev:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1-dev:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1_dev:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1_dev:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1-dev","purl":"pkg:deb/ubuntu/libexpat1-dev@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1-dev/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libexpat1-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libexpat1-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52425","versionConstraint":"< 2.4.7-1ubuntu0.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-52425","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.3"],"available":[{"date":"2024-03-14","kind":"advisory","version":"2.4.7-1ubuntu0.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2023-52425","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-52425","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52425","date":"2026-11-02","epss":0.02149,"percentile":0.82121}],"risk":1.0745,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52425"},"relatedVulnerabilities":[{"id":"CVE-2023-52425","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52425","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-52425","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52425","date":"2026-11-02","epss":0.02149,"percentile":0.82121}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/20/5","https://github.com/libexpat/libexpat/pull/789","https://lists.debian.org/debian-lts-announce/2024/04/msg00006.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/","https://security.netapp.com/advisory/ntap-20240614-0003/","https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-784301.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52425","description":"libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed."}]},{"artifact":{"id":"842dbc9fb51686ce","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.4:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.4?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.4","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33845","versionConstraint":"< 3.7.3-4ubuntu1.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.4"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-33845","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.9"],"available":[{"date":"2026-05-20","kind":"advisory","version":"3.7.3-4ubuntu1.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-33845","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-33845","cwe":"CWE-191","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33845","date":"2026-11-02","epss":0.02073,"percentile":0.81458}],"risk":1.0365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33845"},"relatedVulnerabilities":[{"id":"CVE-2026-33845","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33845","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-33845","cwe":"CWE-191","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33845","date":"2026-11-02","epss":0.02073,"percentile":0.81458}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:34372","https://access.redhat.com/errata/RHSA-2026:36004","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:56786","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:56911","https://access.redhat.com/errata/RHSA-2026:57402","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-33845","https://bugzilla.redhat.com/show_bug.cgi?id=2450624","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33845.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33845","description":"A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service."}]},{"artifact":{"id":"63d46d0fb4026810","cpes":["cpe:2.3:a:apache:commons-io:2.11.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_io:2.11.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:2.11.0:*:*:*:*:*:*:*"],"name":"commons-io","purl":"pkg:maven/commons-io/commons-io@2.11.0","type":"java-archive","version":"2.11.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"commons-io","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/commons-io-2.11.0.jar","manifestName":"","pomArtifactID":"commons-io","archiveDigests":[{"value":"a2503f302b11ebde7ebc3df41daebe0e4eea3689","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/commons-io-2.11.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.14.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-78wr-2p64-hpwj","versionConstraint":">=2.0,<2.14.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-io:commons-io","version":"2.11.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-78wr-2p64-hpwj","fix":{"state":"fixed","versions":["2.14.0"],"available":[{"date":"2024-10-04","kind":"first-observed","version":"2.14.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47554","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-47554","date":"2026-11-02","epss":0.01315,"percentile":0.7075}],"risk":1.0257,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-47554","https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1","http://www.openwall.com/lists/oss-security/2024/10/03/2","https://security.netapp.com/advisory/ntap-20250131-0010"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-78wr-2p64-hpwj","description":"Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader"},"relatedVulnerabilities":[{"id":"CVE-2024-47554","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47554","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-47554","date":"2026-11-02","epss":0.01315,"percentile":0.7075}],"urls":["https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1","http://www.openwall.com/lists/oss-security/2024/10/03/2","https://security.netapp.com/advisory/ntap-20250131-0010/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47554","description":"Uncontrolled Resource Consumption vulnerability in Apache Commons IO.\n\nThe org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.\n\n\nThis issue affects Apache Commons IO: from 2.0 before 2.14.0.\n\nUsers are recommended to upgrade to version 2.14.0 or later, which fixes the issue."}]},{"artifact":{"id":"af534de498eed696","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-28757","versionConstraint":"< 2.4.7-1ubuntu0.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-28757","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.3"],"available":[{"date":"2024-03-14","kind":"advisory","version":"2.4.7-1ubuntu0.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-28757","cwe":"CWE-776","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-28757","cwe":"CWE-776","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28757","date":"2026-11-02","epss":0.02006,"percentile":0.80821}],"risk":1.0030000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28757"},"relatedVulnerabilities":[{"id":"CVE-2024-28757","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28757","cwe":"CWE-776","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-28757","cwe":"CWE-776","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28757","date":"2026-11-02","epss":0.02006,"percentile":0.80821}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/15/1","https://github.com/libexpat/libexpat/issues/839","https://github.com/libexpat/libexpat/pull/842","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE/","https://security.netapp.com/advisory/ntap-20240322-0001/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-784301.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28757","description":"libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate)."}]},{"artifact":{"id":"23731e55f78e12a9","cpes":["cpe:2.3:a:libexpat1-dev:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1-dev:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1_dev:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1_dev:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1-dev","purl":"pkg:deb/ubuntu/libexpat1-dev@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1-dev/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libexpat1-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libexpat1-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-28757","versionConstraint":"< 2.4.7-1ubuntu0.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-28757","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.3"],"available":[{"date":"2024-03-14","kind":"advisory","version":"2.4.7-1ubuntu0.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-28757","cwe":"CWE-776","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-28757","cwe":"CWE-776","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28757","date":"2026-11-02","epss":0.02006,"percentile":0.80821}],"risk":1.0030000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28757"},"relatedVulnerabilities":[{"id":"CVE-2024-28757","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28757","cwe":"CWE-776","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-28757","cwe":"CWE-776","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28757","date":"2026-11-02","epss":0.02006,"percentile":0.80821}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/15/1","https://github.com/libexpat/libexpat/issues/839","https://github.com/libexpat/libexpat/pull/842","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE/","https://security.netapp.com/advisory/ntap-20240322-0001/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-784301.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28757","description":"libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate)."}]},{"artifact":{"id":"3a060baa137f74ea","cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@17.0.10%2B7?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk17u.git","type":"binary","version":"17.0.10+7","language":"","licenses":[],"metadata":{"release":{"fullVersion":"17.0.10+7","javaVersion":"17.0.10","semanticVersion":"17.0.10+7","javaRuntimeVersion":"17.0.10+7"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:8b8fefae6897ed4bfb12e519d4bdcaca9564779609395dcc3238ea1d369600aa","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"17.0.16"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-30749","versionConstraint":"< 1.8.0_462||>= 1.9, < 8.0.462||>= 12, < 17.0.16||>= 18, < 21.0.8||>= 22, < 24.0.2||>= 9, < 11.0.28 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"17.0.10+7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-30749","fix":{"state":"fixed","versions":["1.8.0_462","8.0.462","11.0.28","17.0.16","21.0.8","24.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_462"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.462"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.16"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.8"},{"date":"2025-09-04","kind":"first-observed","version":"24.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.28"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-30749","date":"2026-11-02","epss":0.0127,"percentile":0.69823}],"risk":0.9906,"urls":["https://www.oracle.com/security-alerts/cpujul2025.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00014.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-30749","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and  24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."},"relatedVulnerabilities":[]},{"artifact":{"id":"4f2f779127e466d8","cpes":["cpe:2.3:a:org.eclipse.jetty:jetty-http:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_http:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty-http:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty_http:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty-http:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty_http:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-http:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_http:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-http:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_http:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:9.4.53.v20231009:*:*:*:*:*:*:*"],"name":"jetty-http","purl":"pkg:maven/org.eclipse.jetty/jetty-http@9.4.53.v20231009","type":"java-archive","version":"9.4.53.v20231009","language":"java","licenses":[],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/signalfx-java-1.0.36.jar:org.eclipse.jetty:jetty-http","manifestName":"","pomArtifactID":"jetty-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/signalfx-java-1.0.36.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.4.60"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-355h-qmc2-wpwf","versionConstraint":">=9.4.0,<=9.4.59 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-http","version":"9.4.53.v20231009"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-355h-qmc2-wpwf","fix":{"state":"fixed","versions":["9.4.60"],"available":[{"date":"2026-04-15","kind":"first-observed","version":"9.4.60"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2332","cwe":"CWE-444","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2026-2332","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-2332","date":"2026-11-02","epss":0.01305,"percentile":0.70534}],"risk":0.972225,"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf","https://nvd.nist.gov/vuln/detail/CVE-2026-2332","https://gitlab.eclipse.org/security/cve-assignment/-/issues/89","https://w4ke.info/2025/06/18/funky-chunks.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json","https://bugzilla.redhat.com/show_bug.cgi?id=2458187","https://access.redhat.com/security/cve/CVE-2026-2332","https://access.redhat.com/errata/RHSA-2026:50263","https://access.redhat.com/errata/RHSA-2026:50223","https://access.redhat.com/errata/RHSA-2026:50222","https://access.redhat.com/errata/RHSA-2026:50221","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:22453","https://access.redhat.com/errata/RHSA-2026:21773","https://access.redhat.com/errata/RHSA-2026:20568","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:10175"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-355h-qmc2-wpwf","description":"Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-2332","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"emo@eclipse.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2332","cwe":"CWE-444","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2026-2332","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-2332","date":"2026-11-02","epss":0.01305,"percentile":0.70534}],"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf","https://gitlab.eclipse.org/security/cve-assignment/-/issues/89","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:20568","https://access.redhat.com/errata/RHSA-2026:21773","https://access.redhat.com/errata/RHSA-2026:22453","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:50221","https://access.redhat.com/errata/RHSA-2026:50222","https://access.redhat.com/errata/RHSA-2026:50223","https://access.redhat.com/errata/RHSA-2026:50263","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/security/cve/CVE-2026-2332","https://bugzilla.redhat.com/show_bug.cgi?id=2458187","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2332","description":"In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\n  *  https://w4ke.info/2025/06/18/funky-chunks.html\n\n  *  https://w4ke.info/2025/10/29/funky-chunks-2.html\n\n\nJetty terminates chunk extension parsing at \\r\\n inside quoted strings instead of treating this as an error.\n\n\n\n\nPOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext=\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\n\n\n\n\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request."}]},{"artifact":{"id":"56f757709c1467d1","cpes":["cpe:2.3:a:python3-pkg-resources:python3-pkg-resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg-resources:python3_pkg_resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg_resources:python3-pkg-resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg_resources:python3_pkg_resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg:python3-pkg-resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg:python3_pkg_resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg:python3-pkg-resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg:python3_pkg_resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-pkg-resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_pkg_resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*"],"name":"python3-pkg-resources","purl":"pkg:deb/ubuntu/python3-pkg-resources@59.6.0-1.2ubuntu0.22.04.1?arch=all&distro=ubuntu-22.04&upstream=setuptools","type":"deb","version":"59.6.0-1.2ubuntu0.22.04.1","language":"","licenses":["Apache-2.0","BSD-3-Clause","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3-pkg-resources/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3-pkg-resources/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3-pkg-resources.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3-pkg-resources.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.list"},{"path":"/var/lib/dpkg/info/python3-pkg-resources.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.postinst"},{"path":"/var/lib/dpkg/info/python3-pkg-resources.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.prerm"}],"upstreams":[{"name":"setuptools"}]},"matchDetails":[{"fix":{"suggestedVersion":"59.6.0-1.2ubuntu0.22.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-6345","versionConstraint":"< 59.6.0-1.2ubuntu0.22.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"setuptools","version":"59.6.0-1.2ubuntu0.22.04.1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6345","fix":{"state":"fixed","versions":["59.6.0-1.2ubuntu0.22.04.2"],"available":[{"date":"2024-09-12","kind":"advisory","version":"59.6.0-1.2ubuntu0.22.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6345","cwe":"CWE-94","type":"Secondary","source":"security@huntr.dev"}],"epss":[{"cve":"CVE-2024-6345","date":"2026-11-02","epss":0.01939,"percentile":0.80114}],"risk":0.9695,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6345"},"relatedVulnerabilities":[{"id":"CVE-2024-6345","cvss":[{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6345","cwe":"CWE-94","type":"Secondary","source":"security@huntr.dev"}],"epss":[{"cve":"CVE-2024-6345","date":"2026-11-02","epss":0.01939,"percentile":0.80114}],"urls":["https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0","https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5","https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html","https://github.com/advisories/GHSA-cx63-2mw6-8hw5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6345","description":"A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0."}]},{"artifact":{"id":"44e84e19af66323e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.12.7.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1","type":"java-archive","version":"2.12.7.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.12.7.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"bb77fcffb9ecc2cc","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2","type":"java-archive","version":"2.13.4.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar:META-INF/lib/jackson-databind-2.13.4.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"325c06bdfeb628cfb80ebaaf1a26cc1eb558a585","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar:META-INF/lib/jackson-databind-2.13.4.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.13.4.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"0fb142b267f8963c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2","type":"java-archive","version":"2.13.4.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.13.4.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"96e49eed88feacc3","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/opensearch/modules/ingest-geoip/jackson-databind-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"01e71fddbc80bb86f71a6345ac1e8ab8a00e7134","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/modules/ingest-geoip/jackson-databind-2.14.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/modules/ingest-geoip/jackson-databind-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"148d0e1e06039376","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/jackson-databind-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"01e71fddbc80bb86f71a6345ac1e8ab8a00e7134","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/jackson-databind-2.14.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/jackson-databind-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"4d0c3abee3ce4445","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-remote-event-common-plugin-7.0.1.jar:META-INF/lib/jackson-databind-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"01e71fddbc80bb86f71a6345ac1e8ab8a00e7134","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-remote-event-common-plugin-7.0.1.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-remote-event-common-plugin-7.0.1.jar:META-INF/lib/jackson-databind-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"abf07cd44e688c5e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/opensearch/lib/tools/upgrade-cli/jackson-databind-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"01e71fddbc80bb86f71a6345ac1e8ab8a00e7134","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/lib/tools/upgrade-cli/jackson-databind-2.14.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/lib/tools/upgrade-cli/jackson-databind-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"67df6d98175155b6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/signalfx-java-1.0.36.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/signalfx-java-1.0.36.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"6c1f803e9e3094a1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/applinks-plugin-9.2.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/applinks-plugin-9.2.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/applinks-plugin-9.2.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"90999fe659e21a85","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-plugin-2.4.3.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-plugin-2.4.3.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-plugin-2.4.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"17a6603b2c8c52c8","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/jackson-databind-2.15.3.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"a734bc2c47a9453c4efa772461a3aeb273c010d9","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/jackson-databind-2.15.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"2655c2da825d89d6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1","type":"java-archive","version":"2.16.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-search-8.18.0.jar:META-INF/lib/jackson-databind-2.16.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"02a16efeb840c45af1e2f31753dfe76795278b73","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-search-8.18.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-search-8.18.0.jar:META-INF/lib/jackson-databind-2.16.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"7fb7ae836158dda2","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1","type":"java-archive","version":"2.16.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/jackson-databind-2.16.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"02a16efeb840c45af1e2f31753dfe76795278b73","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/jackson-databind-2.16.1.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/jackson-databind-2.16.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"e3420c6beccb7277","cpes":["cpe:2.3:a:org.sonatype.oss:json:20220320:*:*:*:*:*:*:*","cpe:2.3:a:org.json:json:20220320:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:json:20220320:*:*:*:*:*:*:*","cpe:2.3:a:json:json:20220320:*:*:*:*:*:*:*","cpe:2.3:a:oss:json:20220320:*:*:*:*:*:*:*"],"name":"json","purl":"pkg:maven/org.json/json@20220320","type":"java-archive","version":"20220320","language":"java","licenses":["The JSON License"],"metadata":{"pomGroupID":"org.json","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar:org.json:json","manifestName":"","pomArtifactID":"json","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"20230227"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3vqj-43w4-2q58","versionConstraint":"<20230227 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.json:json","version":"20220320"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3vqj-43w4-2q58","fix":{"state":"fixed","versions":["20230227"],"available":[{"date":"2023-04-15","kind":"first-observed","version":"20230227"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-45688","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-45688","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-45688","date":"2026-11-02","epss":0.01263,"percentile":0.69664}],"risk":0.94725,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-45688","https://github.com/dromara/hutool/issues/2748","https://github.com/stleary/JSON-java/issues/708","https://github.com/stleary/JSON-java/commit/a6e412bded7a0ad605adfeca029318f184c32102","https://github.com/dromara/hutool/commit/6a2b585de0a380e8c12016dbaa1620b69be11b8c","https://github.com/dromara/hutool/releases/tag/5.8.25"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3vqj-43w4-2q58","description":"json stack overflow vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2022-45688","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-45688","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-45688","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-45688","date":"2026-11-02","epss":0.01263,"percentile":0.69664}],"urls":["https://github.com/dromara/hutool/issues/2748","https://github.com/stleary/JSON-java/issues/708"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-45688","description":"A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data."}]},{"artifact":{"id":"6795f180edad07cc","cpes":["cpe:2.3:a:libssh-4:libssh-4:0.9.6-2ubuntu0.22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libssh-4:libssh_4:0.9.6-2ubuntu0.22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libssh_4:libssh-4:0.9.6-2ubuntu0.22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libssh_4:libssh_4:0.9.6-2ubuntu0.22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh-4:0.9.6-2ubuntu0.22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh_4:0.9.6-2ubuntu0.22.04.3:*:*:*:*:*:*:*"],"name":"libssh-4","purl":"pkg:deb/ubuntu/libssh-4@0.9.6-2ubuntu0.22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=libssh","type":"deb","version":"0.9.6-2ubuntu0.22.04.3","language":"","licenses":["BSD-2-clause","BSD-3-clause","LGPL-2.1","LGPL-2.1+~OpenSSL","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh-4/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libssh-4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh-4:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libssh-4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"0.9.6-2ubuntu0.22.04.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-5318","versionConstraint":"< 0.9.6-2ubuntu0.22.04.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libssh","version":"0.9.6-2ubuntu0.22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-5318","fix":{"state":"fixed","versions":["0.9.6-2ubuntu0.22.04.4"],"available":[{"date":"2025-07-07","kind":"advisory","version":"0.9.6-2ubuntu0.22.04.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-5318","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5318","date":"2026-11-02","epss":0.01886,"percentile":0.79508}],"risk":0.943,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-5318"},"relatedVulnerabilities":[{"id":"CVE-2025-5318","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5318","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5318","date":"2026-11-02","epss":0.01886,"percentile":0.79508}],"urls":["https://access.redhat.com/errata/RHSA-2025:18231","https://access.redhat.com/errata/RHSA-2025:18275","https://access.redhat.com/errata/RHSA-2025:18286","https://access.redhat.com/errata/RHSA-2025:19012","https://access.redhat.com/errata/RHSA-2025:19098","https://access.redhat.com/errata/RHSA-2025:19101","https://access.redhat.com/errata/RHSA-2025:19295","https://access.redhat.com/errata/RHSA-2025:19300","https://access.redhat.com/errata/RHSA-2025:19313","https://access.redhat.com/errata/RHSA-2025:19400","https://access.redhat.com/errata/RHSA-2025:19401","https://access.redhat.com/errata/RHSA-2025:19470","https://access.redhat.com/errata/RHSA-2025:19472","https://access.redhat.com/errata/RHSA-2025:19807","https://access.redhat.com/errata/RHSA-2025:19864","https://access.redhat.com/errata/RHSA-2025:20943","https://access.redhat.com/errata/RHSA-2025:21013","https://access.redhat.com/errata/RHSA-2025:21329","https://access.redhat.com/errata/RHSA-2025:21829","https://access.redhat.com/errata/RHSA-2025:22275","https://access.redhat.com/errata/RHSA-2025:23078","https://access.redhat.com/errata/RHSA-2025:23079","https://access.redhat.com/errata/RHSA-2025:23080","https://access.redhat.com/errata/RHSA-2026:0326","https://access.redhat.com/errata/RHSA-2026:1541","https://access.redhat.com/errata/RHSA-2026:3461","https://access.redhat.com/errata/RHSA-2026:3462","https://access.redhat.com/security/cve/CVE-2025-5318","https://bugzilla.redhat.com/show_bug.cgi?id=2369131","https://www.libssh.org/security/advisories/CVE-2025-5318.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5318","description":"A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior."}]},{"artifact":{"id":"fb7895faf09fd4e5","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.19.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.2-2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-37371","versionConstraint":"< 1.19.2-2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-37371","fix":{"state":"fixed","versions":["1.19.2-2ubuntu0.4"],"available":[{"date":"2024-08-08","kind":"advisory","version":"1.19.2-2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-37371","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-37371","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37371","date":"2026-11-02","epss":0.01863,"percentile":0.79269}],"risk":0.9315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-37371"},"relatedVulnerabilities":[{"id":"CVE-2024-37371","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-37371","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-37371","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37371","date":"2026-11-02","epss":0.01863,"percentile":0.79269}],"urls":["https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef","https://web.mit.edu/kerberos/www/advisories/","https://security.netapp.com/advisory/ntap-20241108-0009/","https://security.netapp.com/advisory/ntap-20250124-0010/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-37371","description":"In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields."}]},{"artifact":{"id":"33db6cef15da892e","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.19.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.2-2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-37371","versionConstraint":"< 1.19.2-2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-37371","fix":{"state":"fixed","versions":["1.19.2-2ubuntu0.4"],"available":[{"date":"2024-08-08","kind":"advisory","version":"1.19.2-2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-37371","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-37371","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37371","date":"2026-11-02","epss":0.01863,"percentile":0.79269}],"risk":0.9315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-37371"},"relatedVulnerabilities":[{"id":"CVE-2024-37371","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-37371","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-37371","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37371","date":"2026-11-02","epss":0.01863,"percentile":0.79269}],"urls":["https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef","https://web.mit.edu/kerberos/www/advisories/","https://security.netapp.com/advisory/ntap-20241108-0009/","https://security.netapp.com/advisory/ntap-20250124-0010/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-37371","description":"In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields."}]},{"artifact":{"id":"8baf93711e927f68","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.19.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.2-2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-37371","versionConstraint":"< 1.19.2-2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-37371","fix":{"state":"fixed","versions":["1.19.2-2ubuntu0.4"],"available":[{"date":"2024-08-08","kind":"advisory","version":"1.19.2-2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-37371","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-37371","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37371","date":"2026-11-02","epss":0.01863,"percentile":0.79269}],"risk":0.9315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-37371"},"relatedVulnerabilities":[{"id":"CVE-2024-37371","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-37371","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-37371","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37371","date":"2026-11-02","epss":0.01863,"percentile":0.79269}],"urls":["https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef","https://web.mit.edu/kerberos/www/advisories/","https://security.netapp.com/advisory/ntap-20241108-0009/","https://security.netapp.com/advisory/ntap-20250124-0010/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-37371","description":"In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields."}]},{"artifact":{"id":"6e90bedd237fee0a","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.19.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.2-2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-37371","versionConstraint":"< 1.19.2-2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-37371","fix":{"state":"fixed","versions":["1.19.2-2ubuntu0.4"],"available":[{"date":"2024-08-08","kind":"advisory","version":"1.19.2-2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-37371","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-37371","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37371","date":"2026-11-02","epss":0.01863,"percentile":0.79269}],"risk":0.9315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-37371"},"relatedVulnerabilities":[{"id":"CVE-2024-37371","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-37371","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-37371","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37371","date":"2026-11-02","epss":0.01863,"percentile":0.79269}],"urls":["https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef","https://web.mit.edu/kerberos/www/advisories/","https://security.netapp.com/advisory/ntap-20241108-0009/","https://security.netapp.com/advisory/ntap-20250124-0010/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-37371","description":"In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields."}]},{"artifact":{"id":"7bccd4346e7df4e4","cpes":["cpe:2.3:a:org.springframework:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring_web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring_web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_web:5.3.31:*:*:*:*:*:*:*"],"name":"spring-web","purl":"pkg:maven/org.springframework/spring-web@5.3.31","type":"java-archive","version":"5.3.31","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-web-5.3.31.jar","manifestName":"","pomArtifactID":"spring-web","archiveDigests":[{"value":"3bf73c385a1f2f4a0d482149d6a205e854cec497","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-web-5.3.31.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-web-5.3.31.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.3.34"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2wrp-6fg6-hmc5","versionConstraint":"<5.3.34 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-web","version":"5.3.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-2wrp-6fg6-hmc5","fix":{"state":"fixed","versions":["5.3.34"],"available":[{"date":"2024-04-26","kind":"first-observed","version":"5.3.34"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-22262","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-22262","cwe":"CWE-918","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-22262","date":"2026-11-02","epss":0.01191,"percentile":0.67967}],"risk":0.9289800000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-22262","https://spring.io/security/cve-2024-22262","https://github.com/spring-projects/spring-framework/blob/main/spring-web/src/main/java/org/springframework/web/util/UriComponentsBuilder.java","https://security.netapp.com/advisory/ntap-20240524-0003"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2wrp-6fg6-hmc5","description":"Spring Framework URL Parsing with Host Validation"},"relatedVulnerabilities":[{"id":"CVE-2024-22262","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-22262","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-22262","cwe":"CWE-918","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-22262","date":"2026-11-02","epss":0.01191,"percentile":0.67967}],"urls":["https://security.netapp.com/advisory/ntap-20240524-0003/","https://spring.io/security/cve-2024-22262"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-22262","description":"Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a  open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.\n\nThis is the same as  CVE-2024-22259 https://spring.io/security/cve-2024-22259  and  CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input."}]},{"artifact":{"id":"d8682c7fc9d4337d","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http2-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"cbf1a430ea44dbdedbcde16b185cbb95f28d72c7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http2-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.132.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w9fj-cfpg-grvv","versionConstraint":"<4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-w9fj-cfpg-grvv","fix":{"state":"fixed","versions":["4.1.132.Final"],"available":[{"date":"2026-03-27","kind":"first-observed","version":"4.1.132.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33871","date":"2026-11-02","epss":0.01145,"percentile":0.66746}],"risk":0.92745,"urls":["https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv","https://nvd.nist.gov/vuln/detail/CVE-2026-33871"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w9fj-cfpg-grvv","description":"Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-33871","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33871","date":"2026-11-02","epss":0.01145,"percentile":0.66746}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:7109","https://access.redhat.com/errata/RHSA-2026:7380","https://access.redhat.com/errata/RHSA-2026:8159","https://access.redhat.com/errata/RHSA-2026:8509","https://access.redhat.com/security/cve/CVE-2026-33871","https://bugzilla.redhat.com/show_bug.cgi?id=2452456","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33871.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33871","description":"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue."}]},{"artifact":{"id":"eae37dd4ad8fc905","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http2-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"cbf1a430ea44dbdedbcde16b185cbb95f28d72c7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http2-4.1.100.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http2-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.132.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w9fj-cfpg-grvv","versionConstraint":"<4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-w9fj-cfpg-grvv","fix":{"state":"fixed","versions":["4.1.132.Final"],"available":[{"date":"2026-03-27","kind":"first-observed","version":"4.1.132.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33871","date":"2026-11-02","epss":0.01145,"percentile":0.66746}],"risk":0.92745,"urls":["https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv","https://nvd.nist.gov/vuln/detail/CVE-2026-33871"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w9fj-cfpg-grvv","description":"Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-33871","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33871","date":"2026-11-02","epss":0.01145,"percentile":0.66746}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:7109","https://access.redhat.com/errata/RHSA-2026:7380","https://access.redhat.com/errata/RHSA-2026:8159","https://access.redhat.com/errata/RHSA-2026:8509","https://access.redhat.com/security/cve/CVE-2026-33871","https://bugzilla.redhat.com/show_bug.cgi?id=2452456","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33871.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33871","description":"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue."}]},{"artifact":{"id":"77f4a1a56c253c3b","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.132.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w9fj-cfpg-grvv","versionConstraint":"<4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-w9fj-cfpg-grvv","fix":{"state":"fixed","versions":["4.1.132.Final"],"available":[{"date":"2026-03-27","kind":"first-observed","version":"4.1.132.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33871","date":"2026-11-02","epss":0.01145,"percentile":0.66746}],"risk":0.92745,"urls":["https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv","https://nvd.nist.gov/vuln/detail/CVE-2026-33871"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w9fj-cfpg-grvv","description":"Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-33871","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33871","date":"2026-11-02","epss":0.01145,"percentile":0.66746}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:7109","https://access.redhat.com/errata/RHSA-2026:7380","https://access.redhat.com/errata/RHSA-2026:8159","https://access.redhat.com/errata/RHSA-2026:8509","https://access.redhat.com/security/cve/CVE-2026-33871","https://bugzilla.redhat.com/show_bug.cgi?id=2452456","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33871.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33871","description":"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue."}]},{"artifact":{"id":"0fc5ab4c86eb7ea7","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/ubuntu/libssl-dev@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-4741","versionConstraint":"< 3.0.2-0ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-4741","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.17"],"available":[{"date":"2024-07-31","kind":"advisory","version":"3.0.2-0ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-4741","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-4741","date":"2026-11-02","epss":0.02925,"percentile":0.8706}],"risk":0.8775,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-4741"},"relatedVulnerabilities":[{"id":"CVE-2024-4741","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4741","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-4741","date":"2026-11-02","epss":0.02925,"percentile":0.8706}],"urls":["https://github.com/openssl/openssl/commit/704f725b96aa373ee45ecfb23f6abfe8be8d9177","https://github.com/openssl/openssl/commit/b3f0eb0a295f58f16ba43ba99dad70d4ee5c437d","https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac","https://github.com/openssl/openssl/commit/e5093133c35ca82874ad83697af76f4b0f7e3bd8","https://github.openssl.org/openssl/extended-releases/commit/f7a045f3143fc6da2ee66bf52d8df04829590dd4","https://www.openssl.org/news/secadv/20240528.txt","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240621-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4741","description":"Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use.\n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived.\nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use.\n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use.\n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs.\nWe are not aware of this issue being actively exploited.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"080c8716011e8bcc","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-4741","versionConstraint":"< 3.0.2-0ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-4741","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.17"],"available":[{"date":"2024-07-31","kind":"advisory","version":"3.0.2-0ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-4741","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-4741","date":"2026-11-02","epss":0.02925,"percentile":0.8706}],"risk":0.8775,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-4741"},"relatedVulnerabilities":[{"id":"CVE-2024-4741","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4741","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-4741","date":"2026-11-02","epss":0.02925,"percentile":0.8706}],"urls":["https://github.com/openssl/openssl/commit/704f725b96aa373ee45ecfb23f6abfe8be8d9177","https://github.com/openssl/openssl/commit/b3f0eb0a295f58f16ba43ba99dad70d4ee5c437d","https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac","https://github.com/openssl/openssl/commit/e5093133c35ca82874ad83697af76f4b0f7e3bd8","https://github.openssl.org/openssl/extended-releases/commit/f7a045f3143fc6da2ee66bf52d8df04829590dd4","https://www.openssl.org/news/secadv/20240528.txt","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240621-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4741","description":"Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use.\n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived.\nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use.\n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use.\n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs.\nWe are not aware of this issue being actively exploited.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"e6933be022de0634","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.17"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-4741","versionConstraint":"< 3.0.2-0ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-4741","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.17"],"available":[{"date":"2024-07-31","kind":"advisory","version":"3.0.2-0ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-4741","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-4741","date":"2026-11-02","epss":0.02925,"percentile":0.8706}],"risk":0.8775,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-4741"},"relatedVulnerabilities":[{"id":"CVE-2024-4741","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4741","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-4741","date":"2026-11-02","epss":0.02925,"percentile":0.8706}],"urls":["https://github.com/openssl/openssl/commit/704f725b96aa373ee45ecfb23f6abfe8be8d9177","https://github.com/openssl/openssl/commit/b3f0eb0a295f58f16ba43ba99dad70d4ee5c437d","https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac","https://github.com/openssl/openssl/commit/e5093133c35ca82874ad83697af76f4b0f7e3bd8","https://github.openssl.org/openssl/extended-releases/commit/f7a045f3143fc6da2ee66bf52d8df04829590dd4","https://www.openssl.org/news/secadv/20240528.txt","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240621-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4741","description":"Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use.\n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived.\nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use.\n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use.\n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs.\nWe are not aware of this issue being actively exploited.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13836","versionConstraint":"< 3.10.12-1~22.04.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-13836","fix":{"state":"fixed","versions":["3.10.12-1~22.04.13"],"available":[{"date":"2026-01-12","kind":"advisory","version":"3.10.12-1~22.04.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-11-02","epss":0.01748,"percentile":0.77829}],"risk":0.874,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13836"},"relatedVulnerabilities":[{"id":"CVE-2025-13836","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-11-02","epss":0.01748,"percentile":0.77829}],"urls":["https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628","https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15","https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155","https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5","https://github.com/python/cpython/commit/5dc101675fd22918facbbe0fecdc821502beaaf0","https://github.com/python/cpython/commit/afc40bdd3dd71f343fd9016f6d8eebbacbd6587c","https://github.com/python/cpython/issues/119451","https://github.com/python/cpython/pull/119454","https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13836","description":"When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13836","versionConstraint":"< 3.10.12-1~22.04.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-13836","fix":{"state":"fixed","versions":["3.10.12-1~22.04.13"],"available":[{"date":"2026-01-12","kind":"advisory","version":"3.10.12-1~22.04.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-11-02","epss":0.01748,"percentile":0.77829}],"risk":0.874,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13836"},"relatedVulnerabilities":[{"id":"CVE-2025-13836","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-11-02","epss":0.01748,"percentile":0.77829}],"urls":["https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628","https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15","https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155","https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5","https://github.com/python/cpython/commit/5dc101675fd22918facbbe0fecdc821502beaaf0","https://github.com/python/cpython/commit/afc40bdd3dd71f343fd9016f6d8eebbacbd6587c","https://github.com/python/cpython/issues/119451","https://github.com/python/cpython/pull/119454","https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13836","description":"When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-13836","versionConstraint":"< 3.10.12-1~22.04.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-13836","fix":{"state":"fixed","versions":["3.10.12-1~22.04.13"],"available":[{"date":"2026-01-12","kind":"advisory","version":"3.10.12-1~22.04.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-11-02","epss":0.01748,"percentile":0.77829}],"risk":0.874,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13836"},"relatedVulnerabilities":[{"id":"CVE-2025-13836","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-11-02","epss":0.01748,"percentile":0.77829}],"urls":["https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628","https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15","https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155","https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5","https://github.com/python/cpython/commit/5dc101675fd22918facbbe0fecdc821502beaaf0","https://github.com/python/cpython/commit/afc40bdd3dd71f343fd9016f6d8eebbacbd6587c","https://github.com/python/cpython/issues/119451","https://github.com/python/cpython/pull/119454","https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13836","description":"When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13836","versionConstraint":"< 3.10.12-1~22.04.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-13836","fix":{"state":"fixed","versions":["3.10.12-1~22.04.13"],"available":[{"date":"2026-01-12","kind":"advisory","version":"3.10.12-1~22.04.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-11-02","epss":0.01748,"percentile":0.77829}],"risk":0.874,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13836"},"relatedVulnerabilities":[{"id":"CVE-2025-13836","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-11-02","epss":0.01748,"percentile":0.77829}],"urls":["https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628","https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15","https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155","https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5","https://github.com/python/cpython/commit/5dc101675fd22918facbbe0fecdc821502beaaf0","https://github.com/python/cpython/commit/afc40bdd3dd71f343fd9016f6d8eebbacbd6587c","https://github.com/python/cpython/issues/119451","https://github.com/python/cpython/pull/119454","https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13836","description":"When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS."}]},{"artifact":{"id":"6505218af4195526","cpes":["cpe:2.3:a:libperl5.34:libperl5.34:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*"],"name":"libperl5.34","purl":"pkg:deb/ubuntu/libperl5.34@5.34.0-3ubuntu1.3?arch=amd64&distro=ubuntu-22.04&upstream=perl","type":"deb","version":"5.34.0-3ubuntu1.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.34/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libperl5.34/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.34:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libperl5.34:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-31486","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-31486","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-11-02","epss":0.01742,"percentile":0.77754}],"risk":0.8710000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-31486"},"relatedVulnerabilities":[{"id":"CVE-2023-31486","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-11-02","epss":0.01742,"percentile":0.77754}],"urls":["http://www.openwall.com/lists/oss-security/2023/04/29/1","http://www.openwall.com/lists/oss-security/2023/05/03/3","http://www.openwall.com/lists/oss-security/2023/05/03/5","http://www.openwall.com/lists/oss-security/2023/05/07/2","https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/","https://github.com/chansen/p5-http-tiny/pull/153","https://hackeriet.github.io/cpan-http-tiny-overview/","https://www.openwall.com/lists/oss-security/2023/04/18/14","https://www.openwall.com/lists/oss-security/2023/05/03/4","https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/","https://security.netapp.com/advisory/ntap-20241129-0011/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31486","description":"HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates."}]},{"artifact":{"id":"c994432a9bada3de","cpes":["cpe:2.3:a:perl:perl:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.34.0-3ubuntu1.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"5.34.0-3ubuntu1.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-31486","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-31486","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-11-02","epss":0.01742,"percentile":0.77754}],"risk":0.8710000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-31486"},"relatedVulnerabilities":[{"id":"CVE-2023-31486","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-11-02","epss":0.01742,"percentile":0.77754}],"urls":["http://www.openwall.com/lists/oss-security/2023/04/29/1","http://www.openwall.com/lists/oss-security/2023/05/03/3","http://www.openwall.com/lists/oss-security/2023/05/03/5","http://www.openwall.com/lists/oss-security/2023/05/07/2","https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/","https://github.com/chansen/p5-http-tiny/pull/153","https://hackeriet.github.io/cpan-http-tiny-overview/","https://www.openwall.com/lists/oss-security/2023/04/18/14","https://www.openwall.com/lists/oss-security/2023/05/03/4","https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/","https://security.netapp.com/advisory/ntap-20241129-0011/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31486","description":"HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates."}]},{"artifact":{"id":"70df9ec20d499220","cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.3?arch=amd64&distro=ubuntu-22.04&upstream=perl","type":"deb","version":"5.34.0-3ubuntu1.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-31486","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-31486","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-11-02","epss":0.01742,"percentile":0.77754}],"risk":0.8710000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-31486"},"relatedVulnerabilities":[{"id":"CVE-2023-31486","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-11-02","epss":0.01742,"percentile":0.77754}],"urls":["http://www.openwall.com/lists/oss-security/2023/04/29/1","http://www.openwall.com/lists/oss-security/2023/05/03/3","http://www.openwall.com/lists/oss-security/2023/05/03/5","http://www.openwall.com/lists/oss-security/2023/05/07/2","https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/","https://github.com/chansen/p5-http-tiny/pull/153","https://hackeriet.github.io/cpan-http-tiny-overview/","https://www.openwall.com/lists/oss-security/2023/04/18/14","https://www.openwall.com/lists/oss-security/2023/05/03/4","https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/","https://security.netapp.com/advisory/ntap-20241129-0011/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31486","description":"HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates."}]},{"artifact":{"id":"babb7580fe53b9d9","cpes":["cpe:2.3:a:perl-modules-5.34:perl-modules-5.34:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.34:perl_modules_5.34:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.34:perl-modules-5.34:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.34:perl_modules_5.34:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.34:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.34:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.34:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.34:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.34:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.34:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*"],"name":"perl-modules-5.34","purl":"pkg:deb/ubuntu/perl-modules-5.34@5.34.0-3ubuntu1.3?arch=all&distro=ubuntu-22.04&upstream=perl","type":"deb","version":"5.34.0-3ubuntu1.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.34/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/perl-modules-5.34/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.34.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/perl-modules-5.34.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.34.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/perl-modules-5.34.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-31486","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-31486","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-11-02","epss":0.01742,"percentile":0.77754}],"risk":0.8710000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-31486"},"relatedVulnerabilities":[{"id":"CVE-2023-31486","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-11-02","epss":0.01742,"percentile":0.77754}],"urls":["http://www.openwall.com/lists/oss-security/2023/04/29/1","http://www.openwall.com/lists/oss-security/2023/05/03/3","http://www.openwall.com/lists/oss-security/2023/05/03/5","http://www.openwall.com/lists/oss-security/2023/05/07/2","https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/","https://github.com/chansen/p5-http-tiny/pull/153","https://hackeriet.github.io/cpan-http-tiny-overview/","https://www.openwall.com/lists/oss-security/2023/04/18/14","https://www.openwall.com/lists/oss-security/2023/05/03/4","https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/","https://security.netapp.com/advisory/ntap-20241129-0011/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31486","description":"HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates."}]},{"artifact":{"id":"1f8e56f352643db0","cpes":["cpe:2.3:a:libtasn1-6:libtasn1-6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1-6:libtasn1_6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1-6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1_6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1-6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1_6:4.18.0-4build1:*:*:*:*:*:*:*"],"name":"libtasn1-6","purl":"pkg:deb/ubuntu/libtasn1-6@4.18.0-4build1?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"4.18.0-4build1","language":"","licenses":["sha256:88a94e40a34bb28145805747cad4018e7eb976b5fd0bf2329dedf90088ebc6e4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtasn1-6/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libtasn1-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.18.0-4ubuntu0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-46848","versionConstraint":"< 4.18.0-4ubuntu0.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libtasn1-6","version":"4.18.0-4build1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2021-46848","fix":{"state":"fixed","versions":["4.18.0-4ubuntu0.2"],"available":[{"date":"2026-01-12","kind":"advisory","version":"4.18.0-4ubuntu0.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2021-46848","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-46848","cwe":"CWE-193","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-46848","date":"2026-11-02","epss":0.02823,"percentile":0.86585}],"risk":0.8469000000000001,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-46848"},"relatedVulnerabilities":[{"id":"CVE-2021-46848","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46848","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-46848","cwe":"CWE-193","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-46848","date":"2026-11-02","epss":0.02823,"percentile":0.86585}],"urls":["https://bugs.gentoo.org/866237","https://gitlab.com/gnutls/libtasn1/-/commit/44a700d2051a666235748970c2df047ff207aeb5","https://gitlab.com/gnutls/libtasn1/-/issues/32","https://lists.debian.org/debian-lts-announce/2023/01/msg00003.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV4SHDJF2XLB4CUPTBPQQ6CLGZ5LKXPZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECM2ELTVRYV4BZ5L5GMIRQE27RFHPAQ6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGO7XST4EIJGX4B2ITZCYSWM24534BSU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V5LWOGF7QRMNFRUCZY6TDYQJVFI6MOQ2/","https://security.netapp.com/advisory/ntap-20221118-0006/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-46848","description":"GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der."}]},{"artifact":{"id":"3a060baa137f74ea","cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@17.0.10%2B7?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk17u.git","type":"binary","version":"17.0.10+7","language":"","licenses":[],"metadata":{"release":{"fullVersion":"17.0.10+7","javaVersion":"17.0.10","semanticVersion":"17.0.10+7","javaRuntimeVersion":"17.0.10+7"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:8b8fefae6897ed4bfb12e519d4bdcaca9564779609395dcc3238ea1d369600aa","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"17.0.12"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-21147","versionConstraint":"< 1.8.0_422||>= 1.9, < 8.0.422||>= 12, < 17.0.12||>= 18, < 21.0.4||>= 22, < 22.0.2||>= 9, < 11.0.24 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"17.0.10+7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-21147","fix":{"state":"fixed","versions":["1.8.0_422","8.0.422","11.0.24","17.0.12","21.0.4","22.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_422"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.422"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.12"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.4"},{"date":"2025-09-04","kind":"first-observed","version":"22.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.24"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21147","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-21147","date":"2026-11-02","epss":0.01136,"percentile":0.66532}],"risk":0.8463200000000001,"urls":["https://security.netapp.com/advisory/ntap-20240719-0008/","https://www.oracle.com/security-alerts/cpujul2024.html","https://openjdk.org/groups/vulnerability/advisories/2024-07-16"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21147","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"eae37dd4ad8fc905","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http2-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"cbf1a430ea44dbdedbcde16b185cbb95f28d72c7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http2-4.1.100.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http2-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.124.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-prj3-ccx8-p6x4","versionConstraint":"<=4.1.123.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-prj3-ccx8-p6x4","fix":{"state":"fixed","versions":["4.1.124.Final"],"available":[{"date":"2025-08-14","kind":"first-observed","version":"4.1.124.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55163","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55163","date":"2026-11-02","epss":0.01101,"percentile":0.65696}],"risk":0.8450175000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4","https://nvd.nist.gov/vuln/detail/CVE-2025-55163","https://github.com/grpc/grpc-java/commit/6462ef9a11980e168c21d90bbc7245c728fd1a7a","https://github.com/netty/netty/commit/be53dc3c9acd9af2e20d0c3c07cd77115a594cf1","https://www.kb.cert.org/vuls/id/767506","http://www.openwall.com/lists/oss-security/2025/08/16/1"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-prj3-ccx8-p6x4","description":"Netty affected by MadeYouReset HTTP/2 DDoS vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-55163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55163","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55163","date":"2026-11-02","epss":0.01101,"percentile":0.65696}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4","http://www.openwall.com/lists/oss-security/2025/08/16/1","https://www.kb.cert.org/vuls/id/767506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55163","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final."}]},{"artifact":{"id":"77f4a1a56c253c3b","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.124.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-prj3-ccx8-p6x4","versionConstraint":"<=4.1.123.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-prj3-ccx8-p6x4","fix":{"state":"fixed","versions":["4.1.124.Final"],"available":[{"date":"2025-08-14","kind":"first-observed","version":"4.1.124.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55163","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55163","date":"2026-11-02","epss":0.01101,"percentile":0.65696}],"risk":0.8450175000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4","https://nvd.nist.gov/vuln/detail/CVE-2025-55163","https://github.com/grpc/grpc-java/commit/6462ef9a11980e168c21d90bbc7245c728fd1a7a","https://github.com/netty/netty/commit/be53dc3c9acd9af2e20d0c3c07cd77115a594cf1","https://www.kb.cert.org/vuls/id/767506","http://www.openwall.com/lists/oss-security/2025/08/16/1"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-prj3-ccx8-p6x4","description":"Netty affected by MadeYouReset HTTP/2 DDoS vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-55163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55163","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55163","date":"2026-11-02","epss":0.01101,"percentile":0.65696}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4","http://www.openwall.com/lists/oss-security/2025/08/16/1","https://www.kb.cert.org/vuls/id/767506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55163","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final."}]},{"artifact":{"id":"d8682c7fc9d4337d","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http2-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"cbf1a430ea44dbdedbcde16b185cbb95f28d72c7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http2-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.124.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-prj3-ccx8-p6x4","versionConstraint":"<=4.1.123.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-prj3-ccx8-p6x4","fix":{"state":"fixed","versions":["4.1.124.Final"],"available":[{"date":"2025-08-14","kind":"first-observed","version":"4.1.124.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55163","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55163","date":"2026-11-02","epss":0.01101,"percentile":0.65696}],"risk":0.8450175000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4","https://nvd.nist.gov/vuln/detail/CVE-2025-55163","https://github.com/grpc/grpc-java/commit/6462ef9a11980e168c21d90bbc7245c728fd1a7a","https://github.com/netty/netty/commit/be53dc3c9acd9af2e20d0c3c07cd77115a594cf1","https://www.kb.cert.org/vuls/id/767506","http://www.openwall.com/lists/oss-security/2025/08/16/1"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-prj3-ccx8-p6x4","description":"Netty affected by MadeYouReset HTTP/2 DDoS vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-55163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55163","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55163","date":"2026-11-02","epss":0.01101,"percentile":0.65696}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4","http://www.openwall.com/lists/oss-security/2025/08/16/1","https://www.kb.cert.org/vuls/id/767506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55163","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final."}]},{"artifact":{"id":"af534de498eed696","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-45490","versionConstraint":"< 2.4.7-1ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-45490","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.4"],"available":[{"date":"2024-09-17","kind":"advisory","version":"2.4.7-1ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-45490","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45490","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45490","date":"2026-11-02","epss":0.01686,"percentile":0.77023}],"risk":0.843,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-45490"},"relatedVulnerabilities":[{"id":"CVE-2024-45490","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-45490","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45490","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45490","date":"2026-11-02","epss":0.01686,"percentile":0.77023}],"urls":["https://github.com/libexpat/libexpat/issues/887","https://github.com/libexpat/libexpat/pull/890","http://seclists.org/fulldisclosure/2024/Dec/10","http://seclists.org/fulldisclosure/2024/Dec/12","http://seclists.org/fulldisclosure/2024/Dec/6","http://seclists.org/fulldisclosure/2024/Dec/7","http://seclists.org/fulldisclosure/2024/Dec/8","https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html","https://security.netapp.com/advisory/ntap-20241018-0004/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45490","description":"An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer."}]},{"artifact":{"id":"23731e55f78e12a9","cpes":["cpe:2.3:a:libexpat1-dev:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1-dev:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1_dev:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1_dev:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1-dev","purl":"pkg:deb/ubuntu/libexpat1-dev@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1-dev/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libexpat1-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libexpat1-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-45490","versionConstraint":"< 2.4.7-1ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-45490","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.4"],"available":[{"date":"2024-09-17","kind":"advisory","version":"2.4.7-1ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-45490","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45490","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45490","date":"2026-11-02","epss":0.01686,"percentile":0.77023}],"risk":0.843,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-45490"},"relatedVulnerabilities":[{"id":"CVE-2024-45490","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-45490","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45490","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45490","date":"2026-11-02","epss":0.01686,"percentile":0.77023}],"urls":["https://github.com/libexpat/libexpat/issues/887","https://github.com/libexpat/libexpat/pull/890","http://seclists.org/fulldisclosure/2024/Dec/10","http://seclists.org/fulldisclosure/2024/Dec/12","http://seclists.org/fulldisclosure/2024/Dec/6","http://seclists.org/fulldisclosure/2024/Dec/7","http://seclists.org/fulldisclosure/2024/Dec/8","https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html","https://security.netapp.com/advisory/ntap-20241018-0004/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45490","description":"An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer."}]},{"artifact":{"id":"4014b07c2a4d63cb","cpes":["cpe:2.3:a:net.minidev:json-smart:2.4.7:*:*:*:*:*:*:*","cpe:2.3:a:net.minidev:json_smart:2.4.7:*:*:*:*:*:*:*","cpe:2.3:a:json-smart:json-smart:2.4.7:*:*:*:*:*:*:*","cpe:2.3:a:json-smart:json_smart:2.4.7:*:*:*:*:*:*:*","cpe:2.3:a:json_smart:json-smart:2.4.7:*:*:*:*:*:*:*","cpe:2.3:a:json_smart:json_smart:2.4.7:*:*:*:*:*:*:*","cpe:2.3:a:minidev:json-smart:2.4.7:*:*:*:*:*:*:*","cpe:2.3:a:minidev:json_smart:2.4.7:*:*:*:*:*:*:*","cpe:2.3:a:json:json-smart:2.4.7:*:*:*:*:*:*:*","cpe:2.3:a:json:json_smart:2.4.7:*:*:*:*:*:*:*"],"name":"json-smart","purl":"pkg:maven/net.minidev/json-smart@2.4.7","type":"java-archive","version":"2.4.7","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"net.minidev","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-connect-server-plugin-3.1.2.jar:net.minidev:json-smart","manifestName":"","pomArtifactID":"json-smart","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-connect-server-plugin-3.1.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-connect-server-plugin-3.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.4.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-493p-pfq6-5258","versionConstraint":"<2.4.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"net.minidev:json-smart","version":"2.4.7"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-493p-pfq6-5258","fix":{"state":"fixed","versions":["2.4.9"],"available":[{"date":"2023-03-24","kind":"first-observed","version":"2.4.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-1370","cwe":"CWE-674","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2023-1370","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-1370","date":"2026-11-02","epss":0.01119,"percentile":0.66157}],"risk":0.83925,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-1370","https://github.com/netplex/json-smart-v2/issues/137","https://github.com/netplex/json-smart-v2/commit/5b3205d051952d3100aa0db1535f6ba6226bd87a","https://github.com/netplex/json-smart-v2/commit/e2791ae506a57491bc856b439d706c81e45adcf8","https://security.snyk.io/vuln/SNYK-JAVA-NETMINIDEV-3369748","https://www.cve.org/CVERecord?id=CVE-2023-1370","https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633","https://security.netapp.com/advisory/ntap-20240621-0006"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-493p-pfq6-5258","description":"json-smart Uncontrolled Recursion vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2023-1370","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-1370","cwe":"CWE-674","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2023-1370","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-1370","date":"2026-11-02","epss":0.01119,"percentile":0.66157}],"urls":["https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633/","https://security.netapp.com/advisory/ntap-20240621-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-1370","description":"[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib.\n\nWhen reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively.\n\nIt was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software."}]},{"artifact":{"id":"0fc5ab4c86eb7ea7","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/ubuntu/libssl-dev@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.29"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63076","versionConstraint":"< 3.0.2-0ubuntu1.29 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-63076","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.29"],"available":[{"date":"2026-08-25","kind":"advisory","version":"3.0.2-0ubuntu1.29"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-11-02","epss":0.01602,"percentile":0.75819}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63076"},"relatedVulnerabilities":[{"id":"CVE-2026-63076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-11-02","epss":0.01602,"percentile":0.75819}],"urls":["https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b","https://github.com/openssl/openssl/commit/a17cc8d612ecff6d94a9b7ca8b5283ddf5ff570e","https://github.com/openssl/openssl/commit/a1f348ccb328c3afbd4ba6883f9b7c813c043259","https://github.com/openssl/openssl/commit/a7af46a92d0ce19a90e669ef56d2576a07924226","https://github.com/openssl/openssl/commit/cdacfff557389abfa9e4615abded2ec984517d6c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63076","description":"Issue summary: OpenSSL CMP password based protection verification only\nchecks whether the protectionAlg parameter was not NULL and not its\nASN.1 type, before treating it as a PBMParameter. A crafted message can\ncontain a parameter of a different type, which is then dereferenced as an\ninvalid pointer.\n\nImpact summary: A remote, unauthenticated attacker can crash an application\nacting as a CMP server that accepts PBM-protected messages, or a CMP client\ntalking to a malicious or intercepted CMP server, resulting in a Denial of\nService.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: When verifying the password-based MAC protection of a CMP\nmessage, OpenSSL library reads the protectionAlg algorithm parameter with\nX509_ALGOR_get0(), which returns both the parameter type and its value\npointer. The value is then cast to an ASN1_STRING and treated as the\nexpected PBMParameter after only checking that pointer is not NULL. The\nparameter type returned by X509_ALGOR_get0() was never consulted.\n\nThis happens during protection verification, before any MAC is computed, so\nno knowledge of the PBM shared secret is required; the only precondition is\nthat PBM verification is reachable. On the server side this is reached from\nOSSL_CMP_SRV_process_request() for any application that stands up a CMP\nserver accepting PBM-protected messages, and on the client side from CMP\nresponse validation against a malicious or on-path (MITM) server. The\nreliable consequence is a denial of service; there is no memory disclosure,\nno controlled memory write, and no path to code execution. CMP is a\nspecialized feature that an application must explicitly enable.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE."}]},{"artifact":{"id":"080c8716011e8bcc","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.29"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63076","versionConstraint":"< 3.0.2-0ubuntu1.29 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-63076","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.29"],"available":[{"date":"2026-08-25","kind":"advisory","version":"3.0.2-0ubuntu1.29"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-11-02","epss":0.01602,"percentile":0.75819}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63076"},"relatedVulnerabilities":[{"id":"CVE-2026-63076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-11-02","epss":0.01602,"percentile":0.75819}],"urls":["https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b","https://github.com/openssl/openssl/commit/a17cc8d612ecff6d94a9b7ca8b5283ddf5ff570e","https://github.com/openssl/openssl/commit/a1f348ccb328c3afbd4ba6883f9b7c813c043259","https://github.com/openssl/openssl/commit/a7af46a92d0ce19a90e669ef56d2576a07924226","https://github.com/openssl/openssl/commit/cdacfff557389abfa9e4615abded2ec984517d6c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63076","description":"Issue summary: OpenSSL CMP password based protection verification only\nchecks whether the protectionAlg parameter was not NULL and not its\nASN.1 type, before treating it as a PBMParameter. A crafted message can\ncontain a parameter of a different type, which is then dereferenced as an\ninvalid pointer.\n\nImpact summary: A remote, unauthenticated attacker can crash an application\nacting as a CMP server that accepts PBM-protected messages, or a CMP client\ntalking to a malicious or intercepted CMP server, resulting in a Denial of\nService.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: When verifying the password-based MAC protection of a CMP\nmessage, OpenSSL library reads the protectionAlg algorithm parameter with\nX509_ALGOR_get0(), which returns both the parameter type and its value\npointer. The value is then cast to an ASN1_STRING and treated as the\nexpected PBMParameter after only checking that pointer is not NULL. The\nparameter type returned by X509_ALGOR_get0() was never consulted.\n\nThis happens during protection verification, before any MAC is computed, so\nno knowledge of the PBM shared secret is required; the only precondition is\nthat PBM verification is reachable. On the server side this is reached from\nOSSL_CMP_SRV_process_request() for any application that stands up a CMP\nserver accepting PBM-protected messages, and on the client side from CMP\nresponse validation against a malicious or on-path (MITM) server. The\nreliable consequence is a denial of service; there is no memory disclosure,\nno controlled memory write, and no path to code execution. CMP is a\nspecialized feature that an application must explicitly enable.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE."}]},{"artifact":{"id":"e6933be022de0634","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.29"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63076","versionConstraint":"< 3.0.2-0ubuntu1.29 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-63076","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.29"],"available":[{"date":"2026-08-25","kind":"advisory","version":"3.0.2-0ubuntu1.29"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-11-02","epss":0.01602,"percentile":0.75819}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63076"},"relatedVulnerabilities":[{"id":"CVE-2026-63076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-11-02","epss":0.01602,"percentile":0.75819}],"urls":["https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b","https://github.com/openssl/openssl/commit/a17cc8d612ecff6d94a9b7ca8b5283ddf5ff570e","https://github.com/openssl/openssl/commit/a1f348ccb328c3afbd4ba6883f9b7c813c043259","https://github.com/openssl/openssl/commit/a7af46a92d0ce19a90e669ef56d2576a07924226","https://github.com/openssl/openssl/commit/cdacfff557389abfa9e4615abded2ec984517d6c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63076","description":"Issue summary: OpenSSL CMP password based protection verification only\nchecks whether the protectionAlg parameter was not NULL and not its\nASN.1 type, before treating it as a PBMParameter. A crafted message can\ncontain a parameter of a different type, which is then dereferenced as an\ninvalid pointer.\n\nImpact summary: A remote, unauthenticated attacker can crash an application\nacting as a CMP server that accepts PBM-protected messages, or a CMP client\ntalking to a malicious or intercepted CMP server, resulting in a Denial of\nService.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: When verifying the password-based MAC protection of a CMP\nmessage, OpenSSL library reads the protectionAlg algorithm parameter with\nX509_ALGOR_get0(), which returns both the parameter type and its value\npointer. The value is then cast to an ASN1_STRING and treated as the\nexpected PBMParameter after only checking that pointer is not NULL. The\nparameter type returned by X509_ALGOR_get0() was never consulted.\n\nThis happens during protection verification, before any MAC is computed, so\nno knowledge of the PBM shared secret is required; the only precondition is\nthat PBM verification is reachable. On the server side this is reached from\nOSSL_CMP_SRV_process_request() for any application that stands up a CMP\nserver accepting PBM-protected messages, and on the client side from CMP\nresponse validation against a malicious or on-path (MITM) server. The\nreliable consequence is a denial of service; there is no memory disclosure,\nno controlled memory write, and no path to code execution. CMP is a\nspecialized feature that an application must explicitly enable.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE."}]},{"artifact":{"id":"56f757709c1467d1","cpes":["cpe:2.3:a:python3-pkg-resources:python3-pkg-resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg-resources:python3_pkg_resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg_resources:python3-pkg-resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg_resources:python3_pkg_resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg:python3-pkg-resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg:python3_pkg_resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg:python3-pkg-resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg:python3_pkg_resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-pkg-resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_pkg_resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*"],"name":"python3-pkg-resources","purl":"pkg:deb/ubuntu/python3-pkg-resources@59.6.0-1.2ubuntu0.22.04.1?arch=all&distro=ubuntu-22.04&upstream=setuptools","type":"deb","version":"59.6.0-1.2ubuntu0.22.04.1","language":"","licenses":["Apache-2.0","BSD-3-Clause","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3-pkg-resources/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3-pkg-resources/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3-pkg-resources.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3-pkg-resources.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.list"},{"path":"/var/lib/dpkg/info/python3-pkg-resources.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.postinst"},{"path":"/var/lib/dpkg/info/python3-pkg-resources.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.prerm"}],"upstreams":[{"name":"setuptools"}]},"matchDetails":[{"fix":{"suggestedVersion":"59.6.0-1.2ubuntu0.22.04.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-47273","versionConstraint":"< 59.6.0-1.2ubuntu0.22.04.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"setuptools","version":"59.6.0-1.2ubuntu0.22.04.1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-47273","fix":{"state":"fixed","versions":["59.6.0-1.2ubuntu0.22.04.3"],"available":[{"date":"2025-05-28","kind":"advisory","version":"59.6.0-1.2ubuntu0.22.04.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-47273","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-47273","date":"2026-11-02","epss":0.01592,"percentile":0.75692}],"risk":0.796,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-47273"},"relatedVulnerabilities":[{"id":"CVE-2025-47273","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-47273","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-47273","date":"2026-11-02","epss":0.01592,"percentile":0.75692}],"urls":["https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88","https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b","https://github.com/pypa/setuptools/issues/4946","https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf","https://lists.debian.org/debian-lts-announce/2025/05/msg00035.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47273","description":"setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0938","versionConstraint":"< 3.10.12-1~22.04.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-0938","fix":{"state":"fixed","versions":["3.10.12-1~22.04.9"],"available":[{"date":"2025-02-20","kind":"advisory","version":"3.10.12-1~22.04.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-0938","cwe":"CWE-20","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-0938","date":"2026-11-02","epss":0.01556,"percentile":0.7517}],"risk":0.7779999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0938"},"relatedVulnerabilities":[{"id":"CVE-2025-0938","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0938","cwe":"CWE-20","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-0938","date":"2026-11-02","epss":0.01556,"percentile":0.7517}],"urls":["https://github.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba","https://github.com/python/cpython/commit/90e526ae67b172ed7c6c56e7edad36263b0f9403","https://github.com/python/cpython/commit/a7084f6075c9595ba60119ce8c62f1496f50c568","https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab","https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a","https://github.com/python/cpython/commit/ff4e5c25666f63544071a6b075ae8b25c98b7a32","https://github.com/python/cpython/issues/105704","https://github.com/python/cpython/pull/129418","https://mail.python.org/archives/list/security-announce@python.org/thread/K4EUG6EKV6JYFIC24BASYOZS4M5XOQIB/","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html","https://security.netapp.com/advisory/ntap-20250314-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0938","description":"The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0938","versionConstraint":"< 3.10.12-1~22.04.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-0938","fix":{"state":"fixed","versions":["3.10.12-1~22.04.9"],"available":[{"date":"2025-02-20","kind":"advisory","version":"3.10.12-1~22.04.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-0938","cwe":"CWE-20","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-0938","date":"2026-11-02","epss":0.01556,"percentile":0.7517}],"risk":0.7779999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0938"},"relatedVulnerabilities":[{"id":"CVE-2025-0938","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0938","cwe":"CWE-20","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-0938","date":"2026-11-02","epss":0.01556,"percentile":0.7517}],"urls":["https://github.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba","https://github.com/python/cpython/commit/90e526ae67b172ed7c6c56e7edad36263b0f9403","https://github.com/python/cpython/commit/a7084f6075c9595ba60119ce8c62f1496f50c568","https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab","https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a","https://github.com/python/cpython/commit/ff4e5c25666f63544071a6b075ae8b25c98b7a32","https://github.com/python/cpython/issues/105704","https://github.com/python/cpython/pull/129418","https://mail.python.org/archives/list/security-announce@python.org/thread/K4EUG6EKV6JYFIC24BASYOZS4M5XOQIB/","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html","https://security.netapp.com/advisory/ntap-20250314-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0938","description":"The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-0938","versionConstraint":"< 3.10.12-1~22.04.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-0938","fix":{"state":"fixed","versions":["3.10.12-1~22.04.9"],"available":[{"date":"2025-02-20","kind":"advisory","version":"3.10.12-1~22.04.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-0938","cwe":"CWE-20","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-0938","date":"2026-11-02","epss":0.01556,"percentile":0.7517}],"risk":0.7779999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0938"},"relatedVulnerabilities":[{"id":"CVE-2025-0938","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0938","cwe":"CWE-20","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-0938","date":"2026-11-02","epss":0.01556,"percentile":0.7517}],"urls":["https://github.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba","https://github.com/python/cpython/commit/90e526ae67b172ed7c6c56e7edad36263b0f9403","https://github.com/python/cpython/commit/a7084f6075c9595ba60119ce8c62f1496f50c568","https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab","https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a","https://github.com/python/cpython/commit/ff4e5c25666f63544071a6b075ae8b25c98b7a32","https://github.com/python/cpython/issues/105704","https://github.com/python/cpython/pull/129418","https://mail.python.org/archives/list/security-announce@python.org/thread/K4EUG6EKV6JYFIC24BASYOZS4M5XOQIB/","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html","https://security.netapp.com/advisory/ntap-20250314-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0938","description":"The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0938","versionConstraint":"< 3.10.12-1~22.04.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-0938","fix":{"state":"fixed","versions":["3.10.12-1~22.04.9"],"available":[{"date":"2025-02-20","kind":"advisory","version":"3.10.12-1~22.04.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-0938","cwe":"CWE-20","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-0938","date":"2026-11-02","epss":0.01556,"percentile":0.7517}],"risk":0.7779999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0938"},"relatedVulnerabilities":[{"id":"CVE-2025-0938","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0938","cwe":"CWE-20","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-0938","date":"2026-11-02","epss":0.01556,"percentile":0.7517}],"urls":["https://github.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba","https://github.com/python/cpython/commit/90e526ae67b172ed7c6c56e7edad36263b0f9403","https://github.com/python/cpython/commit/a7084f6075c9595ba60119ce8c62f1496f50c568","https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab","https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a","https://github.com/python/cpython/commit/ff4e5c25666f63544071a6b075ae8b25c98b7a32","https://github.com/python/cpython/issues/105704","https://github.com/python/cpython/pull/129418","https://mail.python.org/archives/list/security-announce@python.org/thread/K4EUG6EKV6JYFIC24BASYOZS4M5XOQIB/","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html","https://security.netapp.com/advisory/ntap-20250314-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0938","description":"The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers."}]},{"artifact":{"id":"0fc5ab4c86eb7ea7","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/ubuntu/libssl-dev@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.20"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9230","versionConstraint":"< 3.0.2-0ubuntu1.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-9230","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.20"],"available":[{"date":"2025-09-30","kind":"advisory","version":"3.0.2-0ubuntu1.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-11-02","epss":0.01554,"percentile":0.75152}],"risk":0.777,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9230"},"relatedVulnerabilities":[{"id":"CVE-2025-9230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-11-02","epss":0.01554,"percentile":0.75152}],"urls":["https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45","https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280","https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def","https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd","https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482","https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3","https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5","https://lists.debian.org/debian-lts-announce/2025/10/msg00001.html","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","description":"Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary."}]},{"artifact":{"id":"080c8716011e8bcc","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.20"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9230","versionConstraint":"< 3.0.2-0ubuntu1.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-9230","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.20"],"available":[{"date":"2025-09-30","kind":"advisory","version":"3.0.2-0ubuntu1.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-11-02","epss":0.01554,"percentile":0.75152}],"risk":0.777,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9230"},"relatedVulnerabilities":[{"id":"CVE-2025-9230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-11-02","epss":0.01554,"percentile":0.75152}],"urls":["https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45","https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280","https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def","https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd","https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482","https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3","https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5","https://lists.debian.org/debian-lts-announce/2025/10/msg00001.html","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","description":"Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary."}]},{"artifact":{"id":"e6933be022de0634","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.20"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-9230","versionConstraint":"< 3.0.2-0ubuntu1.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-9230","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.20"],"available":[{"date":"2025-09-30","kind":"advisory","version":"3.0.2-0ubuntu1.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-11-02","epss":0.01554,"percentile":0.75152}],"risk":0.777,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9230"},"relatedVulnerabilities":[{"id":"CVE-2025-9230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-11-02","epss":0.01554,"percentile":0.75152}],"urls":["https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45","https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280","https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def","https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd","https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482","https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3","https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5","https://lists.debian.org/debian-lts-announce/2025/10/msg00001.html","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","description":"Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary."}]},{"artifact":{"id":"b051bfff7d8ef5fa","cpes":["cpe:2.3:a:apache:kafka-clients:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:kafka_clients:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:kafka:3.5.1:*:*:*:*:*:*:*"],"name":"kafka-clients","purl":"pkg:maven/org.apache.kafka/kafka-clients@3.5.1","type":"java-archive","version":"3.5.1","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.kafka","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/kafka-clients-3.5.1.jar","manifestName":"","pomArtifactID":"kafka-clients","archiveDigests":[{"value":"2675a2dc48735f75d0694ca8bd8d4d3cb3737c17","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/kafka-clients-3.5.1.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/kafka-clients-3.5.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.7.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2x2g-32r7-p4x8","versionConstraint":">=2.3.0,<3.7.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.kafka:kafka-clients","version":"3.5.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-2x2g-32r7-p4x8","fix":{"state":"fixed","versions":["3.7.1"],"available":[{"date":"2024-11-20","kind":"first-observed","version":"3.7.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31141","cwe":"CWE-269","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2024-31141","cwe":"CWE-552","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-31141","date":"2026-11-02","epss":0.0133,"percentile":0.71055}],"risk":0.774725,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-31141","https://lists.apache.org/thread/9whdzfr0zwdhr364604w5ssnzmg4v2lv","https://security.netapp.com/advisory/ntap-20250131-0001","http://www.openwall.com/lists/oss-security/2024/11/18/5"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2x2g-32r7-p4x8","description":"Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider"},"relatedVulnerabilities":[{"id":"CVE-2024-31141","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31141","cwe":"CWE-269","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2024-31141","cwe":"CWE-552","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-31141","date":"2026-11-02","epss":0.0133,"percentile":0.71055}],"urls":["https://lists.apache.org/thread/9whdzfr0zwdhr364604w5ssnzmg4v2lv","http://www.openwall.com/lists/oss-security/2024/11/18/5","https://security.netapp.com/advisory/ntap-20250131-0001/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31141","description":"Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients.\n\nApache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables.\nIn applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.\n\nIn particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products.\nThis issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0.\n\n\nUsers with affected applications are recommended to upgrade kafka-clients to version >=3.8.0, and set the JVM system property \"org.apache.kafka.automatic.config.providers=none\".\nUsers of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate \"allowlist.pattern\" and \"allowed.paths\" to restrict their operation to appropriate bounds.\n\n\nFor users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property.\nFor users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property."}]},{"artifact":{"id":"fb59295dfaa83cc8","cpes":["cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:io.netty:netty-handler","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3qp7-7mw8-wx86","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3qp7-7mw8-wx86","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-11-02","epss":0.00987,"percentile":0.62422}],"risk":0.7698600000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-44249"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3qp7-7mw8-wx86","description":"Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking"},"relatedVulnerabilities":[{"id":"CVE-2026-44249","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-11-02","epss":0.00987,"percentile":0.62422}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44249","https://bugzilla.redhat.com/show_bug.cgi?id=2488081","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44249","description":"Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"89fd601f024d673b","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-handler-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"4c0acdb8bb73647ebb3847ac2d503d53d72c02b4","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-handler-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3qp7-7mw8-wx86","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3qp7-7mw8-wx86","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-11-02","epss":0.00987,"percentile":0.62422}],"risk":0.7698600000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-44249"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3qp7-7mw8-wx86","description":"Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking"},"relatedVulnerabilities":[{"id":"CVE-2026-44249","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-11-02","epss":0.00987,"percentile":0.62422}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44249","https://bugzilla.redhat.com/show_bug.cgi?id=2488081","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44249","description":"Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"e23b3db52150d31e","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-handler-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"4c0acdb8bb73647ebb3847ac2d503d53d72c02b4","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-handler-4.1.100.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-handler-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3qp7-7mw8-wx86","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3qp7-7mw8-wx86","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-11-02","epss":0.00987,"percentile":0.62422}],"risk":0.7698600000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-44249"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3qp7-7mw8-wx86","description":"Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking"},"relatedVulnerabilities":[{"id":"CVE-2026-44249","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-11-02","epss":0.00987,"percentile":0.62422}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44249","https://bugzilla.redhat.com/show_bug.cgi?id=2488081","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44249","description":"Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"76376ee746ecb41b","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-handler-4.1.101.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"7800aea949bf95f63df73166d144e49405b279dd","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-handler-4.1.101.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-handler-4.1.101.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3qp7-7mw8-wx86","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3qp7-7mw8-wx86","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-11-02","epss":0.00987,"percentile":0.62422}],"risk":0.7698600000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-44249"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3qp7-7mw8-wx86","description":"Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking"},"relatedVulnerabilities":[{"id":"CVE-2026-44249","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-11-02","epss":0.00987,"percentile":0.62422}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44249","https://bugzilla.redhat.com/show_bug.cgi?id=2488081","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44249","description":"Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"c157d2710f492255","cpes":["cpe:2.3:a:netty-handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/micrometer-registry-statsd-1.11.6.jar:io.netty:netty-handler","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/micrometer-registry-statsd-1.11.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3qp7-7mw8-wx86","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3qp7-7mw8-wx86","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-11-02","epss":0.00987,"percentile":0.62422}],"risk":0.7698600000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-44249"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3qp7-7mw8-wx86","description":"Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking"},"relatedVulnerabilities":[{"id":"CVE-2026-44249","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-11-02","epss":0.00987,"percentile":0.62422}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44249","https://bugzilla.redhat.com/show_bug.cgi?id=2488081","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44249","description":"Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"5491f3e702333e3e","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-handler-4.1.101.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"7800aea949bf95f63df73166d144e49405b279dd","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-handler-4.1.101.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-handler-4.1.101.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3qp7-7mw8-wx86","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3qp7-7mw8-wx86","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-11-02","epss":0.00987,"percentile":0.62422}],"risk":0.7698600000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-44249"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3qp7-7mw8-wx86","description":"Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking"},"relatedVulnerabilities":[{"id":"CVE-2026-44249","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-11-02","epss":0.00987,"percentile":0.62422}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44249","https://bugzilla.redhat.com/show_bug.cgi?id=2488081","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44249","description":"Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"8807c52b963c5b8b","cpes":["cpe:2.3:a:netty-codec-dns:netty-codec-dns:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-dns:netty_codec_dns:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_dns:netty-codec-dns:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_dns:netty_codec_dns:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-dns:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_dns:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-dns:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_dns:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-dns:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_dns:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-dns:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_dns:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-codec-dns","purl":"pkg:maven/io.netty/netty-codec-dns@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/micrometer-registry-statsd-1.11.6.jar:io.netty:netty-codec-dns","manifestName":"","pomArtifactID":"netty-codec-dns","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/micrometer-registry-statsd-1.11.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cm33-6792-r9fm","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-dns","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cm33-6792-r9fm","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42579","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-626","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-1286","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42579","date":"2026-11-02","epss":0.01006,"percentile":0.63021}],"risk":0.7545,"urls":["https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm","https://tools.ietf.org/html/rfc1035#section-2.3.4","https://tools.ietf.org/html/rfc1035#section-4.1.4","https://nvd.nist.gov/vuln/detail/CVE-2026-42579"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cm33-6792-r9fm","description":"Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)"},"relatedVulnerabilities":[{"id":"CVE-2026-42579","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42579","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-626","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-1286","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42579","date":"2026-11-02","epss":0.01006,"percentile":0.63021}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/security/cve/CVE-2026-42579","https://bugzilla.redhat.com/show_bug.cgi?id=2477217","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42579.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42579","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"9a1d6897fd0c0ecf","cpes":["cpe:2.3:a:org.springframework.security:spring-security-core:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_core:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:spring-security-core:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:spring_security_core:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:spring-security-core:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:spring_security_core:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:spring_security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-core:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_core:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-core:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_core:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:spring_security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-core:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_core:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-core:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_core:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-core:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_core:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring-security-core:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_security_core:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:security:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:vmware:security:5.8.9:*:*:*:*:*:*:*"],"name":"spring-security-core","purl":"pkg:maven/org.springframework.security/spring-security-core@5.8.9","type":"java-archive","version":"5.8.9","language":"java","licenses":[],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-security-core-5.8.9.jar","manifestName":"","pomArtifactID":"spring-security-core","archiveDigests":[{"value":"c9e12dfc323b313cf1c75d89af65d408debce306","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-security-core-5.8.9.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-security-core-5.8.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.8.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f3jh-qvm4-mg39","versionConstraint":">=5.8.0,<5.8.11 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-core","version":"5.8.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f3jh-qvm4-mg39","fix":{"state":"fixed","versions":["5.8.11"],"available":[{"date":"2024-03-19","kind":"first-observed","version":"5.8.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-22257","cwe":"CWE-862","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-22257","date":"2026-11-02","epss":0.00956,"percentile":0.61419}],"risk":0.75046,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-22257","https://spring.io/security/cve-2024-22257","https://github.com/spring-projects/spring-security/commit/5a7f12f1a9fdb4edaab6f61495f1d781a7273b61","https://security.netapp.com/advisory/ntap-20240419-0005"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f3jh-qvm4-mg39","description":"Erroneous authentication pass in Spring Security"},"relatedVulnerabilities":[{"id":"CVE-2024-22257","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-22257","cwe":"CWE-862","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-22257","date":"2026-11-02","epss":0.00956,"percentile":0.61419}],"urls":["https://security.netapp.com/advisory/ntap-20240419-0005/","https://spring.io/security/cve-2024-22257","https://github.com/dependency-check/DependencyCheck/issues/8642"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-22257","description":"In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to \n5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, \nversions 6.2.x prior to 6.2.3, an application is possible vulnerable to \nbroken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter."}]},{"artifact":{"id":"3a060baa137f74ea","cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@17.0.10%2B7?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk17u.git","type":"binary","version":"17.0.10+7","language":"","licenses":[],"metadata":{"release":{"fullVersion":"17.0.10+7","javaVersion":"17.0.10","semanticVersion":"17.0.10+7","javaRuntimeVersion":"17.0.10+7"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:8b8fefae6897ed4bfb12e519d4bdcaca9564779609395dcc3238ea1d369600aa","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"17.0.18"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-21945","versionConstraint":"< 1.8.0_482||>= 1.9, < 8.0.482||>= 12, < 17.0.18||>= 18, < 21.0.10||>= 22, < 25.0.2||>= 9, < 11.0.30 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"17.0.10+7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-21945","fix":{"state":"fixed","versions":["1.8.0_482","8.0.482","11.0.30","17.0.18","21.0.10","25.0.2"],"available":[{"date":"2026-01-27","kind":"first-observed","version":"1.8.0_482"},{"date":"2026-01-27","kind":"first-observed","version":"8.0.482"},{"date":"2026-01-27","kind":"first-observed","version":"17.0.18"},{"date":"2026-01-27","kind":"first-observed","version":"21.0.10"},{"date":"2026-01-27","kind":"first-observed","version":"25.0.2"},{"date":"2026-01-27","kind":"first-observed","version":"11.0.30"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21945","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-21945","cwe":"CWE-295","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-21945","date":"2026-11-02","epss":0.00992,"percentile":0.6258}],"risk":0.744,"urls":["https://www.oracle.com/security-alerts/cpujan2026.html","https://access.redhat.com/errata/RHSA-2026:0847","https://access.redhat.com/errata/RHSA-2026:0848","https://access.redhat.com/errata/RHSA-2026:0895","https://access.redhat.com/errata/RHSA-2026:0897","https://access.redhat.com/errata/RHSA-2026:0899","https://access.redhat.com/errata/RHSA-2026:0901","https://access.redhat.com/errata/RHSA-2026:0927","https://access.redhat.com/errata/RHSA-2026:0928","https://access.redhat.com/errata/RHSA-2026:0931","https://access.redhat.com/errata/RHSA-2026:0932","https://access.redhat.com/errata/RHSA-2026:0933","https://access.redhat.com/errata/RHSA-2026:1606","https://access.redhat.com/errata/RHSA-2026:4832","https://access.redhat.com/security/cve/CVE-2026-21945","https://bugzilla.redhat.com/show_bug.cgi?id=2429927","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21945.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21945","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and  21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."},"relatedVulnerabilities":[]},{"artifact":{"id":"e3d98c49743c8191","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f6hv-jmp6-3vwv","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f6hv-jmp6-3vwv","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"risk":0.7425000000000002,"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://nvd.nist.gov/vuln/detail/CVE-2026-42587"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","description":"Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42587","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42587","https://bugzilla.redhat.com/show_bug.cgi?id=2477220","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"e6711addddd64a36","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f6hv-jmp6-3vwv","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f6hv-jmp6-3vwv","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"risk":0.7425000000000002,"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://nvd.nist.gov/vuln/detail/CVE-2026-42587"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","description":"Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42587","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42587","https://bugzilla.redhat.com/show_bug.cgi?id=2477220","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"3a71b2136cbaef6c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f6hv-jmp6-3vwv","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f6hv-jmp6-3vwv","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"risk":0.7425000000000002,"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://nvd.nist.gov/vuln/detail/CVE-2026-42587"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","description":"Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42587","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42587","https://bugzilla.redhat.com/show_bug.cgi?id=2477220","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"d68e99b783ccdee5","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"c648f863b301e3fc62d0de098ec61be7628b8ea2","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f6hv-jmp6-3vwv","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f6hv-jmp6-3vwv","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"risk":0.7425000000000002,"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://nvd.nist.gov/vuln/detail/CVE-2026-42587"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","description":"Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42587","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42587","https://bugzilla.redhat.com/show_bug.cgi?id=2477220","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"2692d67b14b4b286","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"c648f863b301e3fc62d0de098ec61be7628b8ea2","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f6hv-jmp6-3vwv","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f6hv-jmp6-3vwv","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"risk":0.7425000000000002,"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://nvd.nist.gov/vuln/detail/CVE-2026-42587"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","description":"Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42587","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42587","https://bugzilla.redhat.com/show_bug.cgi?id=2477220","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"77f4a1a56c253c3b","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f6hv-jmp6-3vwv","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f6hv-jmp6-3vwv","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"risk":0.7425000000000002,"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://nvd.nist.gov/vuln/detail/CVE-2026-42587"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","description":"Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42587","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42587","https://bugzilla.redhat.com/show_bug.cgi?id=2477220","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"d8682c7fc9d4337d","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http2-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"cbf1a430ea44dbdedbcde16b185cbb95f28d72c7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http2-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f6hv-jmp6-3vwv","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f6hv-jmp6-3vwv","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"risk":0.7425000000000002,"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://nvd.nist.gov/vuln/detail/CVE-2026-42587"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","description":"Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42587","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42587","https://bugzilla.redhat.com/show_bug.cgi?id=2477220","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"eae37dd4ad8fc905","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http2-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"cbf1a430ea44dbdedbcde16b185cbb95f28d72c7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http2-4.1.100.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http2-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f6hv-jmp6-3vwv","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f6hv-jmp6-3vwv","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"risk":0.7425000000000002,"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://nvd.nist.gov/vuln/detail/CVE-2026-42587"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","description":"Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42587","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42587","https://bugzilla.redhat.com/show_bug.cgi?id=2477220","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.105"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h2fw-rfh5-95r3","versionConstraint":">=9.0.0.M1,<9.0.105 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h2fw-rfh5-95r3","fix":{"state":"fixed","versions":["9.0.105"],"available":[{"date":"2025-05-30","kind":"first-observed","version":"9.0.105"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear","metrics":{"baseScore":1.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-46701","cwe":"CWE-178","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-46701","date":"2026-11-02","epss":0.03143,"percentile":0.87918}],"risk":0.738605,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-46701","https://lists.apache.org/thread/xhqqk9w5q45srcdqhogdk04lhdscv30j","https://github.com/apache/tomcat/commit/0f01966eb60015d975525019e12a087f05ebf01a","https://github.com/apache/tomcat/commit/238d2aa54b99f91d1111467e2237d2244c64e558","https://github.com/apache/tomcat/commit/2c6800111e7d8d8d5403c07978ea9bff3db5a5a5","https://github.com/apache/tomcat/commit/8cb95ff03221067c511b3fa66d4f745bc4b0a605","https://github.com/apache/tomcat/commit/8df00018a252baa9497615d6420fb6c10466fa74","https://github.com/apache/tomcat/commit/fab7247d2f0e3a29d5daef565f829f383e10e5e2","https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.41","https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.7","https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.105","http://www.openwall.com/lists/oss-security/2025/05/29/4","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h2fw-rfh5-95r3","description":"Apache Tomcat - CGI security constraint bypass"},"relatedVulnerabilities":[{"id":"CVE-2025-46701","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-46701","cwe":"CWE-178","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-46701","date":"2026-11-02","epss":0.03143,"percentile":0.87918}],"urls":["https://lists.apache.org/thread/xhqqk9w5q45srcdqhogdk04lhdscv30j","http://www.openwall.com/lists/oss-security/2025/05/29/4","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-46701","description":"Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue."}]},{"artifact":{"id":"842dbc9fb51686ce","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.4:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.4?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.4","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-32988","versionConstraint":"< 3.7.3-4ubuntu1.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.4"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-32988","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.7"],"available":[{"date":"2025-07-14","kind":"advisory","version":"3.7.3-4ubuntu1.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-32988","cwe":"CWE-415","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32988","date":"2026-11-02","epss":0.01475,"percentile":0.73832}],"risk":0.7374999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-32988"},"relatedVulnerabilities":[{"id":"CVE-2025-32988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-32988","cwe":"CWE-415","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32988","date":"2026-11-02","epss":0.01475,"percentile":0.73832}],"urls":["https://access.redhat.com/errata/RHSA-2025:16115","https://access.redhat.com/errata/RHSA-2025:16116","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:17348","https://access.redhat.com/errata/RHSA-2025:17361","https://access.redhat.com/errata/RHSA-2025:17415","https://access.redhat.com/errata/RHSA-2025:19088","https://access.redhat.com/errata/RHSA-2025:22529","https://access.redhat.com/errata/RHSA-2026:7477","https://access.redhat.com/security/cve/CVE-2025-32988","https://bugzilla.redhat.com/show_bug.cgi?id=2359622","https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html","http://www.openwall.com/lists/oss-security/2025/07/11/3","https://lists.debian.org/debian-lts-announce/2025/08/msg00005.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-32988","description":"A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure.\n\nThis vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior."}]},{"artifact":{"id":"c1e86990bac3051c","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.75","type":"java-archive","version":"1.75","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"df22e1b6a9f6b218913f5b68dd16641344397fe0","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.80.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p93r-85wp-75v3","versionConstraint":">=1.71,<1.80.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.75"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p93r-85wp-75v3","fix":{"state":"fixed","versions":["1.80.2"],"available":[{"date":"2026-06-19","kind":"first-observed","version":"1.80.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/S:P/AU:Y/U:Red","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5598","cwe":"CWE-385","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-5598","cwe":"CWE-385","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-5598","date":"2026-11-02","epss":0.00899,"percentile":0.59632}],"risk":0.7371800000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-5598","https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5","https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87","https://github.com/bcgit/bc-java/wiki/CVE-2026-5598","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p93r-85wp-75v3","description":"Bouncy Castle Has Covert Timing Channel Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-5598","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:Red","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5598","cwe":"CWE-385","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-5598","cwe":"CWE-385","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-5598","date":"2026-11-02","epss":0.00899,"percentile":0.59632}],"urls":["https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5","https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598","https://access.redhat.com/errata/RHSA-2026:12267","https://access.redhat.com/errata/RHSA-2026:12269","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/security/cve/CVE-2026-5598","https://bugzilla.redhat.com/show_bug.cgi?id=2458635","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5598.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5598","description":"Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules).\n\n This vulnerability is associated with program files FrodoEngine.Java.\n\n\n\nThis issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84."}]},{"artifact":{"id":"44e84e19af66323e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.12.7.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1","type":"java-archive","version":"2.12.7.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.12.7.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"bb77fcffb9ecc2cc","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2","type":"java-archive","version":"2.13.4.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar:META-INF/lib/jackson-databind-2.13.4.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"325c06bdfeb628cfb80ebaaf1a26cc1eb558a585","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar:META-INF/lib/jackson-databind-2.13.4.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.13.4.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"0fb142b267f8963c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2","type":"java-archive","version":"2.13.4.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.13.4.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"148d0e1e06039376","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/jackson-databind-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"01e71fddbc80bb86f71a6345ac1e8ab8a00e7134","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/jackson-databind-2.14.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/jackson-databind-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"abf07cd44e688c5e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/opensearch/lib/tools/upgrade-cli/jackson-databind-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"01e71fddbc80bb86f71a6345ac1e8ab8a00e7134","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/lib/tools/upgrade-cli/jackson-databind-2.14.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/lib/tools/upgrade-cli/jackson-databind-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"4d0c3abee3ce4445","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-remote-event-common-plugin-7.0.1.jar:META-INF/lib/jackson-databind-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"01e71fddbc80bb86f71a6345ac1e8ab8a00e7134","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-remote-event-common-plugin-7.0.1.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-remote-event-common-plugin-7.0.1.jar:META-INF/lib/jackson-databind-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"96e49eed88feacc3","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/opensearch/modules/ingest-geoip/jackson-databind-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"01e71fddbc80bb86f71a6345ac1e8ab8a00e7134","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/modules/ingest-geoip/jackson-databind-2.14.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/modules/ingest-geoip/jackson-databind-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"67df6d98175155b6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/signalfx-java-1.0.36.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/signalfx-java-1.0.36.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"90999fe659e21a85","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-plugin-2.4.3.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-plugin-2.4.3.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-plugin-2.4.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"6c1f803e9e3094a1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/applinks-plugin-9.2.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/applinks-plugin-9.2.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/applinks-plugin-9.2.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"17a6603b2c8c52c8","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/jackson-databind-2.15.3.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"a734bc2c47a9453c4efa772461a3aeb273c010d9","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/jackson-databind-2.15.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"2655c2da825d89d6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1","type":"java-archive","version":"2.16.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-search-8.18.0.jar:META-INF/lib/jackson-databind-2.16.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"02a16efeb840c45af1e2f31753dfe76795278b73","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-search-8.18.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-search-8.18.0.jar:META-INF/lib/jackson-databind-2.16.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"7fb7ae836158dda2","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1","type":"java-archive","version":"2.16.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/jackson-databind-2.16.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"02a16efeb840c45af1e2f31753dfe76795278b73","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/jackson-databind-2.16.1.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/jackson-databind-2.16.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"842dbc9fb51686ce","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.4:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.4?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.4","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-32989","versionConstraint":"< 3.7.3-4ubuntu1.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.4"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-32989","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.7"],"available":[{"date":"2025-07-14","kind":"advisory","version":"3.7.3-4ubuntu1.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-32989","cwe":"CWE-295","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32989","date":"2026-11-02","epss":0.01467,"percentile":0.73702}],"risk":0.7335,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-32989"},"relatedVulnerabilities":[{"id":"CVE-2025-32989","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-32989","cwe":"CWE-295","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32989","date":"2026-11-02","epss":0.01467,"percentile":0.73702}],"urls":["https://access.redhat.com/errata/RHSA-2025:16115","https://access.redhat.com/errata/RHSA-2025:16116","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:17348","https://access.redhat.com/errata/RHSA-2025:17361","https://access.redhat.com/errata/RHSA-2025:19088","https://access.redhat.com/errata/RHSA-2025:22529","https://access.redhat.com/errata/RHSA-2026:7477","https://access.redhat.com/security/cve/CVE-2025-32989","https://bugzilla.redhat.com/show_bug.cgi?id=2359621","https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html","http://www.openwall.com/lists/oss-security/2025/07/11/3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-32989","description":"A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly."}]},{"artifact":{"id":"1f5838a9ab54e0b2","cpes":["cpe:2.3:a:apache:cxf-rt-rs-security-jose:3.5.5:*:*:*:*:*:*:*","cpe:2.3:a:apache:cxf_rt_rs_security_jose:3.5.5:*:*:*:*:*:*:*","cpe:2.3:a:apache:cxf:3.5.5:*:*:*:*:*:*:*"],"name":"cxf-rt-rs-security-jose","purl":"pkg:maven/org.apache.cxf/cxf-rt-rs-security-jose@3.5.5","type":"java-archive","version":"3.5.5","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.cxf","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/cxf-rt-rs-security-jose-3.5.5.jar","manifestName":"","pomArtifactID":"cxf-rt-rs-security-jose","archiveDigests":[{"value":"d90843e609e7a3068139c95a81f18fa2c2c7fefa","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/cxf-rt-rs-security-jose-3.5.5.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/cxf-rt-rs-security-jose-3.5.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6pff-fmh2-4mmf","versionConstraint":"<3.5.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.cxf:cxf-rt-rs-security-jose","version":"3.5.5"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6pff-fmh2-4mmf","fix":{"state":"fixed","versions":["3.5.9"],"available":[{"date":"2024-07-20","kind":"first-observed","version":"3.5.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32007","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2024-32007","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-32007","date":"2026-11-02","epss":0.01314,"percentile":0.70706}],"risk":0.7292699999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-32007","https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633","https://github.com/apache/cxf/commit/20793d3fed2e73e2785a58ec5b47403306ae4a5c","https://github.com/apache/cxf/commit/2d2baa3455db7439bf1ed4e00edfc5a7106edf7d","https://github.com/apache/cxf/commit/d1d77c34c199c2c87ebcfe23e3c81dccfe2e2473"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6pff-fmh2-4mmf","description":"Apache CXF Denial of Service vulnerability in JOSE"},"relatedVulnerabilities":[{"id":"CVE-2024-32007","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32007","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2024-32007","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-32007","date":"2026-11-02","epss":0.01314,"percentile":0.70706}],"urls":["https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633","http://www.openwall.com/lists/oss-security/2024/07/18/3","https://security.netapp.com/advisory/ntap-20240808-0009/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32007","description":"An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token."}]},{"artifact":{"id":"e3d98c49743c8191","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.108.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jpm-x58v-624v","versionConstraint":"<4.1.108.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jpm-x58v-624v","fix":{"state":"fixed","versions":["4.1.108.Final"],"available":[{"date":"2024-03-26","kind":"first-observed","version":"4.1.108.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29025","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-29025","date":"2026-11-02","epss":0.0138,"percentile":0.72123}],"risk":0.7107,"urls":["https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v","https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3","https://github.com/vietj/netty/tree/post-request-decoder","https://nvd.nist.gov/vuln/detail/CVE-2024-29025","https://lists.debian.org/debian-lts-announce/2024/06/msg00015.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jpm-x58v-624v","description":"Netty's HttpPostRequestDecoder can OOM"},"relatedVulnerabilities":[{"id":"CVE-2024-29025","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29025","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-29025","date":"2026-11-02","epss":0.0138,"percentile":0.72123}],"urls":["https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3","https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v","https://lists.debian.org/debian-lts-announce/2024/06/msg00015.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-29025","description":"Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final."}]},{"artifact":{"id":"e6711addddd64a36","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.108.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jpm-x58v-624v","versionConstraint":"<4.1.108.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jpm-x58v-624v","fix":{"state":"fixed","versions":["4.1.108.Final"],"available":[{"date":"2024-03-26","kind":"first-observed","version":"4.1.108.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29025","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-29025","date":"2026-11-02","epss":0.0138,"percentile":0.72123}],"risk":0.7107,"urls":["https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v","https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3","https://github.com/vietj/netty/tree/post-request-decoder","https://nvd.nist.gov/vuln/detail/CVE-2024-29025","https://lists.debian.org/debian-lts-announce/2024/06/msg00015.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jpm-x58v-624v","description":"Netty's HttpPostRequestDecoder can OOM"},"relatedVulnerabilities":[{"id":"CVE-2024-29025","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29025","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-29025","date":"2026-11-02","epss":0.0138,"percentile":0.72123}],"urls":["https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3","https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v","https://lists.debian.org/debian-lts-announce/2024/06/msg00015.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-29025","description":"Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final."}]},{"artifact":{"id":"3a71b2136cbaef6c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.108.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jpm-x58v-624v","versionConstraint":"<4.1.108.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jpm-x58v-624v","fix":{"state":"fixed","versions":["4.1.108.Final"],"available":[{"date":"2024-03-26","kind":"first-observed","version":"4.1.108.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29025","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-29025","date":"2026-11-02","epss":0.0138,"percentile":0.72123}],"risk":0.7107,"urls":["https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v","https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3","https://github.com/vietj/netty/tree/post-request-decoder","https://nvd.nist.gov/vuln/detail/CVE-2024-29025","https://lists.debian.org/debian-lts-announce/2024/06/msg00015.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jpm-x58v-624v","description":"Netty's HttpPostRequestDecoder can OOM"},"relatedVulnerabilities":[{"id":"CVE-2024-29025","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29025","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-29025","date":"2026-11-02","epss":0.0138,"percentile":0.72123}],"urls":["https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3","https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v","https://lists.debian.org/debian-lts-announce/2024/06/msg00015.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-29025","description":"Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final."}]},{"artifact":{"id":"d68e99b783ccdee5","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"c648f863b301e3fc62d0de098ec61be7628b8ea2","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.108.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jpm-x58v-624v","versionConstraint":"<4.1.108.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jpm-x58v-624v","fix":{"state":"fixed","versions":["4.1.108.Final"],"available":[{"date":"2024-03-26","kind":"first-observed","version":"4.1.108.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29025","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-29025","date":"2026-11-02","epss":0.0138,"percentile":0.72123}],"risk":0.7107,"urls":["https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v","https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3","https://github.com/vietj/netty/tree/post-request-decoder","https://nvd.nist.gov/vuln/detail/CVE-2024-29025","https://lists.debian.org/debian-lts-announce/2024/06/msg00015.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jpm-x58v-624v","description":"Netty's HttpPostRequestDecoder can OOM"},"relatedVulnerabilities":[{"id":"CVE-2024-29025","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29025","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-29025","date":"2026-11-02","epss":0.0138,"percentile":0.72123}],"urls":["https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3","https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v","https://lists.debian.org/debian-lts-announce/2024/06/msg00015.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-29025","description":"Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final."}]},{"artifact":{"id":"2692d67b14b4b286","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"c648f863b301e3fc62d0de098ec61be7628b8ea2","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.108.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jpm-x58v-624v","versionConstraint":"<4.1.108.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jpm-x58v-624v","fix":{"state":"fixed","versions":["4.1.108.Final"],"available":[{"date":"2024-03-26","kind":"first-observed","version":"4.1.108.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29025","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-29025","date":"2026-11-02","epss":0.0138,"percentile":0.72123}],"risk":0.7107,"urls":["https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v","https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3","https://github.com/vietj/netty/tree/post-request-decoder","https://nvd.nist.gov/vuln/detail/CVE-2024-29025","https://lists.debian.org/debian-lts-announce/2024/06/msg00015.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jpm-x58v-624v","description":"Netty's HttpPostRequestDecoder can OOM"},"relatedVulnerabilities":[{"id":"CVE-2024-29025","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29025","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-29025","date":"2026-11-02","epss":0.0138,"percentile":0.72123}],"urls":["https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3","https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v","https://lists.debian.org/debian-lts-announce/2024/06/msg00015.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-29025","description":"Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.121"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9xv2-5v5q-p794","versionConstraint":">=9.0.0.M1,<9.0.121 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9xv2-5v5q-p794","fix":{"state":"fixed","versions":["9.0.121"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"9.0.121"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65905","cwe":"CWE-294","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-65905","date":"2026-11-02","epss":0.00755,"percentile":0.55122}],"risk":0.7097000000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-65905","https://lists.apache.org/thread/9v114xlpgbzrrbzz5vf9f6r2q4wnxwwj","http://www.openwall.com/lists/oss-security/2026/08/26/4"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9xv2-5v5q-p794","description":"Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-65905","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65905","cwe":"CWE-294","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-65905","date":"2026-11-02","epss":0.00755,"percentile":0.55122}],"urls":["https://lists.apache.org/thread/9v114xlpgbzrrbzz5vf9f6r2q4wnxwwj","http://www.openwall.com/lists/oss-security/2026/08/26/4"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65905","description":"Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST \nauthenticated request with a nonceCount on the upper boundary of the \nreplay window then that request is replayable once only while the \nassociated nonceCount remains within the replay window.\n\n\n\n \n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue."}]},{"artifact":{"id":"af534de498eed696","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-45492","versionConstraint":"< 2.4.7-1ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-45492","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.4"],"available":[{"date":"2024-09-17","kind":"advisory","version":"2.4.7-1ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-45492","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45492","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45492","date":"2026-11-02","epss":0.01393,"percentile":0.72369}],"risk":0.6965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-45492"},"relatedVulnerabilities":[{"id":"CVE-2024-45492","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-45492","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45492","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45492","date":"2026-11-02","epss":0.01393,"percentile":0.72369}],"urls":["https://github.com/libexpat/libexpat/issues/889","https://github.com/libexpat/libexpat/pull/892","https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html","https://security.netapp.com/advisory/ntap-20241018-0005/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45492","description":"An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX)."}]},{"artifact":{"id":"23731e55f78e12a9","cpes":["cpe:2.3:a:libexpat1-dev:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1-dev:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1_dev:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1_dev:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1-dev","purl":"pkg:deb/ubuntu/libexpat1-dev@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1-dev/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libexpat1-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libexpat1-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-45492","versionConstraint":"< 2.4.7-1ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-45492","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.4"],"available":[{"date":"2024-09-17","kind":"advisory","version":"2.4.7-1ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-45492","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45492","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45492","date":"2026-11-02","epss":0.01393,"percentile":0.72369}],"risk":0.6965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-45492"},"relatedVulnerabilities":[{"id":"CVE-2024-45492","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-45492","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45492","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45492","date":"2026-11-02","epss":0.01393,"percentile":0.72369}],"urls":["https://github.com/libexpat/libexpat/issues/889","https://github.com/libexpat/libexpat/pull/892","https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html","https://security.netapp.com/advisory/ntap-20241018-0005/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45492","description":"An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX)."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7592","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-7592","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-11-02","epss":0.02303,"percentile":0.83325}],"risk":0.6909,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7592"},"relatedVulnerabilities":[{"id":"CVE-2024-7592","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-11-02","epss":0.02303,"percentile":0.83325}],"urls":["https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621","https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef","https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06","https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a","https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f","https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774","https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1","https://github.com/python/cpython/issues/123067","https://github.com/python/cpython/pull/123075","https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7592","description":"There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7592","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-7592","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-11-02","epss":0.02303,"percentile":0.83325}],"risk":0.6909,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7592"},"relatedVulnerabilities":[{"id":"CVE-2024-7592","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-11-02","epss":0.02303,"percentile":0.83325}],"urls":["https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621","https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef","https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06","https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a","https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f","https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774","https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1","https://github.com/python/cpython/issues/123067","https://github.com/python/cpython/pull/123075","https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7592","description":"There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-7592","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-7592","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-11-02","epss":0.02303,"percentile":0.83325}],"risk":0.6909,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7592"},"relatedVulnerabilities":[{"id":"CVE-2024-7592","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-11-02","epss":0.02303,"percentile":0.83325}],"urls":["https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621","https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef","https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06","https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a","https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f","https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774","https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1","https://github.com/python/cpython/issues/123067","https://github.com/python/cpython/pull/123075","https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7592","description":"There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7592","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-7592","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-11-02","epss":0.02303,"percentile":0.83325}],"risk":0.6909,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7592"},"relatedVulnerabilities":[{"id":"CVE-2024-7592","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-11-02","epss":0.02303,"percentile":0.83325}],"urls":["https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621","https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef","https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06","https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a","https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f","https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774","https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1","https://github.com/python/cpython/issues/123067","https://github.com/python/cpython/pull/123075","https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7592","description":"There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue."}]},{"artifact":{"id":"fb59295dfaa83cc8","cpes":["cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:io.netty:netty-handler","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x4gw-5cx5-pgmh","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-x4gw-5cx5-pgmh","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-11-02","epss":0.00921,"percentile":0.6031}],"risk":0.69075,"urls":["https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-45416"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x4gw-5cx5-pgmh","description":"Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes"},"relatedVulnerabilities":[{"id":"CVE-2026-45416","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-11-02","epss":0.00921,"percentile":0.6031}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-45416","https://bugzilla.redhat.com/show_bug.cgi?id=2488391","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45416","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"89fd601f024d673b","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-handler-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"4c0acdb8bb73647ebb3847ac2d503d53d72c02b4","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-handler-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x4gw-5cx5-pgmh","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-x4gw-5cx5-pgmh","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-11-02","epss":0.00921,"percentile":0.6031}],"risk":0.69075,"urls":["https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-45416"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x4gw-5cx5-pgmh","description":"Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes"},"relatedVulnerabilities":[{"id":"CVE-2026-45416","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-11-02","epss":0.00921,"percentile":0.6031}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-45416","https://bugzilla.redhat.com/show_bug.cgi?id=2488391","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45416","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"e23b3db52150d31e","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-handler-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"4c0acdb8bb73647ebb3847ac2d503d53d72c02b4","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-handler-4.1.100.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-handler-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x4gw-5cx5-pgmh","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-x4gw-5cx5-pgmh","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-11-02","epss":0.00921,"percentile":0.6031}],"risk":0.69075,"urls":["https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-45416"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x4gw-5cx5-pgmh","description":"Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes"},"relatedVulnerabilities":[{"id":"CVE-2026-45416","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-11-02","epss":0.00921,"percentile":0.6031}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-45416","https://bugzilla.redhat.com/show_bug.cgi?id=2488391","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45416","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"c157d2710f492255","cpes":["cpe:2.3:a:netty-handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/micrometer-registry-statsd-1.11.6.jar:io.netty:netty-handler","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/micrometer-registry-statsd-1.11.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x4gw-5cx5-pgmh","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-x4gw-5cx5-pgmh","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-11-02","epss":0.00921,"percentile":0.6031}],"risk":0.69075,"urls":["https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-45416"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x4gw-5cx5-pgmh","description":"Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes"},"relatedVulnerabilities":[{"id":"CVE-2026-45416","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-11-02","epss":0.00921,"percentile":0.6031}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-45416","https://bugzilla.redhat.com/show_bug.cgi?id=2488391","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45416","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"76376ee746ecb41b","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-handler-4.1.101.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"7800aea949bf95f63df73166d144e49405b279dd","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-handler-4.1.101.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-handler-4.1.101.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x4gw-5cx5-pgmh","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-x4gw-5cx5-pgmh","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-11-02","epss":0.00921,"percentile":0.6031}],"risk":0.69075,"urls":["https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-45416"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x4gw-5cx5-pgmh","description":"Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes"},"relatedVulnerabilities":[{"id":"CVE-2026-45416","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-11-02","epss":0.00921,"percentile":0.6031}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-45416","https://bugzilla.redhat.com/show_bug.cgi?id=2488391","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45416","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"5491f3e702333e3e","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-handler-4.1.101.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"7800aea949bf95f63df73166d144e49405b279dd","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-handler-4.1.101.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-handler-4.1.101.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x4gw-5cx5-pgmh","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-x4gw-5cx5-pgmh","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-11-02","epss":0.00921,"percentile":0.6031}],"risk":0.69075,"urls":["https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-45416"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x4gw-5cx5-pgmh","description":"Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes"},"relatedVulnerabilities":[{"id":"CVE-2026-45416","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-11-02","epss":0.00921,"percentile":0.6031}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-45416","https://bugzilla.redhat.com/show_bug.cgi?id=2488391","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45416","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"af534de498eed696","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-59375","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-59375","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-59375","cwe":"CWE-770","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-59375","date":"2026-11-02","epss":0.0138,"percentile":0.72119}],"risk":0.69,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-59375"},"relatedVulnerabilities":[{"id":"CVE-2025-59375","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-59375","cwe":"CWE-770","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-59375","date":"2026-11-02","epss":0.0138,"percentile":0.72119}],"urls":["https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes#L45-L74","https://github.com/libexpat/libexpat/blob/R_2_7_2/expat/Changes","https://github.com/libexpat/libexpat/issues/1018","https://github.com/libexpat/libexpat/pull/1034","https://issues.oss-fuzz.com/issues/439133977","http://www.openwall.com/lists/oss-security/2025/09/16/2","http://www.openwall.com/lists/oss-security/2026/05/01/5","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-59375","description":"libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing."}]},{"artifact":{"id":"23731e55f78e12a9","cpes":["cpe:2.3:a:libexpat1-dev:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1-dev:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1_dev:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1_dev:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1-dev","purl":"pkg:deb/ubuntu/libexpat1-dev@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1-dev/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libexpat1-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libexpat1-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-59375","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-59375","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-59375","cwe":"CWE-770","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-59375","date":"2026-11-02","epss":0.0138,"percentile":0.72119}],"risk":0.69,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-59375"},"relatedVulnerabilities":[{"id":"CVE-2025-59375","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-59375","cwe":"CWE-770","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-59375","date":"2026-11-02","epss":0.0138,"percentile":0.72119}],"urls":["https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes#L45-L74","https://github.com/libexpat/libexpat/blob/R_2_7_2/expat/Changes","https://github.com/libexpat/libexpat/issues/1018","https://github.com/libexpat/libexpat/pull/1034","https://issues.oss-fuzz.com/issues/439133977","http://www.openwall.com/lists/oss-security/2025/09/16/2","http://www.openwall.com/lists/oss-security/2026/05/01/5","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-59375","description":"libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing."}]},{"artifact":{"id":"1f8e56f352643db0","cpes":["cpe:2.3:a:libtasn1-6:libtasn1-6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1-6:libtasn1_6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1-6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1_6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1-6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1_6:4.18.0-4build1:*:*:*:*:*:*:*"],"name":"libtasn1-6","purl":"pkg:deb/ubuntu/libtasn1-6@4.18.0-4build1?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"4.18.0-4build1","language":"","licenses":["sha256:88a94e40a34bb28145805747cad4018e7eb976b5fd0bf2329dedf90088ebc6e4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtasn1-6/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libtasn1-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.18.0-4ubuntu0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-13151","versionConstraint":"< 4.18.0-4ubuntu0.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libtasn1-6","version":"4.18.0-4build1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-13151","fix":{"state":"fixed","versions":["4.18.0-4ubuntu0.2"],"available":[{"date":"2026-01-12","kind":"advisory","version":"4.18.0-4ubuntu0.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-13151","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-13151","date":"2026-11-02","epss":0.0137,"percentile":0.71907}],"risk":0.685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13151"},"relatedVulnerabilities":[{"id":"CVE-2025-13151","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13151","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-13151","date":"2026-11-02","epss":0.0137,"percentile":0.71907}],"urls":["https://gitlab.com/gnutls/libtasn1","https://gitlab.com/gnutls/libtasn1/-/merge_requests/121","http://www.openwall.com/lists/oss-security/2026/01/08/5","https://www.kb.cert.org/vuls/id/271649"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13151","description":"Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string."}]},{"artifact":{"id":"af534de498eed696","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8176","versionConstraint":"< 2.4.7-1ubuntu0.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-8176","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.6"],"available":[{"date":"2025-04-08","kind":"advisory","version":"2.4.7-1ubuntu0.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-8176","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-8176","date":"2026-11-02","epss":0.01353,"percentile":0.71566}],"risk":0.6765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8176"},"relatedVulnerabilities":[{"id":"CVE-2024-8176","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8176","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-8176","date":"2026-11-02","epss":0.01353,"percentile":0.71566}],"urls":["https://access.redhat.com/errata/RHSA-2025:13681","https://access.redhat.com/errata/RHSA-2025:22033","https://access.redhat.com/errata/RHSA-2025:22034","https://access.redhat.com/errata/RHSA-2025:22035","https://access.redhat.com/errata/RHSA-2025:22607","https://access.redhat.com/errata/RHSA-2025:22785","https://access.redhat.com/errata/RHSA-2025:22842","https://access.redhat.com/errata/RHSA-2025:22871","https://access.redhat.com/errata/RHSA-2025:3531","https://access.redhat.com/errata/RHSA-2025:3734","https://access.redhat.com/errata/RHSA-2025:3913","https://access.redhat.com/errata/RHSA-2025:4048","https://access.redhat.com/errata/RHSA-2025:4446","https://access.redhat.com/errata/RHSA-2025:4447","https://access.redhat.com/errata/RHSA-2025:4448","https://access.redhat.com/errata/RHSA-2025:4449","https://access.redhat.com/errata/RHSA-2025:7444","https://access.redhat.com/errata/RHSA-2025:7512","https://access.redhat.com/errata/RHSA-2025:8385","https://access.redhat.com/security/cve/CVE-2024-8176","https://bugzilla.redhat.com/show_bug.cgi?id=2310137","https://github.com/libexpat/libexpat/issues/893","https://github.com/libexpat/libexpat/pull/973","http://seclists.org/fulldisclosure/2025/May/10","http://seclists.org/fulldisclosure/2025/May/11","http://seclists.org/fulldisclosure/2025/May/12","http://seclists.org/fulldisclosure/2025/May/6","http://seclists.org/fulldisclosure/2025/May/7","http://seclists.org/fulldisclosure/2025/May/8","http://www.openwall.com/lists/oss-security/2025/03/15/1","http://www.openwall.com/lists/oss-security/2025/09/24/11","https://blog.hartwork.org/posts/expat-2-7-0-released/","https://bugzilla.suse.com/show_bug.cgi?id=1239618","https://github.com/libexpat/libexpat/blob/R_2_7_0/expat/Changes#L40-L52","https://gitlab.alpinelinux.org/alpine/aports/-/commit/d068c3ff36fc6f4789988a09c69b434db757db53","https://security-tracker.debian.org/tracker/CVE-2024-8176","https://security.netapp.com/advisory/ntap-20250328-0009/","https://ubuntu.com/security/CVE-2024-8176","https://www.kb.cert.org/vuls/id/760160","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8176","description":"A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage."}]},{"artifact":{"id":"23731e55f78e12a9","cpes":["cpe:2.3:a:libexpat1-dev:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1-dev:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1_dev:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1_dev:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1-dev","purl":"pkg:deb/ubuntu/libexpat1-dev@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1-dev/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libexpat1-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libexpat1-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8176","versionConstraint":"< 2.4.7-1ubuntu0.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-8176","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.6"],"available":[{"date":"2025-04-08","kind":"advisory","version":"2.4.7-1ubuntu0.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-8176","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-8176","date":"2026-11-02","epss":0.01353,"percentile":0.71566}],"risk":0.6765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8176"},"relatedVulnerabilities":[{"id":"CVE-2024-8176","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8176","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-8176","date":"2026-11-02","epss":0.01353,"percentile":0.71566}],"urls":["https://access.redhat.com/errata/RHSA-2025:13681","https://access.redhat.com/errata/RHSA-2025:22033","https://access.redhat.com/errata/RHSA-2025:22034","https://access.redhat.com/errata/RHSA-2025:22035","https://access.redhat.com/errata/RHSA-2025:22607","https://access.redhat.com/errata/RHSA-2025:22785","https://access.redhat.com/errata/RHSA-2025:22842","https://access.redhat.com/errata/RHSA-2025:22871","https://access.redhat.com/errata/RHSA-2025:3531","https://access.redhat.com/errata/RHSA-2025:3734","https://access.redhat.com/errata/RHSA-2025:3913","https://access.redhat.com/errata/RHSA-2025:4048","https://access.redhat.com/errata/RHSA-2025:4446","https://access.redhat.com/errata/RHSA-2025:4447","https://access.redhat.com/errata/RHSA-2025:4448","https://access.redhat.com/errata/RHSA-2025:4449","https://access.redhat.com/errata/RHSA-2025:7444","https://access.redhat.com/errata/RHSA-2025:7512","https://access.redhat.com/errata/RHSA-2025:8385","https://access.redhat.com/security/cve/CVE-2024-8176","https://bugzilla.redhat.com/show_bug.cgi?id=2310137","https://github.com/libexpat/libexpat/issues/893","https://github.com/libexpat/libexpat/pull/973","http://seclists.org/fulldisclosure/2025/May/10","http://seclists.org/fulldisclosure/2025/May/11","http://seclists.org/fulldisclosure/2025/May/12","http://seclists.org/fulldisclosure/2025/May/6","http://seclists.org/fulldisclosure/2025/May/7","http://seclists.org/fulldisclosure/2025/May/8","http://www.openwall.com/lists/oss-security/2025/03/15/1","http://www.openwall.com/lists/oss-security/2025/09/24/11","https://blog.hartwork.org/posts/expat-2-7-0-released/","https://bugzilla.suse.com/show_bug.cgi?id=1239618","https://github.com/libexpat/libexpat/blob/R_2_7_0/expat/Changes#L40-L52","https://gitlab.alpinelinux.org/alpine/aports/-/commit/d068c3ff36fc6f4789988a09c69b434db757db53","https://security-tracker.debian.org/tracker/CVE-2024-8176","https://security.netapp.com/advisory/ntap-20250328-0009/","https://ubuntu.com/security/CVE-2024-8176","https://www.kb.cert.org/vuls/id/760160","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8176","description":"A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage."}]},{"artifact":{"id":"842dbc9fb51686ce","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.4:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.4?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.4","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42009","versionConstraint":"< 3.7.3-4ubuntu1.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.4"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-42009","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.9"],"available":[{"date":"2026-05-20","kind":"advisory","version":"3.7.3-4ubuntu1.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-42009","cwe":"CWE-475","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-42009","cwe":"CWE-475","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42009","date":"2026-11-02","epss":0.01335,"percentile":0.71172}],"risk":0.6675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42009"},"relatedVulnerabilities":[{"id":"CVE-2026-42009","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42009","cwe":"CWE-475","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-42009","cwe":"CWE-475","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42009","date":"2026-11-02","epss":0.01335,"percentile":0.71172}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:29794","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:34372","https://access.redhat.com/errata/RHSA-2026:34764","https://access.redhat.com/errata/RHSA-2026:34788","https://access.redhat.com/errata/RHSA-2026:36004","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:40762","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:56786","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:56911","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-42009","https://bugzilla.redhat.com/show_bug.cgi?id=2467279","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-2","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42009.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42009","description":"A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service."}]},{"artifact":{"id":"f02275b79327efaf","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33599","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33599","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-33599","date":"2026-11-02","epss":0.0131,"percentile":0.70644}],"risk":0.655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33599"},"relatedVulnerabilities":[{"id":"CVE-2024-33599","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-33599","date":"2026-11-02","epss":0.0131,"percentile":0.70644}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0011/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0005","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33599","description":"nscd: Stack-based buffer overflow in netgroup cache\n\nIf the Name Service Cache Daemon's (nscd) fixed size cache is exhausted\nby client requests then a subsequent client request for netgroup data\nmay result in a stack-based buffer overflow.  This flaw was introduced\nin glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"91ecf8e0fa5aba51","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/ubuntu/libc-dev-bin@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33599","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33599","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-33599","date":"2026-11-02","epss":0.0131,"percentile":0.70644}],"risk":0.655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33599"},"relatedVulnerabilities":[{"id":"CVE-2024-33599","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-33599","date":"2026-11-02","epss":0.0131,"percentile":0.70644}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0011/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0005","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33599","description":"nscd: Stack-based buffer overflow in netgroup cache\n\nIf the Name Service Cache Daemon's (nscd) fixed size cache is exhausted\nby client requests then a subsequent client request for netgroup data\nmay result in a stack-based buffer overflow.  This flaw was introduced\nin glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"8da7e53d1801cfa5","cpes":["cpe:2.3:a:libc6:libc6:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33599","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33599","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-33599","date":"2026-11-02","epss":0.0131,"percentile":0.70644}],"risk":0.655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33599"},"relatedVulnerabilities":[{"id":"CVE-2024-33599","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-33599","date":"2026-11-02","epss":0.0131,"percentile":0.70644}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0011/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0005","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33599","description":"nscd: Stack-based buffer overflow in netgroup cache\n\nIf the Name Service Cache Daemon's (nscd) fixed size cache is exhausted\nby client requests then a subsequent client request for netgroup data\nmay result in a stack-based buffer overflow.  This flaw was introduced\nin glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"5ee048fdc80b241c","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/ubuntu/libc6-dev@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33599","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33599","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-33599","date":"2026-11-02","epss":0.0131,"percentile":0.70644}],"risk":0.655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33599"},"relatedVulnerabilities":[{"id":"CVE-2024-33599","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-33599","date":"2026-11-02","epss":0.0131,"percentile":0.70644}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0011/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0005","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33599","description":"nscd: Stack-based buffer overflow in netgroup cache\n\nIf the Name Service Cache Daemon's (nscd) fixed size cache is exhausted\nby client requests then a subsequent client request for netgroup data\nmay result in a stack-based buffer overflow.  This flaw was introduced\nin glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"a88b7869c938a730","cpes":["cpe:2.3:a:locales:locales:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/ubuntu/locales@2.35-0ubuntu3.6?arch=all&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33599","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33599","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-33599","date":"2026-11-02","epss":0.0131,"percentile":0.70644}],"risk":0.655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33599"},"relatedVulnerabilities":[{"id":"CVE-2024-33599","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-33599","date":"2026-11-02","epss":0.0131,"percentile":0.70644}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0011/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0005","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33599","description":"nscd: Stack-based buffer overflow in netgroup cache\n\nIf the Name Service Cache Daemon's (nscd) fixed size cache is exhausted\nby client requests then a subsequent client request for netgroup data\nmay result in a stack-based buffer overflow.  This flaw was introduced\nin glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"842dbc9fb51686ce","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.4:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.4?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.4","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-12243","versionConstraint":"< 3.7.3-4ubuntu1.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.4"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-12243","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.6"],"available":[{"date":"2025-02-20","kind":"advisory","version":"3.7.3-4ubuntu1.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-12243","cwe":"CWE-407","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-12243","date":"2026-11-02","epss":0.01292,"percentile":0.70265}],"risk":0.6459999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-12243"},"relatedVulnerabilities":[{"id":"CVE-2024-12243","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-12243","cwe":"CWE-407","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-12243","date":"2026-11-02","epss":0.01292,"percentile":0.70265}],"urls":["https://access.redhat.com/errata/RHSA-2025:17361","https://access.redhat.com/errata/RHSA-2025:4051","https://access.redhat.com/errata/RHSA-2025:7076","https://access.redhat.com/errata/RHSA-2025:8020","https://access.redhat.com/errata/RHSA-2025:8385","https://access.redhat.com/security/cve/CVE-2024-12243","https://bugzilla.redhat.com/show_bug.cgi?id=2344615","https://gitlab.com/gnutls/gnutls/-/issues/1553","https://gitlab.com/gnutls/libtasn1/-/issues/52","https://lists.debian.org/debian-lts-announce/2025/02/msg00027.html","https://security.netapp.com/advisory/ntap-20250523-0002/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-12243","description":"A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition."}]},{"artifact":{"id":"c2ea9d63e93128ea","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:249.11-0ubuntu3.12:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/ubuntu/libsystemd0@249.11-0ubuntu3.12?arch=amd64&distro=ubuntu-22.04&upstream=systemd","type":"deb","version":"249.11-0ubuntu3.12","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"249.11-0ubuntu3.16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4598","versionConstraint":"< 249.11-0ubuntu3.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"systemd","version":"249.11-0ubuntu3.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-4598","fix":{"state":"fixed","versions":["249.11-0ubuntu3.16"],"available":[{"date":"2025-06-09","kind":"advisory","version":"249.11-0ubuntu3.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-11-02","epss":0.01277,"percentile":0.69957}],"risk":0.6385,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-4598"},"relatedVulnerabilities":[{"id":"CVE-2025-4598","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-11-02","epss":0.01277,"percentile":0.69957}],"urls":["https://access.redhat.com/errata/RHSA-2025:22660","https://access.redhat.com/errata/RHSA-2025:22868","https://access.redhat.com/errata/RHSA-2025:23227","https://access.redhat.com/errata/RHSA-2025:23234","https://access.redhat.com/errata/RHSA-2026:0414","https://access.redhat.com/errata/RHSA-2026:1652","https://access.redhat.com/errata/RHSA-2026:18153","https://access.redhat.com/security/cve/CVE-2025-4598","https://bugzilla.redhat.com/show_bug.cgi?id=2369242","https://www.openwall.com/lists/oss-security/2025/05/29/3","http://seclists.org/fulldisclosure/2025/Jun/9","http://www.openwall.com/lists/oss-security/2025/06/05/1","http://www.openwall.com/lists/oss-security/2025/06/05/3","http://www.openwall.com/lists/oss-security/2025/08/18/3","https://blogs.oracle.com/linux/post/analysis-of-cve-2025-4598","https://ciq.com/blog/the-real-danger-of-systemd-coredump-cve-2025-4598/","https://lists.debian.org/debian-lts-announce/2025/07/msg00022.html","https://www.openwall.com/lists/oss-security/2025/08/18/3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4598","description":"A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\n\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality."}]},{"artifact":{"id":"49ca5e32e7135d33","cpes":["cpe:2.3:a:libudev1:libudev1:249.11-0ubuntu3.12:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/ubuntu/libudev1@249.11-0ubuntu3.12?arch=amd64&distro=ubuntu-22.04&upstream=systemd","type":"deb","version":"249.11-0ubuntu3.12","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"249.11-0ubuntu3.16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4598","versionConstraint":"< 249.11-0ubuntu3.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"systemd","version":"249.11-0ubuntu3.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-4598","fix":{"state":"fixed","versions":["249.11-0ubuntu3.16"],"available":[{"date":"2025-06-09","kind":"advisory","version":"249.11-0ubuntu3.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-11-02","epss":0.01277,"percentile":0.69957}],"risk":0.6385,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-4598"},"relatedVulnerabilities":[{"id":"CVE-2025-4598","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-11-02","epss":0.01277,"percentile":0.69957}],"urls":["https://access.redhat.com/errata/RHSA-2025:22660","https://access.redhat.com/errata/RHSA-2025:22868","https://access.redhat.com/errata/RHSA-2025:23227","https://access.redhat.com/errata/RHSA-2025:23234","https://access.redhat.com/errata/RHSA-2026:0414","https://access.redhat.com/errata/RHSA-2026:1652","https://access.redhat.com/errata/RHSA-2026:18153","https://access.redhat.com/security/cve/CVE-2025-4598","https://bugzilla.redhat.com/show_bug.cgi?id=2369242","https://www.openwall.com/lists/oss-security/2025/05/29/3","http://seclists.org/fulldisclosure/2025/Jun/9","http://www.openwall.com/lists/oss-security/2025/06/05/1","http://www.openwall.com/lists/oss-security/2025/06/05/3","http://www.openwall.com/lists/oss-security/2025/08/18/3","https://blogs.oracle.com/linux/post/analysis-of-cve-2025-4598","https://ciq.com/blog/the-real-danger-of-systemd-coredump-cve-2025-4598/","https://lists.debian.org/debian-lts-announce/2025/07/msg00022.html","https://www.openwall.com/lists/oss-security/2025/08/18/3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4598","description":"A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\n\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8088","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-8088","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-8088","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2024-8088","date":"2026-11-02","epss":0.01275,"percentile":0.69922}],"risk":0.6375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8088"},"relatedVulnerabilities":[{"id":"CVE-2024-8088","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:L/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8088","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2024-8088","date":"2026-11-02","epss":0.01275,"percentile":0.69922}],"urls":["https://github.com/python/cpython/commit/0aa1ee22ab6e204e9d3d0e9dd63ea648ed691ef1","https://github.com/python/cpython/commit/2231286d78d328c2f575e0b05b16fe447d1656d6","https://github.com/python/cpython/commit/795f2597a4be988e2bb19b69ff9958e981cb894e","https://github.com/python/cpython/commit/7bc367e464ce50b956dd232c1dfa1cad4e7fb814","https://github.com/python/cpython/commit/7e8883a3f04d308302361aeffc73e0e9837f19d4","https://github.com/python/cpython/commit/8c7348939d8a3ecd79d630075f6be1b0c5b41f64","https://github.com/python/cpython/commit/95b073bddefa6243effa08e131e297c0383e7f6a","https://github.com/python/cpython/commit/962055268ed4f2ca1d717bfc8b6385de50a23ab7","https://github.com/python/cpython/commit/9cd03263100ddb1657826cc4a71470786cab3932","https://github.com/python/cpython/commit/dcc5182f27c1500006a1ef78e10613bb45788dea","https://github.com/python/cpython/commit/e0264a61119d551658d9445af38323ba94fc16db","https://github.com/python/cpython/commit/fc0b8259e693caa8400fa8b6ac1e494e47ea7798","https://github.com/python/cpython/issues/122905","https://github.com/python/cpython/issues/123270","https://github.com/python/cpython/pull/122906","https://mail.python.org/archives/list/security-announce@python.org/thread/GNFCKVI4TCATKQLALJ5SN4L4CSPSMILU/","http://www.openwall.com/lists/oss-security/2024/08/22/1","http://www.openwall.com/lists/oss-security/2024/08/22/4","http://www.openwall.com/lists/oss-security/2024/08/23/1","http://www.openwall.com/lists/oss-security/2024/08/23/2","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241011-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8088","description":"There is a HIGH severity vulnerability affecting the CPython \"zipfile\"\nmodule affecting \"zipfile.Path\". Note that the more common API \"zipfile.ZipFile\" class is unaffected.\n\n\n\n\n\nWhen iterating over names of entries in a zip archive (for example, methods\nof \"zipfile.Path\" like \"namelist()\", \"iterdir()\", etc)\nthe process can be put into an infinite loop with a maliciously crafted\nzip archive. This defect applies when reading only metadata or extracting\nthe contents of the zip archive. Programs that are not handling\nuser-controlled zip archives are not affected."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8088","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-8088","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-8088","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2024-8088","date":"2026-11-02","epss":0.01275,"percentile":0.69922}],"risk":0.6375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8088"},"relatedVulnerabilities":[{"id":"CVE-2024-8088","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:L/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8088","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2024-8088","date":"2026-11-02","epss":0.01275,"percentile":0.69922}],"urls":["https://github.com/python/cpython/commit/0aa1ee22ab6e204e9d3d0e9dd63ea648ed691ef1","https://github.com/python/cpython/commit/2231286d78d328c2f575e0b05b16fe447d1656d6","https://github.com/python/cpython/commit/795f2597a4be988e2bb19b69ff9958e981cb894e","https://github.com/python/cpython/commit/7bc367e464ce50b956dd232c1dfa1cad4e7fb814","https://github.com/python/cpython/commit/7e8883a3f04d308302361aeffc73e0e9837f19d4","https://github.com/python/cpython/commit/8c7348939d8a3ecd79d630075f6be1b0c5b41f64","https://github.com/python/cpython/commit/95b073bddefa6243effa08e131e297c0383e7f6a","https://github.com/python/cpython/commit/962055268ed4f2ca1d717bfc8b6385de50a23ab7","https://github.com/python/cpython/commit/9cd03263100ddb1657826cc4a71470786cab3932","https://github.com/python/cpython/commit/dcc5182f27c1500006a1ef78e10613bb45788dea","https://github.com/python/cpython/commit/e0264a61119d551658d9445af38323ba94fc16db","https://github.com/python/cpython/commit/fc0b8259e693caa8400fa8b6ac1e494e47ea7798","https://github.com/python/cpython/issues/122905","https://github.com/python/cpython/issues/123270","https://github.com/python/cpython/pull/122906","https://mail.python.org/archives/list/security-announce@python.org/thread/GNFCKVI4TCATKQLALJ5SN4L4CSPSMILU/","http://www.openwall.com/lists/oss-security/2024/08/22/1","http://www.openwall.com/lists/oss-security/2024/08/22/4","http://www.openwall.com/lists/oss-security/2024/08/23/1","http://www.openwall.com/lists/oss-security/2024/08/23/2","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241011-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8088","description":"There is a HIGH severity vulnerability affecting the CPython \"zipfile\"\nmodule affecting \"zipfile.Path\". Note that the more common API \"zipfile.ZipFile\" class is unaffected.\n\n\n\n\n\nWhen iterating over names of entries in a zip archive (for example, methods\nof \"zipfile.Path\" like \"namelist()\", \"iterdir()\", etc)\nthe process can be put into an infinite loop with a maliciously crafted\nzip archive. This defect applies when reading only metadata or extracting\nthe contents of the zip archive. Programs that are not handling\nuser-controlled zip archives are not affected."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-8088","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-8088","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-8088","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2024-8088","date":"2026-11-02","epss":0.01275,"percentile":0.69922}],"risk":0.6375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8088"},"relatedVulnerabilities":[{"id":"CVE-2024-8088","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:L/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8088","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2024-8088","date":"2026-11-02","epss":0.01275,"percentile":0.69922}],"urls":["https://github.com/python/cpython/commit/0aa1ee22ab6e204e9d3d0e9dd63ea648ed691ef1","https://github.com/python/cpython/commit/2231286d78d328c2f575e0b05b16fe447d1656d6","https://github.com/python/cpython/commit/795f2597a4be988e2bb19b69ff9958e981cb894e","https://github.com/python/cpython/commit/7bc367e464ce50b956dd232c1dfa1cad4e7fb814","https://github.com/python/cpython/commit/7e8883a3f04d308302361aeffc73e0e9837f19d4","https://github.com/python/cpython/commit/8c7348939d8a3ecd79d630075f6be1b0c5b41f64","https://github.com/python/cpython/commit/95b073bddefa6243effa08e131e297c0383e7f6a","https://github.com/python/cpython/commit/962055268ed4f2ca1d717bfc8b6385de50a23ab7","https://github.com/python/cpython/commit/9cd03263100ddb1657826cc4a71470786cab3932","https://github.com/python/cpython/commit/dcc5182f27c1500006a1ef78e10613bb45788dea","https://github.com/python/cpython/commit/e0264a61119d551658d9445af38323ba94fc16db","https://github.com/python/cpython/commit/fc0b8259e693caa8400fa8b6ac1e494e47ea7798","https://github.com/python/cpython/issues/122905","https://github.com/python/cpython/issues/123270","https://github.com/python/cpython/pull/122906","https://mail.python.org/archives/list/security-announce@python.org/thread/GNFCKVI4TCATKQLALJ5SN4L4CSPSMILU/","http://www.openwall.com/lists/oss-security/2024/08/22/1","http://www.openwall.com/lists/oss-security/2024/08/22/4","http://www.openwall.com/lists/oss-security/2024/08/23/1","http://www.openwall.com/lists/oss-security/2024/08/23/2","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241011-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8088","description":"There is a HIGH severity vulnerability affecting the CPython \"zipfile\"\nmodule affecting \"zipfile.Path\". Note that the more common API \"zipfile.ZipFile\" class is unaffected.\n\n\n\n\n\nWhen iterating over names of entries in a zip archive (for example, methods\nof \"zipfile.Path\" like \"namelist()\", \"iterdir()\", etc)\nthe process can be put into an infinite loop with a maliciously crafted\nzip archive. This defect applies when reading only metadata or extracting\nthe contents of the zip archive. Programs that are not handling\nuser-controlled zip archives are not affected."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8088","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-8088","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-8088","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2024-8088","date":"2026-11-02","epss":0.01275,"percentile":0.69922}],"risk":0.6375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8088"},"relatedVulnerabilities":[{"id":"CVE-2024-8088","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:L/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8088","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2024-8088","date":"2026-11-02","epss":0.01275,"percentile":0.69922}],"urls":["https://github.com/python/cpython/commit/0aa1ee22ab6e204e9d3d0e9dd63ea648ed691ef1","https://github.com/python/cpython/commit/2231286d78d328c2f575e0b05b16fe447d1656d6","https://github.com/python/cpython/commit/795f2597a4be988e2bb19b69ff9958e981cb894e","https://github.com/python/cpython/commit/7bc367e464ce50b956dd232c1dfa1cad4e7fb814","https://github.com/python/cpython/commit/7e8883a3f04d308302361aeffc73e0e9837f19d4","https://github.com/python/cpython/commit/8c7348939d8a3ecd79d630075f6be1b0c5b41f64","https://github.com/python/cpython/commit/95b073bddefa6243effa08e131e297c0383e7f6a","https://github.com/python/cpython/commit/962055268ed4f2ca1d717bfc8b6385de50a23ab7","https://github.com/python/cpython/commit/9cd03263100ddb1657826cc4a71470786cab3932","https://github.com/python/cpython/commit/dcc5182f27c1500006a1ef78e10613bb45788dea","https://github.com/python/cpython/commit/e0264a61119d551658d9445af38323ba94fc16db","https://github.com/python/cpython/commit/fc0b8259e693caa8400fa8b6ac1e494e47ea7798","https://github.com/python/cpython/issues/122905","https://github.com/python/cpython/issues/123270","https://github.com/python/cpython/pull/122906","https://mail.python.org/archives/list/security-announce@python.org/thread/GNFCKVI4TCATKQLALJ5SN4L4CSPSMILU/","http://www.openwall.com/lists/oss-security/2024/08/22/1","http://www.openwall.com/lists/oss-security/2024/08/22/4","http://www.openwall.com/lists/oss-security/2024/08/23/1","http://www.openwall.com/lists/oss-security/2024/08/23/2","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241011-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8088","description":"There is a HIGH severity vulnerability affecting the CPython \"zipfile\"\nmodule affecting \"zipfile.Path\". Note that the more common API \"zipfile.ZipFile\" class is unaffected.\n\n\n\n\n\nWhen iterating over names of entries in a zip archive (for example, methods\nof \"zipfile.Path\" like \"namelist()\", \"iterdir()\", etc)\nthe process can be put into an infinite loop with a maliciously crafted\nzip archive. This defect applies when reading only metadata or extracting\nthe contents of the zip archive. Programs that are not handling\nuser-controlled zip archives are not affected."}]},{"artifact":{"id":"d7625713b45b9e56","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@8.20.1","type":"java-archive","version":"8.20.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-authentication-plugin-4.3.8.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-authentication-plugin-4.3.8.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-authentication-plugin-4.3.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gvpg-vgmx-xg6w","versionConstraint":"<9.37.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"8.20.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gvpg-vgmx-xg6w","fix":{"state":"fixed","versions":["9.37.2"],"available":[{"date":"2024-03-16","kind":"first-observed","version":"9.37.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"risk":0.63492,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-52428","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://connect2id.com/products/nimbus-jose-jwt","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gvpg-vgmx-xg6w","description":"Denial of Service in Connect2id Nimbus JOSE+JWT"},"relatedVulnerabilities":[{"id":"CVE-2023-52428","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/","https://connect2id.com/products/nimbus-jose-jwt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52428","description":"In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component."}]},{"artifact":{"id":"e2fc1cc55ba36eb7","cpes":["cpe:2.3:a:com.nimbusds.nimbus-jose-jwt:nimbus-jose-jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds.nimbus-jose-jwt:nimbus_jose_jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id-ltd-:nimbus-jose-jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id-ltd-:nimbus_jose_jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id_ltd_:nimbus-jose-jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id_ltd_:nimbus_jose_jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.30.2:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.30.2","type":"java-archive","version":"9.30.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/nimbus-jose-jwt-9.30.2.jar","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":[{"value":"3a291d6af4007fd88df384249378130102912385","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/nimbus-jose-jwt-9.30.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/nimbus-jose-jwt-9.30.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gvpg-vgmx-xg6w","versionConstraint":"<9.37.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.30.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gvpg-vgmx-xg6w","fix":{"state":"fixed","versions":["9.37.2"],"available":[{"date":"2024-03-16","kind":"first-observed","version":"9.37.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"risk":0.63492,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-52428","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://connect2id.com/products/nimbus-jose-jwt","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gvpg-vgmx-xg6w","description":"Denial of Service in Connect2id Nimbus JOSE+JWT"},"relatedVulnerabilities":[{"id":"CVE-2023-52428","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/","https://connect2id.com/products/nimbus-jose-jwt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52428","description":"In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component."}]},{"artifact":{"id":"55e63c196031b8c3","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.31","type":"java-archive","version":"9.31","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-universal-plugin-manager-plugin-6.5.0.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-universal-plugin-manager-plugin-6.5.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-universal-plugin-manager-plugin-6.5.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gvpg-vgmx-xg6w","versionConstraint":"<9.37.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gvpg-vgmx-xg6w","fix":{"state":"fixed","versions":["9.37.2"],"available":[{"date":"2024-03-16","kind":"first-observed","version":"9.37.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"risk":0.63492,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-52428","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://connect2id.com/products/nimbus-jose-jwt","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gvpg-vgmx-xg6w","description":"Denial of Service in Connect2id Nimbus JOSE+JWT"},"relatedVulnerabilities":[{"id":"CVE-2023-52428","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/","https://connect2id.com/products/nimbus-jose-jwt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52428","description":"In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component."}]},{"artifact":{"id":"177c38ea558d723d","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.31","type":"java-archive","version":"9.31","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/oauth2-client-plugin-3.1.5.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/oauth2-client-plugin-3.1.5.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/oauth2-client-plugin-3.1.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gvpg-vgmx-xg6w","versionConstraint":"<9.37.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gvpg-vgmx-xg6w","fix":{"state":"fixed","versions":["9.37.2"],"available":[{"date":"2024-03-16","kind":"first-observed","version":"9.37.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"risk":0.63492,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-52428","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://connect2id.com/products/nimbus-jose-jwt","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gvpg-vgmx-xg6w","description":"Denial of Service in Connect2id Nimbus JOSE+JWT"},"relatedVulnerabilities":[{"id":"CVE-2023-52428","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/","https://connect2id.com/products/nimbus-jose-jwt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52428","description":"In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component."}]},{"artifact":{"id":"1131e26f141f84b9","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.31","type":"java-archive","version":"9.31","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/oauth2-provider-plugin-3.1.5.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/oauth2-provider-plugin-3.1.5.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/oauth2-provider-plugin-3.1.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gvpg-vgmx-xg6w","versionConstraint":"<9.37.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gvpg-vgmx-xg6w","fix":{"state":"fixed","versions":["9.37.2"],"available":[{"date":"2024-03-16","kind":"first-observed","version":"9.37.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"risk":0.63492,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-52428","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://connect2id.com/products/nimbus-jose-jwt","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gvpg-vgmx-xg6w","description":"Denial of Service in Connect2id Nimbus JOSE+JWT"},"relatedVulnerabilities":[{"id":"CVE-2023-52428","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/","https://connect2id.com/products/nimbus-jose-jwt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52428","description":"In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component."}]},{"artifact":{"id":"995f8946306aa2d2","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.31","type":"java-archive","version":"9.31","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/jwt-plugin-3.3.2.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/jwt-plugin-3.3.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/jwt-plugin-3.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gvpg-vgmx-xg6w","versionConstraint":"<9.37.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gvpg-vgmx-xg6w","fix":{"state":"fixed","versions":["9.37.2"],"available":[{"date":"2024-03-16","kind":"first-observed","version":"9.37.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"risk":0.63492,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-52428","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://connect2id.com/products/nimbus-jose-jwt","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gvpg-vgmx-xg6w","description":"Denial of Service in Connect2id Nimbus JOSE+JWT"},"relatedVulnerabilities":[{"id":"CVE-2023-52428","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/","https://connect2id.com/products/nimbus-jose-jwt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52428","description":"In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component."}]},{"artifact":{"id":"ca0dfc9d88cdad07","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.9.3:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.9.3","type":"java-archive","version":"9.9.3","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-connect-server-plugin-3.1.2.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-connect-server-plugin-3.1.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-connect-server-plugin-3.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gvpg-vgmx-xg6w","versionConstraint":"<9.37.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.9.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gvpg-vgmx-xg6w","fix":{"state":"fixed","versions":["9.37.2"],"available":[{"date":"2024-03-16","kind":"first-observed","version":"9.37.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"risk":0.63492,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-52428","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://connect2id.com/products/nimbus-jose-jwt","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gvpg-vgmx-xg6w","description":"Denial of Service in Connect2id Nimbus JOSE+JWT"},"relatedVulnerabilities":[{"id":"CVE-2023-52428","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/","https://connect2id.com/products/nimbus-jose-jwt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52428","description":"In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component."}]},{"artifact":{"id":"842dbc9fb51686ce","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.4:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.4?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.4","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33846","versionConstraint":"< 3.7.3-4ubuntu1.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.4"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-33846","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.9"],"available":[{"date":"2026-05-20","kind":"advisory","version":"3.7.3-4ubuntu1.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-33846","cwe":"CWE-130","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-33846","cwe":"CWE-130","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33846","date":"2026-11-02","epss":0.01263,"percentile":0.69691}],"risk":0.6315000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33846"},"relatedVulnerabilities":[{"id":"CVE-2026-33846","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33846","cwe":"CWE-130","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-33846","cwe":"CWE-130","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33846","date":"2026-11-02","epss":0.01263,"percentile":0.69691}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:34372","https://access.redhat.com/errata/RHSA-2026:36004","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:56786","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:56911","https://access.redhat.com/errata/RHSA-2026:57402","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-33846","https://bugzilla.redhat.com/show_bug.cgi?id=2450625","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33846.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33846","description":"A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.118"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx5v-xp9w-j4cg","versionConstraint":"<9.0.118 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx5v-xp9w-j4cg","fix":{"state":"fixed","versions":["9.0.118"],"available":[{"date":"2026-05-19","kind":"first-observed","version":"9.0.118"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41284","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-41284","date":"2026-11-02","epss":0.00839,"percentile":0.57825}],"risk":0.62925,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41284","https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc","http://www.openwall.com/lists/oss-security/2026/05/12/12","https://github.com/apache/tomcat/commit/17dacd9aa48628da2eba37a9ab743c0b6c71685c","https://github.com/apache/tomcat/commit/a96fffd18487a29c0a30d36f00cb2b2d91f6d42c","https://github.com/apache/tomcat/commit/b3d1c1c239142e806be0b7329d304b94a58913ed","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx5v-xp9w-j4cg","description":"Apache Tomcat: Unbounded read in WebDAV LOCK and  PROPFIND handling"},"relatedVulnerabilities":[{"id":"CVE-2026-41284","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41284","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-41284","date":"2026-11-02","epss":0.00839,"percentile":0.57825}],"urls":["https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc","http://www.openwall.com/lists/oss-security/2026/05/12/12"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41284","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117.\nOlder, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue."}]},{"artifact":{"id":"dd3ad14efa4e20df","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.12.7:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.12.7","type":"java-archive","version":"2.12.7","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.15.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h46c-h94j-95f3","versionConstraint":"<2.15.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.12.7"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h46c-h94j-95f3","fix":{"state":"fixed","versions":["2.15.0"],"available":[{"date":"2025-06-28","kind":"first-observed","version":"2.15.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"risk":0.62532,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3","https://nvd.nist.gov/vuln/detail/CVE-2025-52999","https://github.com/FasterXML/jackson-core/pull/943"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h46c-h94j-95f3","description":"jackson-core can throw a StackoverflowError when processing deeply nested data"},"relatedVulnerabilities":[{"id":"CVE-2025-52999","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"urls":["https://github.com/FasterXML/jackson-core/pull/943","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52999","description":"jackson-core contains core low-level incremental (\"streaming\") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources."}]},{"artifact":{"id":"7c53929246646eb2","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.13.4:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4","type":"java-archive","version":"2.13.4","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.15.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h46c-h94j-95f3","versionConstraint":"<2.15.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.13.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h46c-h94j-95f3","fix":{"state":"fixed","versions":["2.15.0"],"available":[{"date":"2025-06-28","kind":"first-observed","version":"2.15.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"risk":0.62532,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3","https://nvd.nist.gov/vuln/detail/CVE-2025-52999","https://github.com/FasterXML/jackson-core/pull/943"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h46c-h94j-95f3","description":"jackson-core can throw a StackoverflowError when processing deeply nested data"},"relatedVulnerabilities":[{"id":"CVE-2025-52999","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"urls":["https://github.com/FasterXML/jackson-core/pull/943","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52999","description":"jackson-core contains core low-level incremental (\"streaming\") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources."}]},{"artifact":{"id":"1f24ff152d9d512b","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.13.4:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4","type":"java-archive","version":"2.13.4","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar:META-INF/lib/jackson-core-2.13.4.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"0cf934c681294b97ef6d80082faeefbe1edadf56","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar:META-INF/lib/jackson-core-2.13.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.15.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h46c-h94j-95f3","versionConstraint":"<2.15.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.13.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h46c-h94j-95f3","fix":{"state":"fixed","versions":["2.15.0"],"available":[{"date":"2025-06-28","kind":"first-observed","version":"2.15.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"risk":0.62532,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3","https://nvd.nist.gov/vuln/detail/CVE-2025-52999","https://github.com/FasterXML/jackson-core/pull/943"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h46c-h94j-95f3","description":"jackson-core can throw a StackoverflowError when processing deeply nested data"},"relatedVulnerabilities":[{"id":"CVE-2025-52999","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"urls":["https://github.com/FasterXML/jackson-core/pull/943","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52999","description":"jackson-core contains core low-level incremental (\"streaming\") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources."}]},{"artifact":{"id":"bf339193a9b89a74","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.13.4:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4","type":"java-archive","version":"2.13.4","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.15.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h46c-h94j-95f3","versionConstraint":"<2.15.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.13.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h46c-h94j-95f3","fix":{"state":"fixed","versions":["2.15.0"],"available":[{"date":"2025-06-28","kind":"first-observed","version":"2.15.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"risk":0.62532,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3","https://nvd.nist.gov/vuln/detail/CVE-2025-52999","https://github.com/FasterXML/jackson-core/pull/943"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h46c-h94j-95f3","description":"jackson-core can throw a StackoverflowError when processing deeply nested data"},"relatedVulnerabilities":[{"id":"CVE-2025-52999","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"urls":["https://github.com/FasterXML/jackson-core/pull/943","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52999","description":"jackson-core contains core low-level incremental (\"streaming\") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources."}]},{"artifact":{"id":"d5dad70ff1dc3167","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/opensearch/lib/tools/upgrade-cli/jackson-core-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"f804090e6399ce0cf78242db086017512dd71fcc","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/lib/tools/upgrade-cli/jackson-core-2.14.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/lib/tools/upgrade-cli/jackson-core-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.15.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h46c-h94j-95f3","versionConstraint":"<2.15.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h46c-h94j-95f3","fix":{"state":"fixed","versions":["2.15.0"],"available":[{"date":"2025-06-28","kind":"first-observed","version":"2.15.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"risk":0.62532,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3","https://nvd.nist.gov/vuln/detail/CVE-2025-52999","https://github.com/FasterXML/jackson-core/pull/943"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h46c-h94j-95f3","description":"jackson-core can throw a StackoverflowError when processing deeply nested data"},"relatedVulnerabilities":[{"id":"CVE-2025-52999","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"urls":["https://github.com/FasterXML/jackson-core/pull/943","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52999","description":"jackson-core contains core low-level incremental (\"streaming\") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources."}]},{"artifact":{"id":"28e056c063a8cae2","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/opensearch/lib/jackson-core-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"f804090e6399ce0cf78242db086017512dd71fcc","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/lib/jackson-core-2.14.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/lib/jackson-core-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.15.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h46c-h94j-95f3","versionConstraint":"<2.15.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h46c-h94j-95f3","fix":{"state":"fixed","versions":["2.15.0"],"available":[{"date":"2025-06-28","kind":"first-observed","version":"2.15.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"risk":0.62532,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3","https://nvd.nist.gov/vuln/detail/CVE-2025-52999","https://github.com/FasterXML/jackson-core/pull/943"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h46c-h94j-95f3","description":"jackson-core can throw a StackoverflowError when processing deeply nested data"},"relatedVulnerabilities":[{"id":"CVE-2025-52999","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"urls":["https://github.com/FasterXML/jackson-core/pull/943","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52999","description":"jackson-core contains core low-level incremental (\"streaming\") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources."}]},{"artifact":{"id":"c2bb7ab35650cdc1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-remote-event-common-plugin-7.0.1.jar:META-INF/lib/jackson-core-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"f804090e6399ce0cf78242db086017512dd71fcc","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-remote-event-common-plugin-7.0.1.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-remote-event-common-plugin-7.0.1.jar:META-INF/lib/jackson-core-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.15.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h46c-h94j-95f3","versionConstraint":"<2.15.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h46c-h94j-95f3","fix":{"state":"fixed","versions":["2.15.0"],"available":[{"date":"2025-06-28","kind":"first-observed","version":"2.15.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"risk":0.62532,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3","https://nvd.nist.gov/vuln/detail/CVE-2025-52999","https://github.com/FasterXML/jackson-core/pull/943"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h46c-h94j-95f3","description":"jackson-core can throw a StackoverflowError when processing deeply nested data"},"relatedVulnerabilities":[{"id":"CVE-2025-52999","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"urls":["https://github.com/FasterXML/jackson-core/pull/943","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52999","description":"jackson-core contains core low-level incremental (\"streaming\") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources."}]},{"artifact":{"id":"0fc5ab4c86eb7ea7","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/ubuntu/libssl-dev@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.30"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84782","versionConstraint":"< 3.0.2-0ubuntu1.30 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.30"],"available":[{"date":"2026-09-29","kind":"advisory","version":"3.0.2-0ubuntu1.30"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-11-02","epss":0.00831,"percentile":0.57589}],"risk":0.62325,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84782"},"relatedVulnerabilities":[{"id":"CVE-2026-84782","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-11-02","epss":0.00831,"percentile":0.57589}],"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"080c8716011e8bcc","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.30"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84782","versionConstraint":"< 3.0.2-0ubuntu1.30 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.30"],"available":[{"date":"2026-09-29","kind":"advisory","version":"3.0.2-0ubuntu1.30"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-11-02","epss":0.00831,"percentile":0.57589}],"risk":0.62325,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84782"},"relatedVulnerabilities":[{"id":"CVE-2026-84782","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-11-02","epss":0.00831,"percentile":0.57589}],"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"e6933be022de0634","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.30"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84782","versionConstraint":"< 3.0.2-0ubuntu1.30 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.30"],"available":[{"date":"2026-09-29","kind":"advisory","version":"3.0.2-0ubuntu1.30"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-11-02","epss":0.00831,"percentile":0.57589}],"risk":0.62325,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84782"},"relatedVulnerabilities":[{"id":"CVE-2026-84782","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-11-02","epss":0.00831,"percentile":0.57589}],"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"b5184c36b907334a","cpes":["cpe:2.3:a:apache:log4j-core:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:2.17.1:*:*:*:*:*:*:*"],"name":"log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1","type":"java-archive","version":"2.17.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.logging.log4j","virtualPath":"/opt/atlassian/bitbucket/opensearch/lib/log4j-core-2.17.1.jar","manifestName":"","pomArtifactID":"log4j-core","archiveDigests":[{"value":"779f60f3844dadc3ef597976fcb1e5127b1f343d","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/lib/log4j-core-2.17.1.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/lib/log4j-core-2.17.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.25.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3pxv-7cmr-fjr4","versionConstraint":">=2.0-alpha1,<2.25.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.17.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3pxv-7cmr-fjr4","fix":{"state":"fixed","versions":["2.25.4"],"available":[{"date":"2026-04-11","kind":"first-observed","version":"2.25.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34480","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-34480","date":"2026-11-02","epss":0.01046,"percentile":0.64178}],"risk":0.6223700000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-34480","https://github.com/apache/logging-log4j2/pull/4077","https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout","https://logging.apache.org/security.html#CVE-2026-34480","http://www.openwall.com/lists/oss-security/2026/04/10/9"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3pxv-7cmr-fjr4","description":"Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters"},"relatedVulnerabilities":[{"id":"CVE-2026-34480","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34480","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-34480","date":"2026-11-02","epss":0.01046,"percentile":0.64178}],"urls":["https://github.com/apache/logging-log4j2/pull/4077","https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout","https://logging.apache.org/security.html#CVE-2026-34480","http://www.openwall.com/lists/oss-security/2026/04/10/9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34480","description":"Apache Log4j Core's  XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets  producing invalid XML output whenever a log message or MDC value contains such characters.\n\nThe impact depends on the StAX implementation in use:\n\n  *  JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.\n  *  Alternative StAX implementations (e.g.,  Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.\n\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output."}]},{"artifact":{"id":"bc7238cfe0245871","cpes":["cpe:2.3:a:apache:log4j-core:2.18.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.18.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.18.0:*:*:*:*:*:*:*"],"name":"log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0","type":"java-archive","version":"2.18.0","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.logging.log4j","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar:org.apache.logging.log4j:log4j-core","manifestName":"","pomArtifactID":"log4j-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.25.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3pxv-7cmr-fjr4","versionConstraint":">=2.0-alpha1,<2.25.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.18.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3pxv-7cmr-fjr4","fix":{"state":"fixed","versions":["2.25.4"],"available":[{"date":"2026-04-11","kind":"first-observed","version":"2.25.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34480","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-34480","date":"2026-11-02","epss":0.01046,"percentile":0.64178}],"risk":0.6223700000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-34480","https://github.com/apache/logging-log4j2/pull/4077","https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout","https://logging.apache.org/security.html#CVE-2026-34480","http://www.openwall.com/lists/oss-security/2026/04/10/9"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3pxv-7cmr-fjr4","description":"Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters"},"relatedVulnerabilities":[{"id":"CVE-2026-34480","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34480","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-34480","date":"2026-11-02","epss":0.01046,"percentile":0.64178}],"urls":["https://github.com/apache/logging-log4j2/pull/4077","https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout","https://logging.apache.org/security.html#CVE-2026-34480","http://www.openwall.com/lists/oss-security/2026/04/10/9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34480","description":"Apache Log4j Core's  XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets  producing invalid XML output whenever a log message or MDC value contains such characters.\n\nThe impact depends on the StAX implementation in use:\n\n  *  JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.\n  *  Alternative StAX implementations (e.g.,  Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.\n\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output."}]},{"artifact":{"id":"c37764faf81b0045","cpes":["cpe:2.3:a:apache:log4j-core:2.22.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.22.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.22.0:*:*:*:*:*:*:*"],"name":"log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.22.0","type":"java-archive","version":"2.22.0","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.logging.log4j","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:org.apache.logging.log4j:log4j-core","manifestName":"","pomArtifactID":"log4j-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.25.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3pxv-7cmr-fjr4","versionConstraint":">=2.0-alpha1,<2.25.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.22.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3pxv-7cmr-fjr4","fix":{"state":"fixed","versions":["2.25.4"],"available":[{"date":"2026-04-11","kind":"first-observed","version":"2.25.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34480","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-34480","date":"2026-11-02","epss":0.01046,"percentile":0.64178}],"risk":0.6223700000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-34480","https://github.com/apache/logging-log4j2/pull/4077","https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout","https://logging.apache.org/security.html#CVE-2026-34480","http://www.openwall.com/lists/oss-security/2026/04/10/9"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3pxv-7cmr-fjr4","description":"Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters"},"relatedVulnerabilities":[{"id":"CVE-2026-34480","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34480","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-34480","date":"2026-11-02","epss":0.01046,"percentile":0.64178}],"urls":["https://github.com/apache/logging-log4j2/pull/4077","https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout","https://logging.apache.org/security.html#CVE-2026-34480","http://www.openwall.com/lists/oss-security/2026/04/10/9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34480","description":"Apache Log4j Core's  XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets  producing invalid XML output whenever a log message or MDC value contains such characters.\n\nThe impact depends on the StAX implementation in use:\n\n  *  JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.\n  *  Alternative StAX implementations (e.g.,  Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.\n\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output."}]},{"artifact":{"id":"3a060baa137f74ea","cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@17.0.10%2B7?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk17u.git","type":"binary","version":"17.0.10+7","language":"","licenses":[],"metadata":{"release":{"fullVersion":"17.0.10+7","javaVersion":"17.0.10","semanticVersion":"17.0.10+7","javaRuntimeVersion":"17.0.10+7"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:8b8fefae6897ed4bfb12e519d4bdcaca9564779609395dcc3238ea1d369600aa","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"17.0.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-21587","versionConstraint":"< 1.8.0_452||>= 1.9, < 8.0.452||>= 12, < 17.0.15||>= 18, < 21.0.7||>= 22, < 24.0.1||>= 9, < 11.0.27 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"17.0.10+7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-21587","fix":{"state":"fixed","versions":["1.8.0_452","8.0.452","11.0.27","17.0.15","21.0.7","24.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_452"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.452"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.15"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.7"},{"date":"2025-09-04","kind":"first-observed","version":"24.0.1"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.27"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-21587","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-21587","date":"2026-11-02","epss":0.00833,"percentile":0.57644}],"risk":0.620585,"urls":["https://www.oracle.com/security-alerts/cpuapr2025.html","https://lists.debian.org/debian-lts-announce/2025/05/msg00026.html","https://security.netapp.com/advisory/ntap-20250502-0005/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-21587","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE:8u441, 8u441-perf, 11.0.26, 17.0.14, 21.0.6, 24; Oracle GraalVM for JDK:17.0.14, 21.0.6, 24; Oracle GraalVM Enterprise Edition:20.3.17 and  21.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"8eacee19ad955801","cpes":["cpe:2.3:a:ion-java:ion-java:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:ion-java:ion_java:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:ion_java:ion-java:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:ion_java:ion_java:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:ion:ion-java:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:ion:ion_java:1.0.2:*:*:*:*:*:*:*"],"name":"ion-java","purl":"pkg:maven/software.amazon.ion/ion-java@1.0.2","type":"java-archive","version":"1.0.2","language":"java","licenses":["The Apache License, Version 2.0"],"metadata":{"pomGroupID":"software.amazon.ion","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar:software.amazon.ion:ion-java","manifestName":"","pomArtifactID":"ion-java","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-264p-99wq-f4j6","versionConstraint":"<1.10.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"software.amazon.ion:ion-java","version":"1.0.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-264p-99wq-f4j6","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21634","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-21634","date":"2026-11-02","epss":0.00827,"percentile":0.57462}],"risk":0.62025,"urls":["https://github.com/amazon-ion/ion-java/security/advisories/GHSA-264p-99wq-f4j6","https://nvd.nist.gov/vuln/detail/CVE-2024-21634","https://security.netapp.com/advisory/ntap-20241108-0002"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-264p-99wq-f4j6","description":"Ion Java StackOverflow vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-21634","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21634","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-21634","date":"2026-11-02","epss":0.00827,"percentile":0.57462}],"urls":["https://github.com/amazon-ion/ion-java/security/advisories/GHSA-264p-99wq-f4j6","https://security.netapp.com/advisory/ntap-20241108-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21634","description":"Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in `ion-java` for applications that use `ion-java` to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the `IonValue` model and then invoke certain `IonValue` methods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using the `IonValue` model, results in a `StackOverflowError` originating from the `ion-java` library. The patch is included in `ion-java` 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with."}]},{"artifact":{"id":"3a71b2136cbaef6c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-57rv-r2g8-2cj3","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-57rv-r2g8-2cj3","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-11-02","epss":0.00838,"percentile":0.57777}],"risk":0.62012,"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://nvd.nist.gov/vuln/detail/CVE-2026-42584"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-57rv-r2g8-2cj3","description":"Netty has HttpClientCodec response desynchronization"},"relatedVulnerabilities":[{"id":"CVE-2026-42584","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-11-02","epss":0.00838,"percentile":0.57777}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42584","https://bugzilla.redhat.com/show_bug.cgi?id=2477224","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42584.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42584","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"e3d98c49743c8191","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-57rv-r2g8-2cj3","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-57rv-r2g8-2cj3","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-11-02","epss":0.00838,"percentile":0.57777}],"risk":0.62012,"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://nvd.nist.gov/vuln/detail/CVE-2026-42584"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-57rv-r2g8-2cj3","description":"Netty has HttpClientCodec response desynchronization"},"relatedVulnerabilities":[{"id":"CVE-2026-42584","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-11-02","epss":0.00838,"percentile":0.57777}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42584","https://bugzilla.redhat.com/show_bug.cgi?id=2477224","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42584.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42584","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"e6711addddd64a36","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-57rv-r2g8-2cj3","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-57rv-r2g8-2cj3","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-11-02","epss":0.00838,"percentile":0.57777}],"risk":0.62012,"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://nvd.nist.gov/vuln/detail/CVE-2026-42584"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-57rv-r2g8-2cj3","description":"Netty has HttpClientCodec response desynchronization"},"relatedVulnerabilities":[{"id":"CVE-2026-42584","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-11-02","epss":0.00838,"percentile":0.57777}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42584","https://bugzilla.redhat.com/show_bug.cgi?id=2477224","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42584.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42584","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"2692d67b14b4b286","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"c648f863b301e3fc62d0de098ec61be7628b8ea2","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-57rv-r2g8-2cj3","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-57rv-r2g8-2cj3","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-11-02","epss":0.00838,"percentile":0.57777}],"risk":0.62012,"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://nvd.nist.gov/vuln/detail/CVE-2026-42584"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-57rv-r2g8-2cj3","description":"Netty has HttpClientCodec response desynchronization"},"relatedVulnerabilities":[{"id":"CVE-2026-42584","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-11-02","epss":0.00838,"percentile":0.57777}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42584","https://bugzilla.redhat.com/show_bug.cgi?id=2477224","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42584.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42584","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"d68e99b783ccdee5","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"c648f863b301e3fc62d0de098ec61be7628b8ea2","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-57rv-r2g8-2cj3","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-57rv-r2g8-2cj3","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-11-02","epss":0.00838,"percentile":0.57777}],"risk":0.62012,"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://nvd.nist.gov/vuln/detail/CVE-2026-42584"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-57rv-r2g8-2cj3","description":"Netty has HttpClientCodec response desynchronization"},"relatedVulnerabilities":[{"id":"CVE-2026-42584","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-11-02","epss":0.00838,"percentile":0.57777}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42584","https://bugzilla.redhat.com/show_bug.cgi?id=2477224","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42584.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42584","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"37fd3bd4a6a92bd0","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.8.0:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/org.lz4/lz4-java@1.8.0","type":"java-archive","version":"1.8.0","language":"java","licenses":[],"metadata":{"pomGroupID":"org.lz4","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/lz4-java-1.8.0.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"4b986a99445e49ea5fbf5d149c4b63f6ed6c6780","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/lz4-java-1.8.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/lz4-java-1.8.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vqf4-7m7x-wgfc","versionConstraint":"<1.8.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.lz4:lz4-java","version":"1.8.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vqf4-7m7x-wgfc","fix":{"state":"fixed","versions":["1.8.1"],"available":[{"date":"2025-12-04","kind":"first-observed","version":"1.8.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12183","cwe":"CWE-125","type":"Secondary","source":"103e4ec9-0a87-450b-af77-479448ddef11"}],"epss":[{"cve":"CVE-2025-12183","date":"2026-11-02","epss":0.00747,"percentile":0.54859}],"risk":0.608805,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-12183","https://github.com/yawkat/lz4-java/releases/tag/v1.8.1","https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183","https://www.sonatype.com/security-advisories/cve-2025-12183","http://www.openwall.com/lists/oss-security/2025/12/01/5"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vqf4-7m7x-wgfc","description":"LZ4 Java Compression has Out-of-bounds memory operations which can cause DoS"},"relatedVulnerabilities":[{"id":"CVE-2025-12183","cvss":[{"type":"Secondary","source":"103e4ec9-0a87-450b-af77-479448ddef11","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12183","cwe":"CWE-125","type":"Secondary","source":"103e4ec9-0a87-450b-af77-479448ddef11"}],"epss":[{"cve":"CVE-2025-12183","date":"2026-11-02","epss":0.00747,"percentile":0.54859}],"urls":["https://github.com/yawkat/lz4-java/releases/tag/v1.8.1","https://www.sonatype.com/security-advisories/cve-2025-12183","http://www.openwall.com/lists/oss-security/2025/12/01/5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12183","description":"Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input."}]},{"artifact":{"id":"f02275b79327efaf","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33600","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33600","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33600","cwe":"CWE-476","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33600","date":"2026-11-02","epss":0.01216,"percentile":0.68595}],"risk":0.608,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33600"},"relatedVulnerabilities":[{"id":"CVE-2024-33600","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33600","cwe":"CWE-476","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33600","date":"2026-11-02","epss":0.01216,"percentile":0.68595}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0013/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0006","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33600","description":"nscd: Null pointer crashes after notfound response\n\nIf the Name Service Cache Daemon's (nscd) cache fails to add a not-found\nnetgroup response to the cache, the client request can result in a null\npointer dereference.  This flaw was introduced in glibc 2.15 when the\ncache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"91ecf8e0fa5aba51","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/ubuntu/libc-dev-bin@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33600","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33600","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33600","cwe":"CWE-476","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33600","date":"2026-11-02","epss":0.01216,"percentile":0.68595}],"risk":0.608,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33600"},"relatedVulnerabilities":[{"id":"CVE-2024-33600","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33600","cwe":"CWE-476","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33600","date":"2026-11-02","epss":0.01216,"percentile":0.68595}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0013/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0006","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33600","description":"nscd: Null pointer crashes after notfound response\n\nIf the Name Service Cache Daemon's (nscd) cache fails to add a not-found\nnetgroup response to the cache, the client request can result in a null\npointer dereference.  This flaw was introduced in glibc 2.15 when the\ncache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"8da7e53d1801cfa5","cpes":["cpe:2.3:a:libc6:libc6:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33600","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33600","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33600","cwe":"CWE-476","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33600","date":"2026-11-02","epss":0.01216,"percentile":0.68595}],"risk":0.608,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33600"},"relatedVulnerabilities":[{"id":"CVE-2024-33600","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33600","cwe":"CWE-476","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33600","date":"2026-11-02","epss":0.01216,"percentile":0.68595}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0013/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0006","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33600","description":"nscd: Null pointer crashes after notfound response\n\nIf the Name Service Cache Daemon's (nscd) cache fails to add a not-found\nnetgroup response to the cache, the client request can result in a null\npointer dereference.  This flaw was introduced in glibc 2.15 when the\ncache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"5ee048fdc80b241c","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/ubuntu/libc6-dev@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33600","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33600","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33600","cwe":"CWE-476","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33600","date":"2026-11-02","epss":0.01216,"percentile":0.68595}],"risk":0.608,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33600"},"relatedVulnerabilities":[{"id":"CVE-2024-33600","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33600","cwe":"CWE-476","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33600","date":"2026-11-02","epss":0.01216,"percentile":0.68595}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0013/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0006","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33600","description":"nscd: Null pointer crashes after notfound response\n\nIf the Name Service Cache Daemon's (nscd) cache fails to add a not-found\nnetgroup response to the cache, the client request can result in a null\npointer dereference.  This flaw was introduced in glibc 2.15 when the\ncache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"a88b7869c938a730","cpes":["cpe:2.3:a:locales:locales:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/ubuntu/locales@2.35-0ubuntu3.6?arch=all&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33600","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33600","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33600","cwe":"CWE-476","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33600","date":"2026-11-02","epss":0.01216,"percentile":0.68595}],"risk":0.608,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33600"},"relatedVulnerabilities":[{"id":"CVE-2024-33600","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33600","cwe":"CWE-476","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33600","date":"2026-11-02","epss":0.01216,"percentile":0.68595}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0013/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0006","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33600","description":"nscd: Null pointer crashes after notfound response\n\nIf the Name Service Cache Daemon's (nscd) cache fails to add a not-found\nnetgroup response to the cache, the client request can result in a null\npointer dereference.  This flaw was introduced in glibc 2.15 when the\ncache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"7f5afd36e2a50847","cpes":["cpe:2.3:a:curl:curl:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.19"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-9681","versionConstraint":"< 7.81.0-1ubuntu1.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-9681","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.19"],"available":[{"date":"2024-11-18","kind":"advisory","version":"7.81.0-1ubuntu1.19"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-9681","cwe":"CWE-697","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-9681","date":"2026-11-02","epss":0.01987,"percentile":0.80618}],"risk":0.5961,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9681"},"relatedVulnerabilities":[{"id":"CVE-2024-9681","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9681","cwe":"CWE-697","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-9681","date":"2026-11-02","epss":0.01987,"percentile":0.80618}],"urls":["https://curl.se/docs/CVE-2024-9681.html","https://curl.se/docs/CVE-2024-9681.json","https://hackerone.com/reports/2764830","http://seclists.org/fulldisclosure/2025/Apr/10","http://seclists.org/fulldisclosure/2025/Apr/11","http://seclists.org/fulldisclosure/2025/Apr/12","http://seclists.org/fulldisclosure/2025/Apr/13","http://seclists.org/fulldisclosure/2025/Apr/4","http://seclists.org/fulldisclosure/2025/Apr/5","http://seclists.org/fulldisclosure/2025/Apr/8","http://seclists.org/fulldisclosure/2025/Apr/9","http://www.openwall.com/lists/oss-security/2024/11/06/2","https://security.netapp.com/advisory/ntap-20241213-0006/","https://github.com/curl/curl/commit/7385610d0c74c6a25","https://github.com/curl/curl/commit/a94973805df96269bf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9681","description":"When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain's cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl's HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent's entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended."}]},{"artifact":{"id":"f75f86e9282bbba5","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.19"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-9681","versionConstraint":"< 7.81.0-1ubuntu1.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-9681","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.19"],"available":[{"date":"2024-11-18","kind":"advisory","version":"7.81.0-1ubuntu1.19"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-9681","cwe":"CWE-697","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-9681","date":"2026-11-02","epss":0.01987,"percentile":0.80618}],"risk":0.5961,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9681"},"relatedVulnerabilities":[{"id":"CVE-2024-9681","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9681","cwe":"CWE-697","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-9681","date":"2026-11-02","epss":0.01987,"percentile":0.80618}],"urls":["https://curl.se/docs/CVE-2024-9681.html","https://curl.se/docs/CVE-2024-9681.json","https://hackerone.com/reports/2764830","http://seclists.org/fulldisclosure/2025/Apr/10","http://seclists.org/fulldisclosure/2025/Apr/11","http://seclists.org/fulldisclosure/2025/Apr/12","http://seclists.org/fulldisclosure/2025/Apr/13","http://seclists.org/fulldisclosure/2025/Apr/4","http://seclists.org/fulldisclosure/2025/Apr/5","http://seclists.org/fulldisclosure/2025/Apr/8","http://seclists.org/fulldisclosure/2025/Apr/9","http://www.openwall.com/lists/oss-security/2024/11/06/2","https://security.netapp.com/advisory/ntap-20241213-0006/","https://github.com/curl/curl/commit/7385610d0c74c6a25","https://github.com/curl/curl/commit/a94973805df96269bf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9681","description":"When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain's cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl's HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent's entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended."}]},{"artifact":{"id":"eebde1772607afd6","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.19"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-9681","versionConstraint":"< 7.81.0-1ubuntu1.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-9681","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.19"],"available":[{"date":"2024-11-18","kind":"advisory","version":"7.81.0-1ubuntu1.19"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-9681","cwe":"CWE-697","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-9681","date":"2026-11-02","epss":0.01987,"percentile":0.80618}],"risk":0.5961,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9681"},"relatedVulnerabilities":[{"id":"CVE-2024-9681","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9681","cwe":"CWE-697","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-9681","date":"2026-11-02","epss":0.01987,"percentile":0.80618}],"urls":["https://curl.se/docs/CVE-2024-9681.html","https://curl.se/docs/CVE-2024-9681.json","https://hackerone.com/reports/2764830","http://seclists.org/fulldisclosure/2025/Apr/10","http://seclists.org/fulldisclosure/2025/Apr/11","http://seclists.org/fulldisclosure/2025/Apr/12","http://seclists.org/fulldisclosure/2025/Apr/13","http://seclists.org/fulldisclosure/2025/Apr/4","http://seclists.org/fulldisclosure/2025/Apr/5","http://seclists.org/fulldisclosure/2025/Apr/8","http://seclists.org/fulldisclosure/2025/Apr/9","http://www.openwall.com/lists/oss-security/2024/11/06/2","https://security.netapp.com/advisory/ntap-20241213-0006/","https://github.com/curl/curl/commit/7385610d0c74c6a25","https://github.com/curl/curl/commit/a94973805df96269bf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9681","description":"When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain's cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl's HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent's entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended."}]},{"artifact":{"id":"6c6ae95c8b3d93fb","cpes":["cpe:2.3:a:libcurl4-gnutls-dev:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4-gnutls-dev:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls_dev:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls_dev:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4-gnutls:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4-gnutls:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl4-gnutls-dev","purl":"pkg:deb/ubuntu/libcurl4-gnutls-dev@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4-gnutls-dev/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libcurl4-gnutls-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4-gnutls-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libcurl4-gnutls-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.19"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-9681","versionConstraint":"< 7.81.0-1ubuntu1.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-9681","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.19"],"available":[{"date":"2024-11-18","kind":"advisory","version":"7.81.0-1ubuntu1.19"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-9681","cwe":"CWE-697","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-9681","date":"2026-11-02","epss":0.01987,"percentile":0.80618}],"risk":0.5961,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9681"},"relatedVulnerabilities":[{"id":"CVE-2024-9681","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9681","cwe":"CWE-697","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-9681","date":"2026-11-02","epss":0.01987,"percentile":0.80618}],"urls":["https://curl.se/docs/CVE-2024-9681.html","https://curl.se/docs/CVE-2024-9681.json","https://hackerone.com/reports/2764830","http://seclists.org/fulldisclosure/2025/Apr/10","http://seclists.org/fulldisclosure/2025/Apr/11","http://seclists.org/fulldisclosure/2025/Apr/12","http://seclists.org/fulldisclosure/2025/Apr/13","http://seclists.org/fulldisclosure/2025/Apr/4","http://seclists.org/fulldisclosure/2025/Apr/5","http://seclists.org/fulldisclosure/2025/Apr/8","http://seclists.org/fulldisclosure/2025/Apr/9","http://www.openwall.com/lists/oss-security/2024/11/06/2","https://security.netapp.com/advisory/ntap-20241213-0006/","https://github.com/curl/curl/commit/7385610d0c74c6a25","https://github.com/curl/curl/commit/a94973805df96269bf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9681","description":"When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain's cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl's HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent's entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended."}]},{"artifact":{"id":"c3b906e6d877e380","cpes":["cpe:2.3:a:micrometer-core:micrometer-core:1.11.6:*:*:*:*:*:*:*","cpe:2.3:a:micrometer-core:micrometer_core:1.11.6:*:*:*:*:*:*:*","cpe:2.3:a:micrometer_core:micrometer-core:1.11.6:*:*:*:*:*:*:*","cpe:2.3:a:micrometer_core:micrometer_core:1.11.6:*:*:*:*:*:*:*","cpe:2.3:a:io.micrometer:micrometer-core:1.11.6:*:*:*:*:*:*:*","cpe:2.3:a:io.micrometer:micrometer_core:1.11.6:*:*:*:*:*:*:*","cpe:2.3:a:micrometer:micrometer-core:1.11.6:*:*:*:*:*:*:*","cpe:2.3:a:micrometer:micrometer_core:1.11.6:*:*:*:*:*:*:*"],"name":"micrometer-core","purl":"pkg:maven/io.micrometer/micrometer-core@1.11.6","type":"java-archive","version":"1.11.6","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"io.micrometer","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/micrometer-core-1.11.6.jar","manifestName":"","pomArtifactID":"micrometer-core","archiveDigests":[{"value":"9e2a6069a0f324d80ae772311521719a92a257dc","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/micrometer-core-1.11.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-g3pr-3p32-fp23","versionConstraint":">=1.10.0,<=1.13.15 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.micrometer:micrometer-core","version":"1.11.6"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-g3pr-3p32-fp23","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40984","cwe":"CWE-400","type":"Secondary","source":"security@vmware.com"},{"cve":"CVE-2026-40984","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-40984","date":"2026-11-02","epss":0.00792,"percentile":0.56332}],"risk":0.594,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-40984","https://spring.io/security/cve-2026-40984","https://github.com/micrometer-metrics/micrometer/commit/36da131525228188a36779a28471a76c79213dd4","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/security/cve/CVE-2026-40984","https://bugzilla.redhat.com/show_bug.cgi?id=2486716","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.json","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-g3pr-3p32-fp23","description":"Micrometer HTTP server instrumentations DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-40984","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40984","cwe":"CWE-400","type":"Secondary","source":"security@vmware.com"},{"cve":"CVE-2026-40984","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-40984","date":"2026-11-02","epss":0.00792,"percentile":0.56332}],"urls":["https://spring.io/security/cve-2026-40984","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-40984","https://bugzilla.redhat.com/show_bug.cgi?id=2486716","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40984","description":"In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nmicrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.\nmicrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\nmicrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18."}]},{"artifact":{"id":"d966d8b2128a80e5","cpes":["cpe:2.3:a:micrometer-core:micrometer-core:1.12.1:*:*:*:*:*:*:*","cpe:2.3:a:micrometer-core:micrometer_core:1.12.1:*:*:*:*:*:*:*","cpe:2.3:a:micrometer_core:micrometer-core:1.12.1:*:*:*:*:*:*:*","cpe:2.3:a:micrometer_core:micrometer_core:1.12.1:*:*:*:*:*:*:*","cpe:2.3:a:io.micrometer:micrometer-core:1.12.1:*:*:*:*:*:*:*","cpe:2.3:a:io.micrometer:micrometer_core:1.12.1:*:*:*:*:*:*:*","cpe:2.3:a:micrometer:micrometer-core:1.12.1:*:*:*:*:*:*:*","cpe:2.3:a:micrometer:micrometer_core:1.12.1:*:*:*:*:*:*:*"],"name":"micrometer-core","purl":"pkg:maven/io.micrometer/micrometer-core@1.12.1","type":"java-archive","version":"1.12.1","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"io.micrometer","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/micrometer-core-1.12.1.jar","manifestName":"","pomArtifactID":"micrometer-core","archiveDigests":[{"value":"b72e9a2f26355ecb8ababa0148a5c3c4ac648f14","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/micrometer-core-1.12.1.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/micrometer-core-1.12.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-g3pr-3p32-fp23","versionConstraint":">=1.10.0,<=1.13.15 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.micrometer:micrometer-core","version":"1.12.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-g3pr-3p32-fp23","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40984","cwe":"CWE-400","type":"Secondary","source":"security@vmware.com"},{"cve":"CVE-2026-40984","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-40984","date":"2026-11-02","epss":0.00792,"percentile":0.56332}],"risk":0.594,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-40984","https://spring.io/security/cve-2026-40984","https://github.com/micrometer-metrics/micrometer/commit/36da131525228188a36779a28471a76c79213dd4","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/security/cve/CVE-2026-40984","https://bugzilla.redhat.com/show_bug.cgi?id=2486716","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.json","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-g3pr-3p32-fp23","description":"Micrometer HTTP server instrumentations DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-40984","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40984","cwe":"CWE-400","type":"Secondary","source":"security@vmware.com"},{"cve":"CVE-2026-40984","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-40984","date":"2026-11-02","epss":0.00792,"percentile":0.56332}],"urls":["https://spring.io/security/cve-2026-40984","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-40984","https://bugzilla.redhat.com/show_bug.cgi?id=2486716","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40984","description":"In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nmicrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.\nmicrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\nmicrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.121"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gcx9-497g-6cp6","versionConstraint":">=9.0.0-M1,<9.0.121 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gcx9-497g-6cp6","fix":{"state":"fixed","versions":["9.0.121"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"9.0.121"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65182","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-65182","cwe":"CWE-863","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-65182","date":"2026-11-02","epss":0.00654,"percentile":0.51309}],"risk":0.59187,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-65182","https://lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767m","http://www.openwall.com/lists/oss-security/2026/08/26/1","https://github.com/apache/tomcat/commit/8bafd79a3b54684e80e9cb1bafd4746aede7d3f5","https://github.com/apache/tomcat/commit/b2c56ec8f20c66773a1a813034ffcdb60841f1cf","https://github.com/apache/tomcat/commit/b79752d2a8578d94743e2a95c50af297f780c0df","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gcx9-497g-6cp6","description":"Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-65182","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65182","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-65182","cwe":"CWE-863","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-65182","date":"2026-11-02","epss":0.00654,"percentile":0.51309}],"urls":["https://lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767m","http://www.openwall.com/lists/oss-security/2026/08/26/1"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65182","description":"Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue."}]},{"artifact":{"id":"7f5afd36e2a50847","cpes":["cpe:2.3:a:curl:curl:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.20"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-11053","versionConstraint":"< 7.81.0-1ubuntu1.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-11053","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.20"],"available":[{"date":"2024-12-16","kind":"advisory","version":"7.81.0-1ubuntu1.20"}]},"cvss":[],"epss":[{"cve":"CVE-2024-11053","date":"2026-11-02","epss":0.01966,"percentile":0.80366}],"risk":0.5898,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-11053"},"relatedVulnerabilities":[{"id":"CVE-2024-11053","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-11-02","epss":0.01966,"percentile":0.80366}],"urls":["https://curl.se/docs/CVE-2024-11053.html","https://curl.se/docs/CVE-2024-11053.json","https://hackerone.com/reports/2829063","http://www.openwall.com/lists/oss-security/2024/12/11/1","https://security.netapp.com/advisory/ntap-20250124-0012/","https://security.netapp.com/advisory/ntap-20250131-0003/","https://security.netapp.com/advisory/ntap-20250131-0004/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-212953.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11053","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password."}]},{"artifact":{"id":"f75f86e9282bbba5","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.20"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11053","versionConstraint":"< 7.81.0-1ubuntu1.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-11053","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.20"],"available":[{"date":"2024-12-16","kind":"advisory","version":"7.81.0-1ubuntu1.20"}]},"cvss":[],"epss":[{"cve":"CVE-2024-11053","date":"2026-11-02","epss":0.01966,"percentile":0.80366}],"risk":0.5898,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-11053"},"relatedVulnerabilities":[{"id":"CVE-2024-11053","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-11-02","epss":0.01966,"percentile":0.80366}],"urls":["https://curl.se/docs/CVE-2024-11053.html","https://curl.se/docs/CVE-2024-11053.json","https://hackerone.com/reports/2829063","http://www.openwall.com/lists/oss-security/2024/12/11/1","https://security.netapp.com/advisory/ntap-20250124-0012/","https://security.netapp.com/advisory/ntap-20250131-0003/","https://security.netapp.com/advisory/ntap-20250131-0004/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-212953.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11053","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password."}]},{"artifact":{"id":"eebde1772607afd6","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.20"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11053","versionConstraint":"< 7.81.0-1ubuntu1.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-11053","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.20"],"available":[{"date":"2024-12-16","kind":"advisory","version":"7.81.0-1ubuntu1.20"}]},"cvss":[],"epss":[{"cve":"CVE-2024-11053","date":"2026-11-02","epss":0.01966,"percentile":0.80366}],"risk":0.5898,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-11053"},"relatedVulnerabilities":[{"id":"CVE-2024-11053","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-11-02","epss":0.01966,"percentile":0.80366}],"urls":["https://curl.se/docs/CVE-2024-11053.html","https://curl.se/docs/CVE-2024-11053.json","https://hackerone.com/reports/2829063","http://www.openwall.com/lists/oss-security/2024/12/11/1","https://security.netapp.com/advisory/ntap-20250124-0012/","https://security.netapp.com/advisory/ntap-20250131-0003/","https://security.netapp.com/advisory/ntap-20250131-0004/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-212953.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11053","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password."}]},{"artifact":{"id":"6c6ae95c8b3d93fb","cpes":["cpe:2.3:a:libcurl4-gnutls-dev:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4-gnutls-dev:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls_dev:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls_dev:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4-gnutls:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4-gnutls:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl4-gnutls-dev","purl":"pkg:deb/ubuntu/libcurl4-gnutls-dev@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4-gnutls-dev/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libcurl4-gnutls-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4-gnutls-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libcurl4-gnutls-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.20"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11053","versionConstraint":"< 7.81.0-1ubuntu1.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-11053","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.20"],"available":[{"date":"2024-12-16","kind":"advisory","version":"7.81.0-1ubuntu1.20"}]},"cvss":[],"epss":[{"cve":"CVE-2024-11053","date":"2026-11-02","epss":0.01966,"percentile":0.80366}],"risk":0.5898,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-11053"},"relatedVulnerabilities":[{"id":"CVE-2024-11053","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-11-02","epss":0.01966,"percentile":0.80366}],"urls":["https://curl.se/docs/CVE-2024-11053.html","https://curl.se/docs/CVE-2024-11053.json","https://hackerone.com/reports/2829063","http://www.openwall.com/lists/oss-security/2024/12/11/1","https://security.netapp.com/advisory/ntap-20250124-0012/","https://security.netapp.com/advisory/ntap-20250131-0003/","https://security.netapp.com/advisory/ntap-20250131-0004/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-212953.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11053","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password."}]},{"artifact":{"id":"3a060baa137f74ea","cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@17.0.10%2B7?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk17u.git","type":"binary","version":"17.0.10+7","language":"","licenses":[],"metadata":{"release":{"fullVersion":"17.0.10+7","javaVersion":"17.0.10","semanticVersion":"17.0.10+7","javaRuntimeVersion":"17.0.10+7"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:8b8fefae6897ed4bfb12e519d4bdcaca9564779609395dcc3238ea1d369600aa","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"17.0.16"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-50106","versionConstraint":"< 1.8.0_462||>= 1.9, < 8.0.462||>= 12, < 17.0.16||>= 18, < 21.0.8||>= 22, < 24.0.2||>= 9, < 11.0.28 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"17.0.10+7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-50106","fix":{"state":"fixed","versions":["1.8.0_462","8.0.462","11.0.28","17.0.16","21.0.8","24.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_462"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.462"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.16"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.8"},{"date":"2025-09-04","kind":"first-observed","version":"24.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.28"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-50106","date":"2026-11-02","epss":0.00751,"percentile":0.54998}],"risk":0.5857800000000001,"urls":["https://www.oracle.com/security-alerts/cpujul2025.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00014.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50106","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and  24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."},"relatedVulnerabilities":[]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.121"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h3x4-894j-xpx5","versionConstraint":">=9.0.0-M1,<9.0.121 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h3x4-894j-xpx5","fix":{"state":"fixed","versions":["9.0.121"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"9.0.121"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68525","cwe":"CWE-863","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-68525","date":"2026-11-02","epss":0.00643,"percentile":0.50824}],"risk":0.5819150000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-68525","https://lists.apache.org/thread/x1y2lfsgzxwzc456f8954vbvgn03zhd7","http://www.openwall.com/lists/oss-security/2026/08/26/7","https://github.com/apache/tomcat/commit/10d048e16034ddf12055e0cede0da05b15c823b8","https://github.com/apache/tomcat/commit/32f0c38526b4e655ff0c17cd97afedefc624fe43","https://github.com/apache/tomcat/commit/58123aa468a20e2a079b7e0c68a4009e2475c098","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h3x4-894j-xpx5","description":"Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-68525","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68525","cwe":"CWE-863","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-68525","date":"2026-11-02","epss":0.00643,"percentile":0.50824}],"urls":["https://lists.apache.org/thread/x1y2lfsgzxwzc456f8954vbvgn03zhd7","http://www.openwall.com/lists/oss-security/2026/08/26/7"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68525","description":"Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET.\n\n\n\n\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\n\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue."}]},{"artifact":{"id":"c37764faf81b0045","cpes":["cpe:2.3:a:apache:log4j-core:2.22.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.22.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.22.0:*:*:*:*:*:*:*"],"name":"log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.22.0","type":"java-archive","version":"2.22.0","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.logging.log4j","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:org.apache.logging.log4j:log4j-core","manifestName":"","pomArtifactID":"log4j-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.25.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-445c-vh5m-36rj","versionConstraint":">=2.21.0,<2.25.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.22.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-445c-vh5m-36rj","fix":{"state":"fixed","versions":["2.25.4"],"available":[{"date":"2026-04-14","kind":"first-observed","version":"2.25.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34478","cwe":"CWE-117","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-34478","cwe":"CWE-684","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-34478","date":"2026-11-02","epss":0.00972,"percentile":0.61978}],"risk":0.57834,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-34478","https://github.com/apache/logging-log4j2/pull/4074","https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout","https://logging.apache.org/security.html#CVE-2026-34478","http://www.openwall.com/lists/oss-security/2026/04/10/7"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-445c-vh5m-36rj","description":"Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibility"},"relatedVulnerabilities":[{"id":"CVE-2026-34478","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34478","cwe":"CWE-117","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-34478","cwe":"CWE-684","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-34478","date":"2026-11-02","epss":0.00972,"percentile":0.61978}],"urls":["https://github.com/apache/logging-log4j2/pull/4074","https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout","https://logging.apache.org/security.html#CVE-2026-34478","http://www.openwall.com/lists/oss-security/2026/04/10/7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34478","description":"Apache Log4j Core's  Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.\n\nTwo distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:\n\n  *  The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.\n  *  The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.\n\n\nUsers of the SyslogAppender are not affected, as its configuration attributes were not modified.\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue."}]},{"artifact":{"id":"dc421bdd72d6d882","cpes":["cpe:2.3:a:com.microsoft.sqlserver.jdbc.osgi.Activator:mssql-jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:com.microsoft.sqlserver.jdbc.osgi.Activator:mssql_jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:com.microsoft.sqlserver.jdbc.osgi.Activator:jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:com.microsoft.sqlserver.mssql-jdbc:mssql-jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:com.microsoft.sqlserver.mssql-jdbc:mssql_jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:com.microsoft.sqlserver.mssql-jdbc:jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:com.microsoft.sqlserver:mssql-jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:com.microsoft.sqlserver:mssql_jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:com.microsoft.sqlserver:jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:mssql-jdbc:mssql-jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:mssql-jdbc:mssql_jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:mssql_jdbc:mssql-jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:mssql_jdbc:mssql_jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:Activator:mssql-jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:Activator:mssql_jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft:mssql-jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft:mssql_jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:sqlserver:mssql-jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:sqlserver:mssql_jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:mssql:mssql-jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:mssql:mssql_jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:mssql-jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:mssql_jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:mssql-jdbc:jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:mssql_jdbc:jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:osgi:mssql-jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:osgi:mssql_jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:Activator:jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft:jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:sqlserver:jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:mssql:jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:jdbc:9.4.1:*:*:*:*:*:*:*","cpe:2.3:a:osgi:jdbc:9.4.1:*:*:*:*:*:*:*"],"name":"mssql-jdbc","purl":"pkg:maven/com.microsoft.sqlserver/mssql-jdbc@9.4.1","type":"java-archive","version":"9.4.1","language":"java","licenses":["http://www.opensource.org/licenses/mit-license.php"],"metadata":{"pomGroupID":"com.microsoft.sqlserver","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/mssql-jdbc-9.4.1.jre8.jar","manifestName":"","pomArtifactID":"mssql-jdbc","archiveDigests":[{"value":"add1e80b29faaf3daef2ff503b572bd2b41c0439","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/mssql-jdbc-9.4.1.jre8.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/mssql-jdbc-9.4.1.jre8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"10.2.4.jre11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m494-w24q-6f7w","versionConstraint":">=8.3.0.jre11-preview,<10.2.4.jre11 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.microsoft.sqlserver:mssql-jdbc","version":"9.4.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-m494-w24q-6f7w","fix":{"state":"fixed","versions":["10.2.4.jre11"],"available":[{"date":"2025-11-06","kind":"first-observed","version":"10.2.4.jre11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-59250","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2025-59250","date":"2026-11-02","epss":0.00735,"percentile":0.54441}],"risk":0.5733,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-59250","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59250","https://github.com/microsoft/mssql-jdbc/pull/2798","https://github.com/microsoft/mssql-jdbc/pull/2800","https://github.com/microsoft/mssql-jdbc/pull/2801","https://github.com/microsoft/mssql-jdbc/pull/2802","https://github.com/microsoft/mssql-jdbc/pull/2803","https://github.com/microsoft/mssql-jdbc/pull/2807","https://github.com/microsoft/mssql-jdbc/blob/main/CHANGELOG.md","https://github.com/microsoft/mssql-jdbc/commit/9732e1bbc6ec44166fda2cddab31ce1c86c873dd#diff-45367b99a1951943bfecfc7765e80df687967aa56286a5b2e039f77cd9a0e118","https://learn.microsoft.com/en-us/sql/connect/jdbc/microsoft-jdbc-driver-for-sql-server-support-matrix"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m494-w24q-6f7w","description":"JDBC Driver for SQL Server has improper input validation issue"},"relatedVulnerabilities":[{"id":"CVE-2025-59250","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-59250","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2025-59250","date":"2026-11-02","epss":0.00735,"percentile":0.54441}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59250"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-59250","description":"Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network."}]},{"artifact":{"id":"99eab8abc4efa46b","cpes":["cpe:2.3:a:org.springframework:spring-webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring-webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring_webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring-webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring_webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-webmvc:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_webmvc:5.3.31:*:*:*:*:*:*:*"],"name":"spring-webmvc","purl":"pkg:maven/org.springframework/spring-webmvc@5.3.31","type":"java-archive","version":"5.3.31","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-webmvc-5.3.31.jar","manifestName":"","pomArtifactID":"spring-webmvc","archiveDigests":[{"value":"45754d056effe8257a012f6b98ed5454cf1e8960","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-webmvc-5.3.31.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-webmvc-5.3.31.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pc63-qcmh-9cmg","versionConstraint":">=5.3.0,<=5.3.49 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-webmvc","version":"5.3.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pc63-qcmh-9cmg","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47884","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47884","date":"2026-11-02","epss":0.00605,"percentile":0.48942}],"risk":0.5687,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-47884","https://spring.io/security/cve-2026-47884","https://github.com/spring-projects/spring-framework/commit/692dbc9160de3b5de50ccedeee014716d0cedb7b"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pc63-qcmh-9cmg","description":"Spring Framework Improper Path Limitation in XsltView"},"relatedVulnerabilities":[{"id":"CVE-2026-47884","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47884","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47884","date":"2026-11-02","epss":0.00605,"percentile":0.48942}],"urls":["https://spring.io/security/cve-2026-47884"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47884","description":"Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an \"/**\" mapping that results in view rendering, and where the view name is not explicitly specified.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19\nSpring Framework 6.1.0 - 6.1.28\nSpring Framework 6.0.0 - 6.0.30\nSpring Framework 5.3.0 - 5.3.49\nSpring Framework 5.2.25.RELEASE and earlier"}]},{"artifact":{"id":"b7b3356925d8b3a0","cpes":["cpe:2.3:a:bouncycastle-org:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bc_fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc_fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc_fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc_fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc_fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc_fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc_fips:1.0.2.4:*:*:*:*:*:*:*"],"name":"bc-fips","purl":"pkg:maven/org.bouncycastle/bc-fips@1.0.2.4","type":"java-archive","version":"1.0.2.4","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/atlassian/bitbucket/opensearch/lib/tools/plugin-cli/bc-fips-1.0.2.4.jar","manifestName":"","pomArtifactID":"bc-fips","archiveDigests":[{"value":"9008d04fc13da6455e6a792935b93b629757335d","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/lib/tools/plugin-cli/bc-fips-1.0.2.4.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/lib/tools/plugin-cli/bc-fips-1.0.2.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.0.2.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8xfc-gm6g-vgpv","versionConstraint":"<1.0.2.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bc-fips","version":"1.0.2.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-8xfc-gm6g-vgpv","fix":{"state":"fixed","versions":["1.0.2.5"],"available":[{"date":"2024-05-15","kind":"first-observed","version":"1.0.2.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29857","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-29857","date":"2026-11-02","epss":0.011,"percentile":0.6568}],"risk":0.5665,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-29857","https://github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9029857","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9029857","https://www.bouncycastle.org/latest_releases.html","https://github.com/bcgit/bc-csharp/commit/56daa6eac526f165416d17f661422d60de0dfd63","https://github.com/bcgit/bc-java/commit/fee80dd230e7fba132d03a34f1dd1d6aae0d0281","https://github.com/bcgit/bc-java/commit/efc498ca4caa340ac2fe11f2efee06c1a294501f","https://security.netapp.com/advisory/ntap-20241206-0008"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8xfc-gm6g-vgpv","description":"Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation."},"relatedVulnerabilities":[{"id":"CVE-2024-29857","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29857","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-29857","date":"2026-11-02","epss":0.011,"percentile":0.6568}],"urls":["https://github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9029857","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9029857","https://www.bouncycastle.org/latest_releases.html","https://security.netapp.com/advisory/ntap-20241206-0008/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-29857","description":"An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters."}]},{"artifact":{"id":"c1e86990bac3051c","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.75","type":"java-archive","version":"1.75","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"df22e1b6a9f6b218913f5b68dd16641344397fe0","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.78"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8xfc-gm6g-vgpv","versionConstraint":"<1.78 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.75"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-8xfc-gm6g-vgpv","fix":{"state":"fixed","versions":["1.78"],"available":[{"date":"2024-05-15","kind":"first-observed","version":"1.78"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29857","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-29857","date":"2026-11-02","epss":0.011,"percentile":0.6568}],"risk":0.5665,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-29857","https://github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9029857","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9029857","https://www.bouncycastle.org/latest_releases.html","https://github.com/bcgit/bc-csharp/commit/56daa6eac526f165416d17f661422d60de0dfd63","https://github.com/bcgit/bc-java/commit/fee80dd230e7fba132d03a34f1dd1d6aae0d0281","https://github.com/bcgit/bc-java/commit/efc498ca4caa340ac2fe11f2efee06c1a294501f","https://security.netapp.com/advisory/ntap-20241206-0008"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8xfc-gm6g-vgpv","description":"Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation."},"relatedVulnerabilities":[{"id":"CVE-2024-29857","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29857","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-29857","date":"2026-11-02","epss":0.011,"percentile":0.6568}],"urls":["https://github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9029857","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9029857","https://www.bouncycastle.org/latest_releases.html","https://security.netapp.com/advisory/ntap-20241206-0008/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-29857","description":"An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters."}]},{"artifact":{"id":"af534de498eed696","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-45491","versionConstraint":"< 2.4.7-1ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-45491","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.4"],"available":[{"date":"2024-09-17","kind":"advisory","version":"2.4.7-1ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-45491","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45491","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45491","date":"2026-11-02","epss":0.0113,"percentile":0.66403}],"risk":0.565,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-45491"},"relatedVulnerabilities":[{"id":"CVE-2024-45491","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-45491","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45491","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45491","date":"2026-11-02","epss":0.0113,"percentile":0.66403}],"urls":["https://github.com/libexpat/libexpat/issues/888","https://github.com/libexpat/libexpat/pull/891","https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html","https://security.netapp.com/advisory/ntap-20241018-0003/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45491","description":"An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX)."}]},{"artifact":{"id":"23731e55f78e12a9","cpes":["cpe:2.3:a:libexpat1-dev:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1-dev:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1_dev:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1_dev:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1-dev","purl":"pkg:deb/ubuntu/libexpat1-dev@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1-dev/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libexpat1-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libexpat1-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-45491","versionConstraint":"< 2.4.7-1ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-45491","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.4"],"available":[{"date":"2024-09-17","kind":"advisory","version":"2.4.7-1ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-45491","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45491","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45491","date":"2026-11-02","epss":0.0113,"percentile":0.66403}],"risk":0.565,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-45491"},"relatedVulnerabilities":[{"id":"CVE-2024-45491","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-45491","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45491","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45491","date":"2026-11-02","epss":0.0113,"percentile":0.66403}],"urls":["https://github.com/libexpat/libexpat/issues/888","https://github.com/libexpat/libexpat/pull/891","https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html","https://security.netapp.com/advisory/ntap-20241018-0003/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45491","description":"An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX)."}]},{"artifact":{"id":"af534de498eed696","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-50602","versionConstraint":"< 2.4.7-1ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-50602","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.5"],"available":[{"date":"2024-12-10","kind":"advisory","version":"2.4.7-1ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-50602","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-50602","date":"2026-11-02","epss":0.01117,"percentile":0.66097}],"risk":0.5585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-50602"},"relatedVulnerabilities":[{"id":"CVE-2024-50602","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-50602","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-50602","date":"2026-11-02","epss":0.01117,"percentile":0.66097}],"urls":["https://github.com/libexpat/libexpat/pull/915","https://lists.debian.org/debian-lts-announce/2025/04/msg00040.html","https://security.netapp.com/advisory/ntap-20250404-0008/","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://docs.python.org/release/3.10.16/whatsnew/changelog.html","https://docs.python.org/release/3.11.11/whatsnew/changelog.html#python-3-11-11","https://docs.python.org/release/3.12.8/whatsnew/changelog.html#python-3-12-8","https://docs.python.org/release/3.13.1/whatsnew/changelog.html#python-3-13-1","https://docs.python.org/release/3.9.21/whatsnew/changelog.html","https://github.com/python/cpython/issues/126623"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-50602","description":"An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser."}]},{"artifact":{"id":"23731e55f78e12a9","cpes":["cpe:2.3:a:libexpat1-dev:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1-dev:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1_dev:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1_dev:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1:libexpat1-dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libexpat1:libexpat1_dev:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1-dev","purl":"pkg:deb/ubuntu/libexpat1-dev@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1-dev/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libexpat1-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libexpat1-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-50602","versionConstraint":"< 2.4.7-1ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-50602","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.5"],"available":[{"date":"2024-12-10","kind":"advisory","version":"2.4.7-1ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-50602","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-50602","date":"2026-11-02","epss":0.01117,"percentile":0.66097}],"risk":0.5585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-50602"},"relatedVulnerabilities":[{"id":"CVE-2024-50602","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-50602","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-50602","date":"2026-11-02","epss":0.01117,"percentile":0.66097}],"urls":["https://github.com/libexpat/libexpat/pull/915","https://lists.debian.org/debian-lts-announce/2025/04/msg00040.html","https://security.netapp.com/advisory/ntap-20250404-0008/","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://docs.python.org/release/3.10.16/whatsnew/changelog.html","https://docs.python.org/release/3.11.11/whatsnew/changelog.html#python-3-11-11","https://docs.python.org/release/3.12.8/whatsnew/changelog.html#python-3-12-8","https://docs.python.org/release/3.13.1/whatsnew/changelog.html#python-3-13-1","https://docs.python.org/release/3.9.21/whatsnew/changelog.html","https://github.com/python/cpython/issues/126623"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-50602","description":"An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser."}]},{"artifact":{"id":"1f8e56f352643db0","cpes":["cpe:2.3:a:libtasn1-6:libtasn1-6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1-6:libtasn1_6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1-6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1_6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1-6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1_6:4.18.0-4build1:*:*:*:*:*:*:*"],"name":"libtasn1-6","purl":"pkg:deb/ubuntu/libtasn1-6@4.18.0-4build1?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"4.18.0-4build1","language":"","licenses":["sha256:88a94e40a34bb28145805747cad4018e7eb976b5fd0bf2329dedf90088ebc6e4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtasn1-6/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libtasn1-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.18.0-4ubuntu0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-12133","versionConstraint":"< 4.18.0-4ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libtasn1-6","version":"4.18.0-4build1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-12133","fix":{"state":"fixed","versions":["4.18.0-4ubuntu0.1"],"available":[{"date":"2025-02-18","kind":"advisory","version":"4.18.0-4ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-12133","cwe":"CWE-407","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-12133","date":"2026-11-02","epss":0.0111,"percentile":0.65925}],"risk":0.555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-12133"},"relatedVulnerabilities":[{"id":"CVE-2024-12133","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-12133","cwe":"CWE-407","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-12133","date":"2026-11-02","epss":0.0111,"percentile":0.65925}],"urls":["https://access.redhat.com/errata/RHSA-2025:17347","https://access.redhat.com/errata/RHSA-2025:4049","https://access.redhat.com/errata/RHSA-2025:7077","https://access.redhat.com/errata/RHSA-2025:8021","https://access.redhat.com/errata/RHSA-2025:8385","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/security/cve/CVE-2024-12133","https://bugzilla.redhat.com/show_bug.cgi?id=2344611","https://gitlab.com/gnutls/libtasn1/-/blob/master/doc/security/CVE-2024-12133.md","https://gitlab.com/gnutls/libtasn1/-/issues/52","http://www.openwall.com/lists/oss-security/2025/02/06/6","https://lists.debian.org/debian-lts-announce/2025/02/msg00025.html","https://security.netapp.com/advisory/ntap-20250523-0003/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-12133","description":"A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack."}]},{"artifact":{"id":"c0b145b45a6f9d3f","cpes":["cpe:2.3:a:wget:wget:1.21.2-2ubuntu1:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:deb/ubuntu/wget@1.21.2-2ubuntu1?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"1.21.2-2ubuntu1","language":"","licenses":["sha256:c58cb5a2d94f35f0e9b0f1a038d48b73477aa12782ff17328c21d8a86f5f99d5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/wget/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/wget/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.conffiles","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/wget.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/wget.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.list","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/wget.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-31879","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"wget","version":"1.21.2-2ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2021-31879","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-31879","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31879","date":"2026-11-02","epss":0.01104,"percentile":0.65763}],"risk":0.5519999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-31879"},"relatedVulnerabilities":[{"id":"CVE-2021-31879","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-31879","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31879","date":"2026-11-02","epss":0.01104,"percentile":0.65763}],"urls":["https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html","https://security.netapp.com/advisory/ntap-20210618-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-31879","description":"GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-6923","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6923","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6923","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-6923","date":"2026-11-02","epss":0.011,"percentile":0.6567}],"risk":0.5499999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6923"},"relatedVulnerabilities":[{"id":"CVE-2024-6923","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.5,"impactScore":3.4,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6923","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-6923","date":"2026-11-02","epss":0.011,"percentile":0.6567}],"urls":["https://github.com/python/cpython/commit/06f28dc236708f72871c64d4bc4b4ea144c50147","https://github.com/python/cpython/commit/097633981879b3c9de9a1dd120d3aa585ecc2384","https://github.com/python/cpython/commit/4766d1200fdf8b6728137aa2927a297e224d5fa7","https://github.com/python/cpython/commit/4aaa4259b5a6e664b7316a4d60bdec7ee0f124d0","https://github.com/python/cpython/commit/b158a76ce094897c870fb6b3de62887b7ccc33f1","https://github.com/python/cpython/commit/f7be505d137a22528cb0fc004422c0081d5d90e6","https://github.com/python/cpython/commit/f7c0f09e69e950cf3c5ada9dbde93898eb975533","https://github.com/python/cpython/issues/121650","https://github.com/python/cpython/pull/122233","https://mail.python.org/archives/list/security-announce@python.org/thread/QH3BUOE2DYQBWP7NAQ7UNHPPOELKISRW/","http://www.openwall.com/lists/oss-security/2024/08/01/3","http://www.openwall.com/lists/oss-security/2024/08/02/2","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/01/msg00005.html","https://security.netapp.com/advisory/ntap-20240926-0003/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6923","description":"There is a MEDIUM severity vulnerability affecting CPython.\n\nThe \nemail module didn’t properly quote newlines for email headers when \nserializing an email message allowing for header injection when an email\n is serialized."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-6923","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6923","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6923","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-6923","date":"2026-11-02","epss":0.011,"percentile":0.6567}],"risk":0.5499999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6923"},"relatedVulnerabilities":[{"id":"CVE-2024-6923","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.5,"impactScore":3.4,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6923","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-6923","date":"2026-11-02","epss":0.011,"percentile":0.6567}],"urls":["https://github.com/python/cpython/commit/06f28dc236708f72871c64d4bc4b4ea144c50147","https://github.com/python/cpython/commit/097633981879b3c9de9a1dd120d3aa585ecc2384","https://github.com/python/cpython/commit/4766d1200fdf8b6728137aa2927a297e224d5fa7","https://github.com/python/cpython/commit/4aaa4259b5a6e664b7316a4d60bdec7ee0f124d0","https://github.com/python/cpython/commit/b158a76ce094897c870fb6b3de62887b7ccc33f1","https://github.com/python/cpython/commit/f7be505d137a22528cb0fc004422c0081d5d90e6","https://github.com/python/cpython/commit/f7c0f09e69e950cf3c5ada9dbde93898eb975533","https://github.com/python/cpython/issues/121650","https://github.com/python/cpython/pull/122233","https://mail.python.org/archives/list/security-announce@python.org/thread/QH3BUOE2DYQBWP7NAQ7UNHPPOELKISRW/","http://www.openwall.com/lists/oss-security/2024/08/01/3","http://www.openwall.com/lists/oss-security/2024/08/02/2","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/01/msg00005.html","https://security.netapp.com/advisory/ntap-20240926-0003/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6923","description":"There is a MEDIUM severity vulnerability affecting CPython.\n\nThe \nemail module didn’t properly quote newlines for email headers when \nserializing an email message allowing for header injection when an email\n is serialized."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-6923","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6923","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6923","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-6923","date":"2026-11-02","epss":0.011,"percentile":0.6567}],"risk":0.5499999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6923"},"relatedVulnerabilities":[{"id":"CVE-2024-6923","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.5,"impactScore":3.4,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6923","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-6923","date":"2026-11-02","epss":0.011,"percentile":0.6567}],"urls":["https://github.com/python/cpython/commit/06f28dc236708f72871c64d4bc4b4ea144c50147","https://github.com/python/cpython/commit/097633981879b3c9de9a1dd120d3aa585ecc2384","https://github.com/python/cpython/commit/4766d1200fdf8b6728137aa2927a297e224d5fa7","https://github.com/python/cpython/commit/4aaa4259b5a6e664b7316a4d60bdec7ee0f124d0","https://github.com/python/cpython/commit/b158a76ce094897c870fb6b3de62887b7ccc33f1","https://github.com/python/cpython/commit/f7be505d137a22528cb0fc004422c0081d5d90e6","https://github.com/python/cpython/commit/f7c0f09e69e950cf3c5ada9dbde93898eb975533","https://github.com/python/cpython/issues/121650","https://github.com/python/cpython/pull/122233","https://mail.python.org/archives/list/security-announce@python.org/thread/QH3BUOE2DYQBWP7NAQ7UNHPPOELKISRW/","http://www.openwall.com/lists/oss-security/2024/08/01/3","http://www.openwall.com/lists/oss-security/2024/08/02/2","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/01/msg00005.html","https://security.netapp.com/advisory/ntap-20240926-0003/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6923","description":"There is a MEDIUM severity vulnerability affecting CPython.\n\nThe \nemail module didn’t properly quote newlines for email headers when \nserializing an email message allowing for header injection when an email\n is serialized."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-6923","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6923","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6923","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-6923","date":"2026-11-02","epss":0.011,"percentile":0.6567}],"risk":0.5499999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6923"},"relatedVulnerabilities":[{"id":"CVE-2024-6923","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.5,"impactScore":3.4,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6923","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-6923","date":"2026-11-02","epss":0.011,"percentile":0.6567}],"urls":["https://github.com/python/cpython/commit/06f28dc236708f72871c64d4bc4b4ea144c50147","https://github.com/python/cpython/commit/097633981879b3c9de9a1dd120d3aa585ecc2384","https://github.com/python/cpython/commit/4766d1200fdf8b6728137aa2927a297e224d5fa7","https://github.com/python/cpython/commit/4aaa4259b5a6e664b7316a4d60bdec7ee0f124d0","https://github.com/python/cpython/commit/b158a76ce094897c870fb6b3de62887b7ccc33f1","https://github.com/python/cpython/commit/f7be505d137a22528cb0fc004422c0081d5d90e6","https://github.com/python/cpython/commit/f7c0f09e69e950cf3c5ada9dbde93898eb975533","https://github.com/python/cpython/issues/121650","https://github.com/python/cpython/pull/122233","https://mail.python.org/archives/list/security-announce@python.org/thread/QH3BUOE2DYQBWP7NAQ7UNHPPOELKISRW/","http://www.openwall.com/lists/oss-security/2024/08/01/3","http://www.openwall.com/lists/oss-security/2024/08/02/2","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/01/msg00005.html","https://security.netapp.com/advisory/ntap-20240926-0003/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6923","description":"There is a MEDIUM severity vulnerability affecting CPython.\n\nThe \nemail module didn’t properly quote newlines for email headers when \nserializing an email message allowing for header injection when an email\n is serialized."}]},{"artifact":{"id":"da11de78b531bf03","cpes":["cpe:2.3:a:libpng16-16:libpng16-16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16-16:libpng16_16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16_16:libpng16-16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16_16:libpng16_16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16:libpng16-16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16:libpng16_16:1.6.37-3build5:*:*:*:*:*:*:*"],"name":"libpng16-16","purl":"pkg:deb/ubuntu/libpng16-16@1.6.37-3build5?arch=amd64&distro=ubuntu-22.04&upstream=libpng1.6","type":"deb","version":"1.6.37-3build5","language":"","licenses":["Apache-2.0","BSD-3-clause","BSD-like-with-advertising-clause","GPL-2","GPL-2+","expat","libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpng16-16/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libpng16-16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpng16-16:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libpng16-16:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libpng1.6"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.6.37-3ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25646","versionConstraint":"< 1.6.37-3ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libpng1.6","version":"1.6.37-3build5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-25646","fix":{"state":"fixed","versions":["1.6.37-3ubuntu0.4"],"available":[{"date":"2026-02-12","kind":"advisory","version":"1.6.37-3ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-25646","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25646","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25646","cwe":"CWE-125","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25646","date":"2026-11-02","epss":0.01095,"percentile":0.65554}],"risk":0.5475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25646"},"relatedVulnerabilities":[{"id":"CVE-2026-25646","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25646","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25646","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25646","cwe":"CWE-125","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25646","date":"2026-11-02","epss":0.01095,"percentile":0.65554}],"urls":["https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88","https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3","http://www.openwall.com/lists/oss-security/2026/02/09/7","https://access.redhat.com/errata/RHSA-2026:10097","https://access.redhat.com/errata/RHSA-2026:12274","https://access.redhat.com/errata/RHSA-2026:14773","https://access.redhat.com/errata/RHSA-2026:15087","https://access.redhat.com/errata/RHSA-2026:16174","https://access.redhat.com/errata/RHSA-2026:17596","https://access.redhat.com/errata/RHSA-2026:3031","https://access.redhat.com/errata/RHSA-2026:3405","https://access.redhat.com/errata/RHSA-2026:3551","https://access.redhat.com/errata/RHSA-2026:3573","https://access.redhat.com/errata/RHSA-2026:3574","https://access.redhat.com/errata/RHSA-2026:3575","https://access.redhat.com/errata/RHSA-2026:3576","https://access.redhat.com/errata/RHSA-2026:3577","https://access.redhat.com/errata/RHSA-2026:3968","https://access.redhat.com/errata/RHSA-2026:3969","https://access.redhat.com/errata/RHSA-2026:4221","https://access.redhat.com/errata/RHSA-2026:4222","https://access.redhat.com/errata/RHSA-2026:4306","https://access.redhat.com/errata/RHSA-2026:4501","https://access.redhat.com/errata/RHSA-2026:4728","https://access.redhat.com/errata/RHSA-2026:4729","https://access.redhat.com/errata/RHSA-2026:4730","https://access.redhat.com/errata/RHSA-2026:4731","https://access.redhat.com/errata/RHSA-2026:4732","https://access.redhat.com/errata/RHSA-2026:4756","https://access.redhat.com/errata/RHSA-2026:5606","https://access.redhat.com/errata/RHSA-2026:6439","https://access.redhat.com/errata/RHSA-2026:6445","https://access.redhat.com/errata/RHSA-2026:6466","https://access.redhat.com/errata/RHSA-2026:6467","https://access.redhat.com/errata/RHSA-2026:6468","https://access.redhat.com/errata/RHSA-2026:6469","https://access.redhat.com/errata/RHSA-2026:6553","https://access.redhat.com/errata/RHSA-2026:6732","https://access.redhat.com/errata/RHSA-2026:7032","https://access.redhat.com/errata/RHSA-2026:7033","https://access.redhat.com/errata/RHSA-2026:7034","https://access.redhat.com/errata/RHSA-2026:7035","https://access.redhat.com/errata/RHSA-2026:7036","https://access.redhat.com/errata/RHSA-2026:7239","https://access.redhat.com/errata/RHSA-2026:7243","https://access.redhat.com/errata/RHSA-2026:8746","https://access.redhat.com/errata/RHSA-2026:8747","https://access.redhat.com/errata/RHSA-2026:8748","https://access.redhat.com/security/cve/CVE-2026-25646","https://bugzilla.redhat.com/show_bug.cgi?id=2438542","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25646.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25646","description":"LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55."}]},{"artifact":{"id":"7f5afd36e2a50847","cpes":["cpe:2.3:a:curl:curl:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.25"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8925","versionConstraint":"< 7.81.0-1ubuntu1.25 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-8925","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.25"],"available":[{"date":"2026-06-30","kind":"advisory","version":"7.81.0-1ubuntu1.25"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8925","date":"2026-11-02","epss":0.0108,"percentile":0.6511}],"risk":0.54,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8925"},"relatedVulnerabilities":[{"id":"CVE-2026-8925","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8925","date":"2026-11-02","epss":0.0108,"percentile":0.6511}],"urls":["https://curl.se/docs/CVE-2026-8925.html","https://curl.se/docs/CVE-2026-8925.json","https://hackerone.com/reports/3735193"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8925","description":"The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice."}]},{"artifact":{"id":"f75f86e9282bbba5","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.25"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8925","versionConstraint":"< 7.81.0-1ubuntu1.25 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-8925","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.25"],"available":[{"date":"2026-06-30","kind":"advisory","version":"7.81.0-1ubuntu1.25"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8925","date":"2026-11-02","epss":0.0108,"percentile":0.6511}],"risk":0.54,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8925"},"relatedVulnerabilities":[{"id":"CVE-2026-8925","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8925","date":"2026-11-02","epss":0.0108,"percentile":0.6511}],"urls":["https://curl.se/docs/CVE-2026-8925.html","https://curl.se/docs/CVE-2026-8925.json","https://hackerone.com/reports/3735193"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8925","description":"The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice."}]},{"artifact":{"id":"eebde1772607afd6","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.25"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8925","versionConstraint":"< 7.81.0-1ubuntu1.25 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-8925","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.25"],"available":[{"date":"2026-06-30","kind":"advisory","version":"7.81.0-1ubuntu1.25"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8925","date":"2026-11-02","epss":0.0108,"percentile":0.6511}],"risk":0.54,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8925"},"relatedVulnerabilities":[{"id":"CVE-2026-8925","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8925","date":"2026-11-02","epss":0.0108,"percentile":0.6511}],"urls":["https://curl.se/docs/CVE-2026-8925.html","https://curl.se/docs/CVE-2026-8925.json","https://hackerone.com/reports/3735193"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8925","description":"The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice."}]},{"artifact":{"id":"6c6ae95c8b3d93fb","cpes":["cpe:2.3:a:libcurl4-gnutls-dev:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4-gnutls-dev:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls_dev:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls_dev:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4-gnutls:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4-gnutls:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl4-gnutls-dev","purl":"pkg:deb/ubuntu/libcurl4-gnutls-dev@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4-gnutls-dev/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libcurl4-gnutls-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4-gnutls-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libcurl4-gnutls-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.25"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8925","versionConstraint":"< 7.81.0-1ubuntu1.25 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-8925","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.25"],"available":[{"date":"2026-06-30","kind":"advisory","version":"7.81.0-1ubuntu1.25"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8925","date":"2026-11-02","epss":0.0108,"percentile":0.6511}],"risk":0.54,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8925"},"relatedVulnerabilities":[{"id":"CVE-2026-8925","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8925","date":"2026-11-02","epss":0.0108,"percentile":0.6511}],"urls":["https://curl.se/docs/CVE-2026-8925.html","https://curl.se/docs/CVE-2026-8925.json","https://hackerone.com/reports/3735193"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8925","description":"The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice."}]},{"artifact":{"id":"f02275b79327efaf","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33601","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33601","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33601","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33601","date":"2026-11-02","epss":0.01075,"percentile":0.64985}],"risk":0.5375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33601"},"relatedVulnerabilities":[{"id":"CVE-2024-33601","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33601","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33601","date":"2026-11-02","epss":0.01075,"percentile":0.64985}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0014/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0007","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33601","description":"nscd: netgroup cache may terminate daemon on memory allocation failure\n\nThe Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or\nxrealloc and these functions may terminate the process due to a memory\nallocation failure resulting in a denial of service to the clients.  The\nflaw was introduced in glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"91ecf8e0fa5aba51","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/ubuntu/libc-dev-bin@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33601","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33601","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33601","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33601","date":"2026-11-02","epss":0.01075,"percentile":0.64985}],"risk":0.5375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33601"},"relatedVulnerabilities":[{"id":"CVE-2024-33601","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33601","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33601","date":"2026-11-02","epss":0.01075,"percentile":0.64985}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0014/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0007","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33601","description":"nscd: netgroup cache may terminate daemon on memory allocation failure\n\nThe Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or\nxrealloc and these functions may terminate the process due to a memory\nallocation failure resulting in a denial of service to the clients.  The\nflaw was introduced in glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"8da7e53d1801cfa5","cpes":["cpe:2.3:a:libc6:libc6:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33601","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33601","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33601","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33601","date":"2026-11-02","epss":0.01075,"percentile":0.64985}],"risk":0.5375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33601"},"relatedVulnerabilities":[{"id":"CVE-2024-33601","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33601","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33601","date":"2026-11-02","epss":0.01075,"percentile":0.64985}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0014/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0007","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33601","description":"nscd: netgroup cache may terminate daemon on memory allocation failure\n\nThe Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or\nxrealloc and these functions may terminate the process due to a memory\nallocation failure resulting in a denial of service to the clients.  The\nflaw was introduced in glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"5ee048fdc80b241c","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/ubuntu/libc6-dev@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33601","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33601","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33601","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33601","date":"2026-11-02","epss":0.01075,"percentile":0.64985}],"risk":0.5375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33601"},"relatedVulnerabilities":[{"id":"CVE-2024-33601","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33601","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33601","date":"2026-11-02","epss":0.01075,"percentile":0.64985}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0014/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0007","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33601","description":"nscd: netgroup cache may terminate daemon on memory allocation failure\n\nThe Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or\nxrealloc and these functions may terminate the process due to a memory\nallocation failure resulting in a denial of service to the clients.  The\nflaw was introduced in glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"a88b7869c938a730","cpes":["cpe:2.3:a:locales:locales:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/ubuntu/locales@2.35-0ubuntu3.6?arch=all&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33601","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33601","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33601","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33601","date":"2026-11-02","epss":0.01075,"percentile":0.64985}],"risk":0.5375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33601"},"relatedVulnerabilities":[{"id":"CVE-2024-33601","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33601","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33601","date":"2026-11-02","epss":0.01075,"percentile":0.64985}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0014/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0007","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33601","description":"nscd: netgroup cache may terminate daemon on memory allocation failure\n\nThe Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or\nxrealloc and these functions may terminate the process due to a memory\nallocation failure resulting in a denial of service to the clients.  The\nflaw was introduced in glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"da11de78b531bf03","cpes":["cpe:2.3:a:libpng16-16:libpng16-16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16-16:libpng16_16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16_16:libpng16-16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16_16:libpng16_16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16:libpng16-16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16:libpng16_16:1.6.37-3build5:*:*:*:*:*:*:*"],"name":"libpng16-16","purl":"pkg:deb/ubuntu/libpng16-16@1.6.37-3build5?arch=amd64&distro=ubuntu-22.04&upstream=libpng1.6","type":"deb","version":"1.6.37-3build5","language":"","licenses":["Apache-2.0","BSD-3-clause","BSD-like-with-advertising-clause","GPL-2","GPL-2+","expat","libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpng16-16/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libpng16-16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpng16-16:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libpng16-16:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libpng1.6"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.6.37-3ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33416","versionConstraint":"< 1.6.37-3ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libpng1.6","version":"1.6.37-3build5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-33416","fix":{"state":"fixed","versions":["1.6.37-3ubuntu0.5"],"available":[{"date":"2026-05-07","kind":"advisory","version":"1.6.37-3ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-33416","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33416","date":"2026-11-02","epss":0.01071,"percentile":0.6487}],"risk":0.5355000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33416"},"relatedVulnerabilities":[{"id":"CVE-2026-33416","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33416","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33416","date":"2026-11-02","epss":0.01071,"percentile":0.6487}],"urls":["https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb","https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667","https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25","https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1","https://github.com/pnggroup/libpng/pull/824","https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33416","description":"LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE` each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng 1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS` sets `png_ptr->trans_alpha = info_ptr->trans_alpha` (256-byte buffer) and `png_set_PLTE` sets `info_ptr->palette = png_ptr->palette` (768-byte buffer). In both cases, calling `png_free_data` (with `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr` pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes the issue."}]},{"artifact":{"id":"d7625713b45b9e56","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@8.20.1","type":"java-archive","version":"8.20.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-authentication-plugin-4.3.8.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-authentication-plugin-4.3.8.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-authentication-plugin-4.3.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xwmg-2g98-w7v9","versionConstraint":"<9.37.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"8.20.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xwmg-2g98-w7v9","fix":{"state":"fixed","versions":["9.37.4"],"available":[{"date":"2025-08-12","kind":"first-observed","version":"9.37.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"risk":0.52974,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-53864","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xwmg-2g98-w7v9","description":"Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON"},"relatedVulnerabilities":[{"id":"CVE-2025-53864","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53864","description":"Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson."}]},{"artifact":{"id":"e2fc1cc55ba36eb7","cpes":["cpe:2.3:a:com.nimbusds.nimbus-jose-jwt:nimbus-jose-jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds.nimbus-jose-jwt:nimbus_jose_jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id-ltd-:nimbus-jose-jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id-ltd-:nimbus_jose_jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id_ltd_:nimbus-jose-jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id_ltd_:nimbus_jose_jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.30.2:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.30.2:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.30.2","type":"java-archive","version":"9.30.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/nimbus-jose-jwt-9.30.2.jar","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":[{"value":"3a291d6af4007fd88df384249378130102912385","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/nimbus-jose-jwt-9.30.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/nimbus-jose-jwt-9.30.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xwmg-2g98-w7v9","versionConstraint":"<9.37.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.30.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xwmg-2g98-w7v9","fix":{"state":"fixed","versions":["9.37.4"],"available":[{"date":"2025-08-12","kind":"first-observed","version":"9.37.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"risk":0.52974,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-53864","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xwmg-2g98-w7v9","description":"Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON"},"relatedVulnerabilities":[{"id":"CVE-2025-53864","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53864","description":"Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson."}]},{"artifact":{"id":"55e63c196031b8c3","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.31","type":"java-archive","version":"9.31","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-universal-plugin-manager-plugin-6.5.0.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-universal-plugin-manager-plugin-6.5.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-universal-plugin-manager-plugin-6.5.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xwmg-2g98-w7v9","versionConstraint":"<9.37.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xwmg-2g98-w7v9","fix":{"state":"fixed","versions":["9.37.4"],"available":[{"date":"2025-08-12","kind":"first-observed","version":"9.37.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"risk":0.52974,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-53864","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xwmg-2g98-w7v9","description":"Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON"},"relatedVulnerabilities":[{"id":"CVE-2025-53864","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53864","description":"Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson."}]},{"artifact":{"id":"995f8946306aa2d2","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.31","type":"java-archive","version":"9.31","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/jwt-plugin-3.3.2.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/jwt-plugin-3.3.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/jwt-plugin-3.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xwmg-2g98-w7v9","versionConstraint":"<9.37.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xwmg-2g98-w7v9","fix":{"state":"fixed","versions":["9.37.4"],"available":[{"date":"2025-08-12","kind":"first-observed","version":"9.37.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"risk":0.52974,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-53864","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xwmg-2g98-w7v9","description":"Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON"},"relatedVulnerabilities":[{"id":"CVE-2025-53864","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53864","description":"Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson."}]},{"artifact":{"id":"177c38ea558d723d","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.31","type":"java-archive","version":"9.31","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/oauth2-client-plugin-3.1.5.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/oauth2-client-plugin-3.1.5.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/oauth2-client-plugin-3.1.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xwmg-2g98-w7v9","versionConstraint":"<9.37.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xwmg-2g98-w7v9","fix":{"state":"fixed","versions":["9.37.4"],"available":[{"date":"2025-08-12","kind":"first-observed","version":"9.37.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"risk":0.52974,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-53864","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xwmg-2g98-w7v9","description":"Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON"},"relatedVulnerabilities":[{"id":"CVE-2025-53864","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53864","description":"Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson."}]},{"artifact":{"id":"1131e26f141f84b9","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.31","type":"java-archive","version":"9.31","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/oauth2-provider-plugin-3.1.5.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/oauth2-provider-plugin-3.1.5.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/oauth2-provider-plugin-3.1.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xwmg-2g98-w7v9","versionConstraint":"<9.37.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xwmg-2g98-w7v9","fix":{"state":"fixed","versions":["9.37.4"],"available":[{"date":"2025-08-12","kind":"first-observed","version":"9.37.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"risk":0.52974,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-53864","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xwmg-2g98-w7v9","description":"Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON"},"relatedVulnerabilities":[{"id":"CVE-2025-53864","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53864","description":"Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson."}]},{"artifact":{"id":"ca0dfc9d88cdad07","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.9.3:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.9.3:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.9.3","type":"java-archive","version":"9.9.3","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-connect-server-plugin-3.1.2.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-connect-server-plugin-3.1.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-connect-server-plugin-3.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xwmg-2g98-w7v9","versionConstraint":"<9.37.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.9.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xwmg-2g98-w7v9","fix":{"state":"fixed","versions":["9.37.4"],"available":[{"date":"2025-08-12","kind":"first-observed","version":"9.37.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"risk":0.52974,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-53864","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xwmg-2g98-w7v9","description":"Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON"},"relatedVulnerabilities":[{"id":"CVE-2025-53864","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53864","description":"Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson."}]},{"artifact":{"id":"0fc5ab4c86eb7ea7","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/ubuntu/libssl-dev@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.25"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34182","versionConstraint":"< 3.0.2-0ubuntu1.25 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-34182","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.25"],"available":[{"date":"2026-06-09","kind":"advisory","version":"3.0.2-0ubuntu1.25"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-34182","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34182","date":"2026-11-02","epss":0.01057,"percentile":0.64455}],"risk":0.5285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34182"},"relatedVulnerabilities":[{"id":"CVE-2026-34182","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34182","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34182","date":"2026-11-02","epss":0.01057,"percentile":0.64455}],"urls":["https://github.com/openssl/openssl/commit/03c1f4d45fb963aee7d5833390c507cd290182bc","https://github.com/openssl/openssl/commit/439ed7d2c0962ce964482727264668bf277c333f","https://github.com/openssl/openssl/commit/7947e6a81eb8776802f159fb6762cb7fcf7e34c7","https://github.com/openssl/openssl/commit/9fd97f8cfdc2c0be214998de3b2b55c8edf6c7ac","https://github.com/openssl/openssl/commit/d2ca86bcd43e4f17d899f347101766b6107676e0","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34182","description":"Issue Summary: Cryptographic Message Services (CMS) processing fails to perform\nsufficient input validation on the cipher and tag length fields of\nAuthEnvelopedData containers, leading to various potential compromises.\n\nImpact Summary: Attackers making use of these vulnerabilities may achieve\nkey-equivalent functionality for a given CMS recipient and/or bypass integrity\nvalidation for a given message.\n\nIn one use case, an attacker may send a CMS message containing\nAuthEnvelopedData with the cipher specified as a non-AEAD cipher.  OpenSSL\nerroneously allows this selection, and attempts to decrypt and validate the\nmessage.\n\nAn on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData\naddressed to the victim can re-emit it with the recipientInfos set left\nbyte-for-byte intact, so the victim's private key still unwraps the genuine CEK\n(the content-encryption key), but with the inner OID rewritten to AES-256-OFB\n(Output Feedback Mode, an unauthenticated keystream mode) and with an\nattacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the\nreal CEK, never consults the MAC field, and CMS_decrypt() returns success.\n\nIf the application under attack responds to the attacker with any indicator\nshowing success or failure of the decryption effort, it is possible for the\nattacker to use this as an oracle to obtain key equivalent functionality for the\nCEK used for the chosen recipient of the message.\n\nIn another use case, an attacker can reduce the tag length of the chosen AEAD\ncipher for a given AuthEnvelopedData container to be a single byte long,\nallowing an attacker to brute force CMS decryption, producing an integrity\nbypass for applications that trust CMS_decrypt() to reject modified content.\n\nThe FIPS modules are not affected by this issue."}]},{"artifact":{"id":"080c8716011e8bcc","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.25"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34182","versionConstraint":"< 3.0.2-0ubuntu1.25 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-34182","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.25"],"available":[{"date":"2026-06-09","kind":"advisory","version":"3.0.2-0ubuntu1.25"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-34182","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34182","date":"2026-11-02","epss":0.01057,"percentile":0.64455}],"risk":0.5285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34182"},"relatedVulnerabilities":[{"id":"CVE-2026-34182","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34182","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34182","date":"2026-11-02","epss":0.01057,"percentile":0.64455}],"urls":["https://github.com/openssl/openssl/commit/03c1f4d45fb963aee7d5833390c507cd290182bc","https://github.com/openssl/openssl/commit/439ed7d2c0962ce964482727264668bf277c333f","https://github.com/openssl/openssl/commit/7947e6a81eb8776802f159fb6762cb7fcf7e34c7","https://github.com/openssl/openssl/commit/9fd97f8cfdc2c0be214998de3b2b55c8edf6c7ac","https://github.com/openssl/openssl/commit/d2ca86bcd43e4f17d899f347101766b6107676e0","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34182","description":"Issue Summary: Cryptographic Message Services (CMS) processing fails to perform\nsufficient input validation on the cipher and tag length fields of\nAuthEnvelopedData containers, leading to various potential compromises.\n\nImpact Summary: Attackers making use of these vulnerabilities may achieve\nkey-equivalent functionality for a given CMS recipient and/or bypass integrity\nvalidation for a given message.\n\nIn one use case, an attacker may send a CMS message containing\nAuthEnvelopedData with the cipher specified as a non-AEAD cipher.  OpenSSL\nerroneously allows this selection, and attempts to decrypt and validate the\nmessage.\n\nAn on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData\naddressed to the victim can re-emit it with the recipientInfos set left\nbyte-for-byte intact, so the victim's private key still unwraps the genuine CEK\n(the content-encryption key), but with the inner OID rewritten to AES-256-OFB\n(Output Feedback Mode, an unauthenticated keystream mode) and with an\nattacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the\nreal CEK, never consults the MAC field, and CMS_decrypt() returns success.\n\nIf the application under attack responds to the attacker with any indicator\nshowing success or failure of the decryption effort, it is possible for the\nattacker to use this as an oracle to obtain key equivalent functionality for the\nCEK used for the chosen recipient of the message.\n\nIn another use case, an attacker can reduce the tag length of the chosen AEAD\ncipher for a given AuthEnvelopedData container to be a single byte long,\nallowing an attacker to brute force CMS decryption, producing an integrity\nbypass for applications that trust CMS_decrypt() to reject modified content.\n\nThe FIPS modules are not affected by this issue."}]},{"artifact":{"id":"e6933be022de0634","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.25"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-34182","versionConstraint":"< 3.0.2-0ubuntu1.25 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-34182","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.25"],"available":[{"date":"2026-06-09","kind":"advisory","version":"3.0.2-0ubuntu1.25"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-34182","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34182","date":"2026-11-02","epss":0.01057,"percentile":0.64455}],"risk":0.5285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34182"},"relatedVulnerabilities":[{"id":"CVE-2026-34182","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34182","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34182","date":"2026-11-02","epss":0.01057,"percentile":0.64455}],"urls":["https://github.com/openssl/openssl/commit/03c1f4d45fb963aee7d5833390c507cd290182bc","https://github.com/openssl/openssl/commit/439ed7d2c0962ce964482727264668bf277c333f","https://github.com/openssl/openssl/commit/7947e6a81eb8776802f159fb6762cb7fcf7e34c7","https://github.com/openssl/openssl/commit/9fd97f8cfdc2c0be214998de3b2b55c8edf6c7ac","https://github.com/openssl/openssl/commit/d2ca86bcd43e4f17d899f347101766b6107676e0","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34182","description":"Issue Summary: Cryptographic Message Services (CMS) processing fails to perform\nsufficient input validation on the cipher and tag length fields of\nAuthEnvelopedData containers, leading to various potential compromises.\n\nImpact Summary: Attackers making use of these vulnerabilities may achieve\nkey-equivalent functionality for a given CMS recipient and/or bypass integrity\nvalidation for a given message.\n\nIn one use case, an attacker may send a CMS message containing\nAuthEnvelopedData with the cipher specified as a non-AEAD cipher.  OpenSSL\nerroneously allows this selection, and attempts to decrypt and validate the\nmessage.\n\nAn on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData\naddressed to the victim can re-emit it with the recipientInfos set left\nbyte-for-byte intact, so the victim's private key still unwraps the genuine CEK\n(the content-encryption key), but with the inner OID rewritten to AES-256-OFB\n(Output Feedback Mode, an unauthenticated keystream mode) and with an\nattacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the\nreal CEK, never consults the MAC field, and CMS_decrypt() returns success.\n\nIf the application under attack responds to the attacker with any indicator\nshowing success or failure of the decryption effort, it is possible for the\nattacker to use this as an oracle to obtain key equivalent functionality for the\nCEK used for the chosen recipient of the message.\n\nIn another use case, an attacker can reduce the tag length of the chosen AEAD\ncipher for a given AuthEnvelopedData container to be a single byte long,\nallowing an attacker to brute force CMS decryption, producing an integrity\nbypass for applications that trust CMS_decrypt() to reject modified content.\n\nThe FIPS modules are not affected by this issue."}]},{"artifact":{"id":"3a060baa137f74ea","cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@17.0.10%2B7?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk17u.git","type":"binary","version":"17.0.10+7","language":"","licenses":[],"metadata":{"release":{"fullVersion":"17.0.10+7","javaVersion":"17.0.10","semanticVersion":"17.0.10+7","javaRuntimeVersion":"17.0.10+7"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:8b8fefae6897ed4bfb12e519d4bdcaca9564779609395dcc3238ea1d369600aa","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"17.0.19"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-22016","versionConstraint":"< 1.8.0_492||>= 1.9, < 8.0.492||>= 12, < 17.0.19||>= 18, < 21.0.11||>= 22, < 25.0.3||>= 26, < 26.0.1||>= 9, < 11.0.31 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"17.0.10+7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-22016","fix":{"state":"fixed","versions":["1.8.0_492","8.0.492","11.0.31","17.0.19","21.0.11","25.0.3","26.0.1"],"available":[{"date":"2026-04-24","kind":"first-observed","version":"1.8.0_492"},{"date":"2026-04-24","kind":"first-observed","version":"8.0.492"},{"date":"2026-04-24","kind":"first-observed","version":"17.0.19"},{"date":"2026-04-24","kind":"first-observed","version":"21.0.11"},{"date":"2026-04-24","kind":"first-observed","version":"25.0.3"},{"date":"2026-04-24","kind":"first-observed","version":"26.0.1"},{"date":"2026-04-24","kind":"first-observed","version":"11.0.31"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22016","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-22016","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-22016","cwe":"CWE-611","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-22016","date":"2026-11-02","epss":0.00702,"percentile":0.53266}],"risk":0.5265000000000001,"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html","https://access.redhat.com/errata/RHSA-2026:11403","https://access.redhat.com/errata/RHSA-2026:11655","https://access.redhat.com/errata/RHSA-2026:11822","https://access.redhat.com/errata/RHSA-2026:11829","https://access.redhat.com/errata/RHSA-2026:11902","https://access.redhat.com/errata/RHSA-2026:22139","https://access.redhat.com/errata/RHSA-2026:22328","https://access.redhat.com/errata/RHSA-2026:9254","https://access.redhat.com/errata/RHSA-2026:9682","https://access.redhat.com/errata/RHSA-2026:9683","https://access.redhat.com/errata/RHSA-2026:9684","https://access.redhat.com/errata/RHSA-2026:9686","https://access.redhat.com/errata/RHSA-2026:9687","https://access.redhat.com/errata/RHSA-2026:9688","https://access.redhat.com/errata/RHSA-2026:9689","https://access.redhat.com/errata/RHSA-2026:9691","https://access.redhat.com/errata/RHSA-2026:9693","https://access.redhat.com/errata/RHSA-2026:9694","https://access.redhat.com/security/cve/CVE-2026-22016","https://bugzilla.redhat.com/show_bug.cgi?id=2460039","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22016.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22016","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and  21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"3a71b2136cbaef6c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.132.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pwqr-wmgm-9rr8","versionConstraint":"<4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pwqr-wmgm-9rr8","fix":{"state":"fixed","versions":["4.1.132.Final"],"available":[{"date":"2026-03-27","kind":"first-observed","version":"4.1.132.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33870","date":"2026-11-02","epss":0.00701,"percentile":0.5322}],"risk":0.52575,"urls":["https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110","https://nvd.nist.gov/vuln/detail/CVE-2026-33870"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pwqr-wmgm-9rr8","description":"Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-33870","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33870","date":"2026-11-02","epss":0.00701,"percentile":0.5322}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:7109","https://access.redhat.com/errata/RHSA-2026:7380","https://access.redhat.com/errata/RHSA-2026:8159","https://access.redhat.com/errata/RHSA-2026:8509","https://access.redhat.com/security/cve/CVE-2026-33870","https://bugzilla.redhat.com/show_bug.cgi?id=2452453","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33870.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33870","description":"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue."}]},{"artifact":{"id":"e6711addddd64a36","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.132.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pwqr-wmgm-9rr8","versionConstraint":"<4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pwqr-wmgm-9rr8","fix":{"state":"fixed","versions":["4.1.132.Final"],"available":[{"date":"2026-03-27","kind":"first-observed","version":"4.1.132.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33870","date":"2026-11-02","epss":0.00701,"percentile":0.5322}],"risk":0.52575,"urls":["https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110","https://nvd.nist.gov/vuln/detail/CVE-2026-33870"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pwqr-wmgm-9rr8","description":"Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-33870","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33870","date":"2026-11-02","epss":0.00701,"percentile":0.5322}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:7109","https://access.redhat.com/errata/RHSA-2026:7380","https://access.redhat.com/errata/RHSA-2026:8159","https://access.redhat.com/errata/RHSA-2026:8509","https://access.redhat.com/security/cve/CVE-2026-33870","https://bugzilla.redhat.com/show_bug.cgi?id=2452453","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33870.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33870","description":"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue."}]},{"artifact":{"id":"e3d98c49743c8191","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.132.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pwqr-wmgm-9rr8","versionConstraint":"<4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pwqr-wmgm-9rr8","fix":{"state":"fixed","versions":["4.1.132.Final"],"available":[{"date":"2026-03-27","kind":"first-observed","version":"4.1.132.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33870","date":"2026-11-02","epss":0.00701,"percentile":0.5322}],"risk":0.52575,"urls":["https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110","https://nvd.nist.gov/vuln/detail/CVE-2026-33870"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pwqr-wmgm-9rr8","description":"Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-33870","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33870","date":"2026-11-02","epss":0.00701,"percentile":0.5322}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:7109","https://access.redhat.com/errata/RHSA-2026:7380","https://access.redhat.com/errata/RHSA-2026:8159","https://access.redhat.com/errata/RHSA-2026:8509","https://access.redhat.com/security/cve/CVE-2026-33870","https://bugzilla.redhat.com/show_bug.cgi?id=2452453","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33870.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33870","description":"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue."}]},{"artifact":{"id":"d68e99b783ccdee5","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"c648f863b301e3fc62d0de098ec61be7628b8ea2","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.132.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pwqr-wmgm-9rr8","versionConstraint":"<4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pwqr-wmgm-9rr8","fix":{"state":"fixed","versions":["4.1.132.Final"],"available":[{"date":"2026-03-27","kind":"first-observed","version":"4.1.132.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33870","date":"2026-11-02","epss":0.00701,"percentile":0.5322}],"risk":0.52575,"urls":["https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110","https://nvd.nist.gov/vuln/detail/CVE-2026-33870"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pwqr-wmgm-9rr8","description":"Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-33870","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33870","date":"2026-11-02","epss":0.00701,"percentile":0.5322}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:7109","https://access.redhat.com/errata/RHSA-2026:7380","https://access.redhat.com/errata/RHSA-2026:8159","https://access.redhat.com/errata/RHSA-2026:8509","https://access.redhat.com/security/cve/CVE-2026-33870","https://bugzilla.redhat.com/show_bug.cgi?id=2452453","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33870.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33870","description":"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue."}]},{"artifact":{"id":"2692d67b14b4b286","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"c648f863b301e3fc62d0de098ec61be7628b8ea2","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.132.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pwqr-wmgm-9rr8","versionConstraint":"<4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pwqr-wmgm-9rr8","fix":{"state":"fixed","versions":["4.1.132.Final"],"available":[{"date":"2026-03-27","kind":"first-observed","version":"4.1.132.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33870","date":"2026-11-02","epss":0.00701,"percentile":0.5322}],"risk":0.52575,"urls":["https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110","https://nvd.nist.gov/vuln/detail/CVE-2026-33870"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pwqr-wmgm-9rr8","description":"Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-33870","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33870","date":"2026-11-02","epss":0.00701,"percentile":0.5322}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:7109","https://access.redhat.com/errata/RHSA-2026:7380","https://access.redhat.com/errata/RHSA-2026:8159","https://access.redhat.com/errata/RHSA-2026:8509","https://access.redhat.com/security/cve/CVE-2026-33870","https://bugzilla.redhat.com/show_bug.cgi?id=2452453","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33870.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33870","description":"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue."}]},{"artifact":{"id":"842dbc9fb51686ce","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.4:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.4?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.4","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42010","versionConstraint":"< 3.7.3-4ubuntu1.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.4"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-42010","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.9"],"available":[{"date":"2026-05-20","kind":"advisory","version":"3.7.3-4ubuntu1.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-42010","cwe":"CWE-170","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-42010","cwe":"CWE-626","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-42010","cwe":"CWE-170","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42010","date":"2026-11-02","epss":0.0105,"percentile":0.64282}],"risk":0.525,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42010"},"relatedVulnerabilities":[{"id":"CVE-2026-42010","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42010","cwe":"CWE-170","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-42010","cwe":"CWE-626","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-42010","cwe":"CWE-170","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42010","date":"2026-11-02","epss":0.0105,"percentile":0.64282}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:34764","https://access.redhat.com/errata/RHSA-2026:34788","https://access.redhat.com/errata/RHSA-2026:34790","https://access.redhat.com/errata/RHSA-2026:36004","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:40762","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:62409","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:67857","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-42010","https://bugzilla.redhat.com/show_bug.cgi?id=2467289","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-4","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42010.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42010","description":"A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.116"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-563x-q5rq-57qp","versionConstraint":">=7.0.0,<9.0.116 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-563x-q5rq-57qp","fix":{"state":"fixed","versions":["9.0.116"],"available":[{"date":"2026-04-11","kind":"first-observed","version":"9.0.116"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24880","cwe":"CWE-444","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-24880","date":"2026-11-02","epss":0.00697,"percentile":0.53065}],"risk":0.5227499999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-24880","https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn","http://www.openwall.com/lists/oss-security/2026/04/09/20","https://github.com/apache/tomcat/commit/1b586d6aa8ae65726da5fa8799427b5d4718478a","https://github.com/apache/tomcat/commit/1e71441a15972f56e661b0b549fb9e5d838b83bb","https://github.com/apache/tomcat/commit/2cb06c34f661ca42f7570bbcc21e99806184bcc5","https://github.com/apache/tomcat/commit/6d478dbe18b7c4bb671c30fedf130309b0dab77c","https://github.com/apache/tomcat/commit/f07df938d00f7419b40fa65aa912966d0efac522","https://github.com/apache/tomcat/commit/fde1a8235fb73125217bd41e162aa0a113f33552","https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.53","https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.20","https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.116","https://www.herodevs.com/vulnerability-directory/cve-2026-24880"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-563x-q5rq-57qp","description":"Apache Tomcat has an HTTP Request/Response Smuggling vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-24880","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24880","cwe":"CWE-444","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-24880","date":"2026-11-02","epss":0.00697,"percentile":0.53065}],"urls":["https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn","http://www.openwall.com/lists/oss-security/2026/04/09/20"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24880","description":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOther, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue."}]},{"artifact":{"id":"3a060baa137f74ea","cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@17.0.10%2B7?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk17u.git","type":"binary","version":"17.0.10+7","language":"","licenses":[],"metadata":{"release":{"fullVersion":"17.0.10+7","javaVersion":"17.0.10","semanticVersion":"17.0.10+7","javaRuntimeVersion":"17.0.10+7"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:8b8fefae6897ed4bfb12e519d4bdcaca9564779609395dcc3238ea1d369600aa","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"17.0.17"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-53066","versionConstraint":"< 1.8.0_472||>= 1.9, < 8.0.472||>= 12, < 17.0.17||>= 18, < 21.0.9||>= 22, < 25.0.1||>= 9, < 11.0.29 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"17.0.10+7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-53066","fix":{"state":"fixed","versions":["1.8.0_472","8.0.472","11.0.29","17.0.17","21.0.9","25.0.1"],"available":[{"date":"2025-10-23","kind":"first-observed","version":"1.8.0_472"},{"date":"2025-10-23","kind":"first-observed","version":"8.0.472"},{"date":"2025-10-23","kind":"first-observed","version":"17.0.17"},{"date":"2025-10-23","kind":"first-observed","version":"21.0.9"},{"date":"2025-10-23","kind":"first-observed","version":"25.0.1"},{"date":"2025-10-23","kind":"first-observed","version":"11.0.29"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53066","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53066","date":"2026-11-02","epss":0.00694,"percentile":0.52935}],"risk":0.5205,"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html","https://lists.debian.org/debian-lts-announce/2025/10/msg00026.html","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53066","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and  21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"76093a39750fc559","cpes":["cpe:2.3:a:com.hazelcast.osgi.impl.Activator:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast\\,-inc-:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast\\,_inc_:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:com.hazelcast:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:Activator:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:impl:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:osgi:hazelcast:5.2.2:*:*:*:*:*:*:*"],"name":"hazelcast","purl":"pkg:maven/com.hazelcast/hazelcast@5.2.2","type":"java-archive","version":"5.2.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.hazelcast","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar","manifestName":"","pomArtifactID":"hazelcast","archiveDigests":[{"value":"2467e0dc93a2cc4c911ca1b95913384bf891b95d","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.2.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c5vj-wp4v-mmvx","versionConstraint":">=5.2.0,<=5.2.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.hazelcast:hazelcast","version":"5.2.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c5vj-wp4v-mmvx","fix":{"state":"fixed","versions":["5.2.4"],"available":[{"date":"2023-07-20","kind":"first-observed","version":"5.2.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-33265","cwe":"CWE-862","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-33265","date":"2026-11-02","epss":0.00688,"percentile":0.52711}],"risk":0.51944,"urls":["https://github.com/hazelcast/hazelcast/security/advisories/GHSA-c5vj-wp4v-mmvx","https://nvd.nist.gov/vuln/detail/CVE-2023-33265","https://github.com/hazelcast/hazelcast","https://github.com/hazelcast/hazelcast/releases/tag/v5.0.5","https://github.com/hazelcast/hazelcast/releases/tag/v5.1.7","https://github.com/hazelcast/hazelcast/releases/tag/v5.2.4","https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c5vj-wp4v-mmvx","description":"Hazelcast Executor Services don't check client permissions properly"},"relatedVulnerabilities":[{"id":"CVE-2023-33265","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-33265","cwe":"CWE-862","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-33265","date":"2026-11-02","epss":0.00688,"percentile":0.52711}],"urls":["https://github.com/hazelcast/hazelcast","https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-33265","description":"In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted."}]},{"artifact":{"id":"0fc5ab4c86eb7ea7","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/ubuntu/libssl-dev@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.23"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-31790","versionConstraint":"< 3.0.2-0ubuntu1.23 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-31790","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.23"],"available":[{"date":"2026-04-08","kind":"advisory","version":"3.0.2-0ubuntu1.23"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-31790","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31790","date":"2026-11-02","epss":0.0103,"percentile":0.63727}],"risk":0.515,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-31790"},"relatedVulnerabilities":[{"id":"CVE-2026-31790","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31790","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31790","date":"2026-11-02","epss":0.0103,"percentile":0.63727}],"urls":["https://github.com/openssl/openssl/commit/001e01db3e996e13ffc72386fe79d03a6683b5ac","https://github.com/openssl/openssl/commit/abd8b2eec7e3f3fda60ecfb68498b246b52af482","https://github.com/openssl/openssl/commit/b922e24e5b23ffb9cb9e14cadff23d91e9f7e406","https://github.com/openssl/openssl/commit/d5f8e71cd0a54e961d0c3b174348f8308486f790","https://github.com/openssl/openssl/commit/eed200f58cd8645ed77e46b7e9f764e284df379e","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31790","description":"Issue summary: Applications using RSASVE key encapsulation to establish\na secret encryption key can send contents of an uninitialized memory buffer to\na malicious peer.\n\nImpact summary: The uninitialized buffer might contain sensitive data from the\nprevious execution of the application process which leads to sensitive data\nleakage to an attacker.\n\nRSA_public_encrypt() returns the number of bytes written on success and -1\non error. The affected code tests only whether the return value is non-zero.\nAs a result, if RSA encryption fails, encapsulation can still return success to\nthe caller, set the output lengths, and leave the caller to use the contents of\nthe ciphertext buffer as if a valid KEM ciphertext had been produced.\n\nIf applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an\nattacker-supplied invalid RSA public key without first validating that key,\nthen this may cause stale or uninitialized contents of the caller-provided\nciphertext buffer to be disclosed to the attacker in place of the KEM\nciphertext.\n\nAs a workaround calling EVP_PKEY_public_check() or\nEVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate\nthe issue.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue."}]},{"artifact":{"id":"080c8716011e8bcc","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.23"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-31790","versionConstraint":"< 3.0.2-0ubuntu1.23 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-31790","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.23"],"available":[{"date":"2026-04-08","kind":"advisory","version":"3.0.2-0ubuntu1.23"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-31790","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31790","date":"2026-11-02","epss":0.0103,"percentile":0.63727}],"risk":0.515,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-31790"},"relatedVulnerabilities":[{"id":"CVE-2026-31790","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31790","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31790","date":"2026-11-02","epss":0.0103,"percentile":0.63727}],"urls":["https://github.com/openssl/openssl/commit/001e01db3e996e13ffc72386fe79d03a6683b5ac","https://github.com/openssl/openssl/commit/abd8b2eec7e3f3fda60ecfb68498b246b52af482","https://github.com/openssl/openssl/commit/b922e24e5b23ffb9cb9e14cadff23d91e9f7e406","https://github.com/openssl/openssl/commit/d5f8e71cd0a54e961d0c3b174348f8308486f790","https://github.com/openssl/openssl/commit/eed200f58cd8645ed77e46b7e9f764e284df379e","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31790","description":"Issue summary: Applications using RSASVE key encapsulation to establish\na secret encryption key can send contents of an uninitialized memory buffer to\na malicious peer.\n\nImpact summary: The uninitialized buffer might contain sensitive data from the\nprevious execution of the application process which leads to sensitive data\nleakage to an attacker.\n\nRSA_public_encrypt() returns the number of bytes written on success and -1\non error. The affected code tests only whether the return value is non-zero.\nAs a result, if RSA encryption fails, encapsulation can still return success to\nthe caller, set the output lengths, and leave the caller to use the contents of\nthe ciphertext buffer as if a valid KEM ciphertext had been produced.\n\nIf applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an\nattacker-supplied invalid RSA public key without first validating that key,\nthen this may cause stale or uninitialized contents of the caller-provided\nciphertext buffer to be disclosed to the attacker in place of the KEM\nciphertext.\n\nAs a workaround calling EVP_PKEY_public_check() or\nEVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate\nthe issue.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue."}]},{"artifact":{"id":"e6933be022de0634","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.23"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-31790","versionConstraint":"< 3.0.2-0ubuntu1.23 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-31790","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.23"],"available":[{"date":"2026-04-08","kind":"advisory","version":"3.0.2-0ubuntu1.23"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-31790","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31790","date":"2026-11-02","epss":0.0103,"percentile":0.63727}],"risk":0.515,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-31790"},"relatedVulnerabilities":[{"id":"CVE-2026-31790","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31790","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31790","date":"2026-11-02","epss":0.0103,"percentile":0.63727}],"urls":["https://github.com/openssl/openssl/commit/001e01db3e996e13ffc72386fe79d03a6683b5ac","https://github.com/openssl/openssl/commit/abd8b2eec7e3f3fda60ecfb68498b246b52af482","https://github.com/openssl/openssl/commit/b922e24e5b23ffb9cb9e14cadff23d91e9f7e406","https://github.com/openssl/openssl/commit/d5f8e71cd0a54e961d0c3b174348f8308486f790","https://github.com/openssl/openssl/commit/eed200f58cd8645ed77e46b7e9f764e284df379e","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31790","description":"Issue summary: Applications using RSASVE key encapsulation to establish\na secret encryption key can send contents of an uninitialized memory buffer to\na malicious peer.\n\nImpact summary: The uninitialized buffer might contain sensitive data from the\nprevious execution of the application process which leads to sensitive data\nleakage to an attacker.\n\nRSA_public_encrypt() returns the number of bytes written on success and -1\non error. The affected code tests only whether the return value is non-zero.\nAs a result, if RSA encryption fails, encapsulation can still return success to\nthe caller, set the output lengths, and leave the caller to use the contents of\nthe ciphertext buffer as if a valid KEM ciphertext had been produced.\n\nIf applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an\nattacker-supplied invalid RSA public key without first validating that key,\nthen this may cause stale or uninitialized contents of the caller-provided\nciphertext buffer to be disclosed to the attacker in place of the KEM\nciphertext.\n\nAs a workaround calling EVP_PKEY_public_check() or\nEVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate\nthe issue.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue."}]},{"artifact":{"id":"e6711addddd64a36","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jppx-w49h-x2qq","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jppx-w49h-x2qq","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-11-02","epss":0.0063,"percentile":0.50188}],"risk":0.5103,"urls":["https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq","https://nvd.nist.gov/vuln/detail/CVE-2026-56745","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jppx-w49h-x2qq","description":"Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-56745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-11-02","epss":0.0063,"percentile":0.50188}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56745","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"e3d98c49743c8191","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jppx-w49h-x2qq","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jppx-w49h-x2qq","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-11-02","epss":0.0063,"percentile":0.50188}],"risk":0.5103,"urls":["https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq","https://nvd.nist.gov/vuln/detail/CVE-2026-56745","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jppx-w49h-x2qq","description":"Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-56745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-11-02","epss":0.0063,"percentile":0.50188}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56745","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"3a71b2136cbaef6c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jppx-w49h-x2qq","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jppx-w49h-x2qq","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-11-02","epss":0.0063,"percentile":0.50188}],"risk":0.5103,"urls":["https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq","https://nvd.nist.gov/vuln/detail/CVE-2026-56745","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jppx-w49h-x2qq","description":"Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-56745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-11-02","epss":0.0063,"percentile":0.50188}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56745","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"2692d67b14b4b286","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"c648f863b301e3fc62d0de098ec61be7628b8ea2","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jppx-w49h-x2qq","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jppx-w49h-x2qq","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-11-02","epss":0.0063,"percentile":0.50188}],"risk":0.5103,"urls":["https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq","https://nvd.nist.gov/vuln/detail/CVE-2026-56745","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jppx-w49h-x2qq","description":"Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-56745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-11-02","epss":0.0063,"percentile":0.50188}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56745","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"d68e99b783ccdee5","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"c648f863b301e3fc62d0de098ec61be7628b8ea2","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jppx-w49h-x2qq","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jppx-w49h-x2qq","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-11-02","epss":0.0063,"percentile":0.50188}],"risk":0.5103,"urls":["https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq","https://nvd.nist.gov/vuln/detail/CVE-2026-56745","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jppx-w49h-x2qq","description":"Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-56745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-11-02","epss":0.0063,"percentile":0.50188}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56745","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"eaaf707db378cc79","cpes":["cpe:2.3:a:apache:cxf-core:3.5.5:*:*:*:*:*:*:*","cpe:2.3:a:apache:cxf_core:3.5.5:*:*:*:*:*:*:*","cpe:2.3:a:apache:cxf:3.5.5:*:*:*:*:*:*:*"],"name":"cxf-core","purl":"pkg:maven/org.apache.cxf/cxf-core@3.5.5","type":"java-archive","version":"3.5.5","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.cxf","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/cxf-core-3.5.5.jar","manifestName":"","pomArtifactID":"cxf-core","archiveDigests":[{"value":"6920f145ab2e1b4a539da1658dcd26385b73564b","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/cxf-core-3.5.5.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/cxf-core-3.5.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.6.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xw5h-cmh3-8j6j","versionConstraint":"<3.6.12 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.cxf:cxf-core","version":"3.5.5"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xw5h-cmh3-8j6j","fix":{"state":"fixed","versions":["3.6.12"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.6.12"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49875","cwe":"CWE-611","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-49875","cwe":"CWE-611","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49875","date":"2026-11-02","epss":0.00533,"percentile":0.45025}],"risk":0.50102,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-49875","https://lists.apache.org/thread/3kb9w5bg90xcp06fccoz9k3gpsvyy79o","http://www.openwall.com/lists/oss-security/2026/06/11/2","https://access.redhat.com/security/cve/CVE-2026-49875","https://bugzilla.redhat.com/show_bug.cgi?id=2488309","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49875.json","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:37390","https://cxf.apache.org/security-advisories.data/CVE-2026-49875.txt"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xw5h-cmh3-8j6j","description":"Apache CXF has Improper Restriction of XML External Entity Reference"},"relatedVulnerabilities":[{"id":"CVE-2026-49875","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49875","cwe":"CWE-611","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-49875","cwe":"CWE-611","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49875","date":"2026-11-02","epss":0.00533,"percentile":0.45025}],"urls":["https://lists.apache.org/thread/3kb9w5bg90xcp06fccoz9k3gpsvyy79o","http://www.openwall.com/lists/oss-security/2026/06/11/2","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/security/cve/CVE-2026-49875","https://bugzilla.redhat.com/show_bug.cgi?id=2488309","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49875.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49875","description":"Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) \nexternal entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue."}]},{"artifact":{"id":"e3d98c49743c8191","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mvh2-crg5-v77c","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mvh2-crg5-v77c","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c","https://nvd.nist.gov/vuln/detail/CVE-2026-55833","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mvh2-crg5-v77c","description":"Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation"},"relatedVulnerabilities":[{"id":"CVE-2026-55833","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55833","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"e6711addddd64a36","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mvh2-crg5-v77c","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mvh2-crg5-v77c","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c","https://nvd.nist.gov/vuln/detail/CVE-2026-55833","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mvh2-crg5-v77c","description":"Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation"},"relatedVulnerabilities":[{"id":"CVE-2026-55833","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55833","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"3a71b2136cbaef6c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mvh2-crg5-v77c","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mvh2-crg5-v77c","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c","https://nvd.nist.gov/vuln/detail/CVE-2026-55833","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mvh2-crg5-v77c","description":"Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation"},"relatedVulnerabilities":[{"id":"CVE-2026-55833","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55833","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"2692d67b14b4b286","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"c648f863b301e3fc62d0de098ec61be7628b8ea2","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mvh2-crg5-v77c","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mvh2-crg5-v77c","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c","https://nvd.nist.gov/vuln/detail/CVE-2026-55833","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mvh2-crg5-v77c","description":"Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation"},"relatedVulnerabilities":[{"id":"CVE-2026-55833","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55833","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"d68e99b783ccdee5","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"c648f863b301e3fc62d0de098ec61be7628b8ea2","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mvh2-crg5-v77c","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mvh2-crg5-v77c","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c","https://nvd.nist.gov/vuln/detail/CVE-2026-55833","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mvh2-crg5-v77c","description":"Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation"},"relatedVulnerabilities":[{"id":"CVE-2026-55833","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55833","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"eae37dd4ad8fc905","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http2-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"cbf1a430ea44dbdedbcde16b185cbb95f28d72c7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http2-4.1.100.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http2-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-93wv-jw9v-4972","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-93wv-jw9v-4972","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-08-01","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972","https://nvd.nist.gov/vuln/detail/CVE-2026-56819","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-93wv-jw9v-4972","description":"Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-56819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56819","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"d8682c7fc9d4337d","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http2-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"cbf1a430ea44dbdedbcde16b185cbb95f28d72c7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http2-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-93wv-jw9v-4972","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-93wv-jw9v-4972","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-08-01","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972","https://nvd.nist.gov/vuln/detail/CVE-2026-56819","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-93wv-jw9v-4972","description":"Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-56819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56819","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"77f4a1a56c253c3b","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-93wv-jw9v-4972","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-93wv-jw9v-4972","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-08-01","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972","https://nvd.nist.gov/vuln/detail/CVE-2026-56819","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-93wv-jw9v-4972","description":"Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-56819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56819","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"3a71b2136cbaef6c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6jqx-86gh-f27w","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6jqx-86gh-f27w","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-11-02","epss":0.00665,"percentile":0.51798}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w","https://nvd.nist.gov/vuln/detail/CVE-2026-55831","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6jqx-86gh-f27w","description":"Netty SPDY SETTINGS frame count materializes unbounded settings map"},"relatedVulnerabilities":[{"id":"CVE-2026-55831","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-11-02","epss":0.00665,"percentile":0.51798}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55831","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"e6711addddd64a36","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6jqx-86gh-f27w","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6jqx-86gh-f27w","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-11-02","epss":0.00665,"percentile":0.51798}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w","https://nvd.nist.gov/vuln/detail/CVE-2026-55831","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6jqx-86gh-f27w","description":"Netty SPDY SETTINGS frame count materializes unbounded settings map"},"relatedVulnerabilities":[{"id":"CVE-2026-55831","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-11-02","epss":0.00665,"percentile":0.51798}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55831","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"e3d98c49743c8191","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6jqx-86gh-f27w","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6jqx-86gh-f27w","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-11-02","epss":0.00665,"percentile":0.51798}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w","https://nvd.nist.gov/vuln/detail/CVE-2026-55831","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6jqx-86gh-f27w","description":"Netty SPDY SETTINGS frame count materializes unbounded settings map"},"relatedVulnerabilities":[{"id":"CVE-2026-55831","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-11-02","epss":0.00665,"percentile":0.51798}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55831","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"d68e99b783ccdee5","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"c648f863b301e3fc62d0de098ec61be7628b8ea2","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/modules/transport-netty4/netty-codec-http-4.1.101.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6jqx-86gh-f27w","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6jqx-86gh-f27w","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-11-02","epss":0.00665,"percentile":0.51798}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w","https://nvd.nist.gov/vuln/detail/CVE-2026-55831","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6jqx-86gh-f27w","description":"Netty SPDY SETTINGS frame count materializes unbounded settings map"},"relatedVulnerabilities":[{"id":"CVE-2026-55831","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-11-02","epss":0.00665,"percentile":0.51798}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55831","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"2692d67b14b4b286","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.101.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.101.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.101.Final","type":"java-archive","version":"4.1.101.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"c648f863b301e3fc62d0de098ec61be7628b8ea2","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/netty-codec-http-4.1.101.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6jqx-86gh-f27w","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.101.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6jqx-86gh-f27w","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-11-02","epss":0.00665,"percentile":0.51798}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w","https://nvd.nist.gov/vuln/detail/CVE-2026-55831","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6jqx-86gh-f27w","description":"Netty SPDY SETTINGS frame count materializes unbounded settings map"},"relatedVulnerabilities":[{"id":"CVE-2026-55831","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-11-02","epss":0.00665,"percentile":0.51798}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55831","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"1b8f9af2644a7fd3","cpes":["cpe:2.3:a:apache:commons-compress:1.21:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_compress:1.21:*:*:*:*:*:*:*","cpe:2.3:a:apache:compress:1.21:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.21:*:*:*:*:*:*:*"],"name":"commons-compress","purl":"pkg:maven/org.apache.commons/commons-compress@1.21","type":"java-archive","version":"1.21","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/commons-compress-1.21.jar","manifestName":"","pomArtifactID":"commons-compress","archiveDigests":[{"value":"4ec95b60d4e86b5c95a0e919cb172a0af98011ef","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/commons-compress-1.21.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4265-ccf5-phj5","versionConstraint":">=1.21,<1.26.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-compress","version":"1.21"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4265-ccf5-phj5","fix":{"state":"fixed","versions":["1.26.0"],"available":[{"date":"2024-02-21","kind":"first-observed","version":"1.26.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":6.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-26308","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-26308","date":"2026-11-02","epss":0.00898,"percentile":0.59602}],"risk":0.49838999999999994,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-26308","https://lists.apache.org/thread/ch5yo2d21p7vlqrhll9b17otbyq4npfg","http://www.openwall.com/lists/oss-security/2024/02/19/2","https://security.netapp.com/advisory/ntap-20240307-0009"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4265-ccf5-phj5","description":"Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file"},"relatedVulnerabilities":[{"id":"CVE-2024-26308","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-26308","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-26308","date":"2026-11-02","epss":0.00898,"percentile":0.59602}],"urls":["http://www.openwall.com/lists/oss-security/2024/02/19/2","https://lists.apache.org/thread/ch5yo2d21p7vlqrhll9b17otbyq4npfg","https://security.netapp.com/advisory/ntap-20240307-0009/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-26308","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.\n\nUsers are recommended to upgrade to version 1.26, which fixes the issue."}]},{"artifact":{"id":"cf6d6b3dc3fa8331","cpes":["cpe:2.3:a:apache:commons-compress:1.24.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_compress:1.24.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:compress:1.24.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.24.0:*:*:*:*:*:*:*"],"name":"commons-compress","purl":"pkg:maven/org.apache.commons/commons-compress@1.24.0","type":"java-archive","version":"1.24.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/commons-compress-1.24.0.jar","manifestName":"","pomArtifactID":"commons-compress","archiveDigests":[{"value":"b4b1b5a3d9573b2970fddab236102c0a4d27d35e","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/commons-compress-1.24.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/commons-compress-1.24.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4265-ccf5-phj5","versionConstraint":">=1.21,<1.26.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-compress","version":"1.24.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4265-ccf5-phj5","fix":{"state":"fixed","versions":["1.26.0"],"available":[{"date":"2024-02-21","kind":"first-observed","version":"1.26.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":6.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-26308","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-26308","date":"2026-11-02","epss":0.00898,"percentile":0.59602}],"risk":0.49838999999999994,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-26308","https://lists.apache.org/thread/ch5yo2d21p7vlqrhll9b17otbyq4npfg","http://www.openwall.com/lists/oss-security/2024/02/19/2","https://security.netapp.com/advisory/ntap-20240307-0009"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4265-ccf5-phj5","description":"Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file"},"relatedVulnerabilities":[{"id":"CVE-2024-26308","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-26308","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-26308","date":"2026-11-02","epss":0.00898,"percentile":0.59602}],"urls":["http://www.openwall.com/lists/oss-security/2024/02/19/2","https://lists.apache.org/thread/ch5yo2d21p7vlqrhll9b17otbyq4npfg","https://security.netapp.com/advisory/ntap-20240307-0009/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-26308","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.\n\nUsers are recommended to upgrade to version 1.26, which fixes the issue."}]},{"artifact":{"id":"3a060baa137f74ea","cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@17.0.10%2B7?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk17u.git","type":"binary","version":"17.0.10+7","language":"","licenses":[],"metadata":{"release":{"fullVersion":"17.0.10+7","javaVersion":"17.0.10","semanticVersion":"17.0.10+7","javaRuntimeVersion":"17.0.10+7"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:8b8fefae6897ed4bfb12e519d4bdcaca9564779609395dcc3238ea1d369600aa","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"17.0.16"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-50059","versionConstraint":">= 12, < 17.0.16||>= 18, < 21.0.8||>= 22, < 24.0.2||>= 9, < 11.0.28 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"17.0.10+7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-50059","fix":{"state":"fixed","versions":["11.0.28","17.0.16","21.0.8","24.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"17.0.16"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.8"},{"date":"2025-09-04","kind":"first-observed","version":"24.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.28"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50059","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50059","date":"2026-11-02","epss":0.00615,"percentile":0.49489}],"risk":0.49507499999999993,"urls":["https://www.oracle.com/security-alerts/cpujul2025.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00014.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50059","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and  24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.106"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-23hv-mwm6-g8jf","versionConstraint":">=9.0.0.M1,<9.0.106 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-23hv-mwm6-g8jf","fix":{"state":"fixed","versions":["9.0.106"],"available":[{"date":"2026-07-01","kind":"first-observed","version":"9.0.106"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55668","cwe":"CWE-384","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-55668","date":"2026-11-02","epss":0.0086,"percentile":0.58523}],"risk":0.4945,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-55668","https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47","https://github.com/apache/tomcat/commit/8621e4c6ba2c916a41eb34cb0f781171ead33fb6","https://github.com/apache/tomcat/commit/90306d971bb8b8393336d893644124fb2ca11d21","https://github.com/apache/tomcat/commit/9c3673ba04009377cb0c81ccb6cf5078aec1aa95","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html","http://www.openwall.com/lists/oss-security/2025/08/13/3"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-23hv-mwm6-g8jf","description":"Apache Tomcat Session Fixation vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-55668","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55668","cwe":"CWE-384","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-55668","date":"2026-11-02","epss":0.0086,"percentile":0.58523}],"urls":["https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47","http://www.openwall.com/lists/oss-security/2025/08/13/3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55668","description":"Session Fixation vulnerability in Apache Tomcat via rewrite valve.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nOlder, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue."}]},{"artifact":{"id":"c1e86990bac3051c","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.75","type":"java-archive","version":"1.75","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"df22e1b6a9f6b218913f5b68dd16641344397fe0","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.78"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v435-xc8x-wvr9","versionConstraint":"<1.78 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.75"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-v435-xc8x-wvr9","fix":{"state":"fixed","versions":["1.78"],"available":[{"date":"2024-05-15","kind":"first-observed","version":"1.78"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-30171","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-30171","date":"2026-11-02","epss":0.00901,"percentile":0.59715}],"risk":0.4910450000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-30171","https://github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9030171","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9030171","https://www.bouncycastle.org/latest_releases.html","https://github.com/bcgit/bc-csharp/commit/c984b8bfd8544dfc55dba91a02cbbbb9c580c217","https://github.com/bcgit/bc-java/commit/d7d5e735abd64bf0f413f54fd9e495fc02400fb0","https://github.com/bcgit/bc-java/commit/e0569dcb1dea9d421d84fc4c5c5688fe101afa2d","https://security.netapp.com/advisory/ntap-20240614-0008"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v435-xc8x-wvr9","description":"Bouncy Castle affected by timing side-channel for RSA key exchange (\"The Marvin Attack\")"},"relatedVulnerabilities":[{"id":"CVE-2024-30171","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-30171","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-30171","date":"2026-11-02","epss":0.00901,"percentile":0.59715}],"urls":["https://github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9030171","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9030171","https://security.netapp.com/advisory/ntap-20240614-0008/","https://www.bouncycastle.org/latest_releases.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-30171","description":"An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing."}]},{"artifact":{"id":"c7466d586d7cf1bd","cpes":["cpe:2.3:a:python3-jinja2:python3-jinja2:3.0.3-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:python3-jinja2:python3_jinja2:3.0.3-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_jinja2:python3-jinja2:3.0.3-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_jinja2:python3_jinja2:3.0.3-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-jinja2:3.0.3-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_jinja2:3.0.3-1ubuntu0.1:*:*:*:*:*:*:*"],"name":"python3-jinja2","purl":"pkg:deb/ubuntu/python3-jinja2@3.0.3-1ubuntu0.1?arch=all&distro=ubuntu-22.04&upstream=jinja2","type":"deb","version":"3.0.3-1ubuntu0.1","language":"","licenses":["BSD-3-Clause","GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3-jinja2/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3-jinja2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3-jinja2.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3-jinja2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3-jinja2.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3-jinja2.list"},{"path":"/var/lib/dpkg/info/python3-jinja2.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3-jinja2.postinst"},{"path":"/var/lib/dpkg/info/python3-jinja2.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3-jinja2.prerm"}],"upstreams":[{"name":"jinja2"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.3-1ubuntu0.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-34064","versionConstraint":"< 3.0.3-1ubuntu0.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"jinja2","version":"3.0.3-1ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-34064","fix":{"state":"fixed","versions":["3.0.3-1ubuntu0.2"],"available":[{"date":"2024-05-28","kind":"advisory","version":"3.0.3-1ubuntu0.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-34064","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-34064","date":"2026-11-02","epss":0.00979,"percentile":0.62189}],"risk":0.4895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-34064"},"relatedVulnerabilities":[{"id":"CVE-2024-34064","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-34064","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-34064","date":"2026-11-02","epss":0.00979,"percentile":0.62189}],"urls":["https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb","https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/567XIGSZMABG6TSMYWD7MIYNJSUQQRUC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCLF44KY43BSVMTE6S53B4V5WP3FRRSE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS/","https://lists.debian.org/debian-lts-announce/2024/12/msg00009.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-34064","description":"Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This vulnerability is fixed in 3.1.4."}]},{"artifact":{"id":"3a060baa137f74ea","cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@17.0.10%2B7?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk17u.git","type":"binary","version":"17.0.10+7","language":"","licenses":[],"metadata":{"release":{"fullVersion":"17.0.10+7","javaVersion":"17.0.10","semanticVersion":"17.0.10+7","javaRuntimeVersion":"17.0.10+7"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:8b8fefae6897ed4bfb12e519d4bdcaca9564779609395dcc3238ea1d369600aa","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"17.0.14"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-21502","versionConstraint":"< 1.8.0_441||>= 1.9, < 8.0.441||>= 12, < 17.0.14||>= 18, < 21.0.6||>= 22, < 23.0.2||>= 9, < 11.0.26 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"17.0.10+7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-21502","fix":{"state":"fixed","versions":["1.8.0_441","8.0.441","11.0.26","17.0.14","21.0.6","23.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_441"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.441"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.14"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.6"},{"date":"2025-09-04","kind":"first-observed","version":"23.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.26"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-21502","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-21502","date":"2026-11-02","epss":0.00986,"percentile":0.624}],"risk":0.48314000000000007,"urls":["https://www.oracle.com/security-alerts/cpujan2025.html","http://www.openwall.com/lists/oss-security/2025/01/25/6","https://lists.debian.org/debian-lts-announce/2025/01/msg00031.html","https://lists.debian.org/debian-lts-announce/2025/02/msg00004.html","https://security.netapp.com/advisory/ntap-20250124-0009/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-21502","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM for JDK: 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM Enterprise Edition: 20.3.16 and  21.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"4f2f779127e466d8","cpes":["cpe:2.3:a:org.eclipse.jetty:jetty-http:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_http:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty-http:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty_http:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty-http:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty_http:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-http:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_http:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-http:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_http:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.53.v20231009:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:9.4.53.v20231009:*:*:*:*:*:*:*"],"name":"jetty-http","purl":"pkg:maven/org.eclipse.jetty/jetty-http@9.4.53.v20231009","type":"java-archive","version":"9.4.53.v20231009","language":"java","licenses":[],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/signalfx-java-1.0.36.jar:org.eclipse.jetty:jetty-http","manifestName":"","pomArtifactID":"jetty-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/signalfx-java-1.0.36.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"12.0.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qh8g-58pp-2wxh","versionConstraint":">=7.0.0,<=12.0.11 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-http","version":"9.4.53.v20231009"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qh8g-58pp-2wxh","fix":{"state":"fixed","versions":["12.0.12"],"available":[{"date":"2024-10-15","kind":"first-observed","version":"12.0.12"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6763","cwe":"CWE-1286","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2024-6763","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6763","date":"2026-11-02","epss":0.00965,"percentile":0.61703}],"risk":0.48250000000000004,"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh","https://nvd.nist.gov/vuln/detail/CVE-2024-6763","https://github.com/jetty/jetty.project/pull/12012","https://gitlab.eclipse.org/security/cve-assignement/-/issues/25","https://security.netapp.com/advisory/ntap-20250306-0005"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qh8g-58pp-2wxh","description":"Eclipse Jetty URI parsing of invalid authority"},"relatedVulnerabilities":[{"id":"CVE-2024-6763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"emo@eclipse.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6763","cwe":"CWE-1286","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2024-6763","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6763","date":"2026-11-02","epss":0.00965,"percentile":0.61703}],"urls":["https://github.com/jetty/jetty.project/pull/12012","https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh","https://gitlab.eclipse.org/security/cve-assignement/-/issues/25","https://security.netapp.com/advisory/ntap-20250306-0005/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6763","description":"Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.\n\nThe HttpURI class does insufficient validation on the authority segment of a URI.  However the behaviour of HttpURI\n differs from the common browsers in how it handles a URI that would be \nconsidered invalid if fully validated against the RRC.  Specifically HttpURI\n and the browser may differ on the value of the host extracted from an \ninvalid URI and thus a combination of Jetty and a vulnerable browser may\n be vulnerable to a open redirect attack or to a SSRF attack if the URI \nis used after passing validation checks."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.118"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fv25-8xcx-gqjc","versionConstraint":"<9.0.118 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fv25-8xcx-gqjc","fix":{"state":"fixed","versions":["9.0.118"],"available":[{"date":"2026-05-19","kind":"first-observed","version":"9.0.118"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42498","cwe":"CWE-200","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-42498","date":"2026-11-02","epss":0.00646,"percentile":0.50945}],"risk":0.47803999999999996,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-42498","https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb","http://www.openwall.com/lists/oss-security/2026/05/12/14","https://github.com/apache/tomcat/commit/169d725788ea6aec217ecac70fe4161c837ba423","https://github.com/apache/tomcat/commit/6cbe274592ef2d11607b5b188e1df649de52f8d5","https://github.com/apache/tomcat/commit/b7b173694d588ddcfa432f079baf763cbbbaa5c4","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fv25-8xcx-gqjc","description":"Apache Tomcat - WebSocket authentication header exposure"},"relatedVulnerabilities":[{"id":"CVE-2026-42498","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42498","cwe":"CWE-200","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-42498","date":"2026-11-02","epss":0.00646,"percentile":0.50945}],"urls":["https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb","http://www.openwall.com/lists/oss-security/2026/05/12/14"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42498","description":"Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue."}]},{"artifact":{"id":"c76e629c8d688bb1","cpes":["cpe:2.3:a:libzstd1:libzstd1:1.4.8\\+dfsg-3build1:*:*:*:*:*:*:*"],"name":"libzstd1","purl":"pkg:deb/ubuntu/libzstd1@1.4.8%2Bdfsg-3build1?arch=amd64&distro=ubuntu-22.04&upstream=libzstd","type":"deb","version":"1.4.8+dfsg-3build1","language":"","licenses":["BSD-3-clause","Expat","GPL-2","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzstd1/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libzstd1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzstd1:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libzstd1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libzstd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-4899","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libzstd","version":"1.4.8+dfsg-3build1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-4899","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4899","date":"2026-11-02","epss":0.01588,"percentile":0.75629}],"risk":0.47639999999999993,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-4899"},"relatedVulnerabilities":[{"id":"CVE-2022-4899","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4899","date":"2026-11-02","epss":0.01588,"percentile":0.75629}],"urls":["https://github.com/facebook/zstd/issues/3200","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C63HAGVLQA6FJNDCHR7CNZZL6VSLILB2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEHRBBYYTPA4DETOM5XAKGCP37NUTLOA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QYLDK6ODVC4LJSDULLX6Q2YHTFOWABCN/","https://security.netapp.com/advisory/ntap-20230725-0005/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4899","description":"A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun."}]},{"artifact":{"id":"3a060baa137f74ea","cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@17.0.10%2B7?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk17u.git","type":"binary","version":"17.0.10+7","language":"","licenses":[],"metadata":{"release":{"fullVersion":"17.0.10+7","javaVersion":"17.0.10","semanticVersion":"17.0.10+7","javaRuntimeVersion":"17.0.10+7"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:8b8fefae6897ed4bfb12e519d4bdcaca9564779609395dcc3238ea1d369600aa","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"17.0.19"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-34282","versionConstraint":"< 1.8.0_492||>= 1.9, < 8.0.492||>= 12, < 17.0.19||>= 18, < 21.0.11||>= 22, < 25.0.3||>= 26, < 26.0.1||>= 9, < 11.0.31 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"17.0.10+7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-34282","fix":{"state":"fixed","versions":["1.8.0_492","8.0.492","11.0.31","17.0.19","21.0.11","25.0.3","26.0.1"],"available":[{"date":"2026-04-24","kind":"first-observed","version":"1.8.0_492"},{"date":"2026-04-24","kind":"first-observed","version":"8.0.492"},{"date":"2026-04-24","kind":"first-observed","version":"17.0.19"},{"date":"2026-04-24","kind":"first-observed","version":"21.0.11"},{"date":"2026-04-24","kind":"first-observed","version":"25.0.3"},{"date":"2026-04-24","kind":"first-observed","version":"26.0.1"},{"date":"2026-04-24","kind":"first-observed","version":"11.0.31"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34282","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-34282","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-34282","date":"2026-11-02","epss":0.00635,"percentile":0.50447}],"risk":0.47624999999999995,"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html","https://access.redhat.com/errata/RHSA-2026:11403","https://access.redhat.com/errata/RHSA-2026:11655","https://access.redhat.com/errata/RHSA-2026:11822","https://access.redhat.com/errata/RHSA-2026:11829","https://access.redhat.com/errata/RHSA-2026:11902","https://access.redhat.com/errata/RHSA-2026:22328","https://access.redhat.com/errata/RHSA-2026:9254","https://access.redhat.com/errata/RHSA-2026:9686","https://access.redhat.com/errata/RHSA-2026:9687","https://access.redhat.com/errata/RHSA-2026:9688","https://access.redhat.com/errata/RHSA-2026:9689","https://access.redhat.com/errata/RHSA-2026:9691","https://access.redhat.com/errata/RHSA-2026:9693","https://access.redhat.com/errata/RHSA-2026:9694","https://access.redhat.com/security/cve/CVE-2026-34282","https://bugzilla.redhat.com/show_bug.cgi?id=2460044","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34282.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34282","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and  21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."},"relatedVulnerabilities":[]},{"artifact":{"id":"37fd3bd4a6a92bd0","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.8.0:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/org.lz4/lz4-java@1.8.0","type":"java-archive","version":"1.8.0","language":"java","licenses":[],"metadata":{"pomGroupID":"org.lz4","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/lz4-java-1.8.0.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"4b986a99445e49ea5fbf5d149c4b63f6ed6c6780","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/lz4-java-1.8.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/lz4-java-1.8.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cmp6-m4wj-q63q","versionConstraint":"<=1.8.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.lz4:lz4-java","version":"1.8.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cmp6-m4wj-q63q","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66566","cwe":"CWE-201","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66566","date":"2026-11-02","epss":0.00605,"percentile":0.48965}],"risk":0.47492499999999993,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-cmp6-m4wj-q63q","https://nvd.nist.gov/vuln/detail/CVE-2025-66566","https://github.com/yawkat/lz4-java/commit/33d180cb70c4d93c80fb0dc3ab3002f457e93840"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cmp6-m4wj-q63q","description":"yawkat LZ4 Java has a possible information leak in Java safe decompressor"},"relatedVulnerabilities":[{"id":"CVE-2025-66566","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66566","cwe":"CWE-201","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66566","date":"2026-11-02","epss":0.00605,"percentile":0.48965}],"urls":["https://github.com/yawkat/lz4-java/commit/33d180cb70c4d93c80fb0dc3ab3002f457e93840","https://github.com/yawkat/lz4-java/security/advisories/GHSA-cmp6-m4wj-q63q"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66566","description":"yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data. JNI-based implementations are not affected. This vulnerability is fixed in 1.10.1."}]},{"artifact":{"id":"b1e71af63e16186c","cpes":["cpe:2.3:a:org.hibernate.validator.hibernate-validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:org.hibernate.validator.hibernate-validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:org.hibernate.validator.hibernate-validator:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:org.hibernate.validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:org.hibernate.validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate-validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate-validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate_validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate_validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:org.hibernate.validator:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate-validator:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate_validator:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:validator:validator:6.0.23.Final:*:*:*:*:*:*:*"],"name":"hibernate-validator","purl":"pkg:maven/org.hibernate.validator/hibernate-validator@6.0.23.Final","type":"java-archive","version":"6.0.23.Final","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.hibernate.validator","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hibernate-validator-6.0.23.Final.jar","manifestName":"","pomArtifactID":"hibernate-validator","archiveDigests":[{"value":"16c36fcd283bf3f774e09a2d525194f29219f758","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hibernate-validator-6.0.23.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hibernate-validator-6.0.23.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.2.0.CR1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7v6m-28jr-rg84","versionConstraint":"<6.2.0.CR1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.hibernate.validator:hibernate-validator","version":"6.0.23.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7v6m-28jr-rg84","fix":{"state":"fixed","versions":["6.2.0.CR1"],"available":[{"date":"2025-06-05","kind":"first-observed","version":"6.2.0.CR1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-35036","cwe":"CWE-94","type":"Secondary","source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"epss":[{"cve":"CVE-2025-35036","date":"2026-11-02","epss":0.00781,"percentile":0.55957}],"risk":0.47250499999999995,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-35036","https://github.com/hibernate/hibernate-validator/pull/1138","https://github.com/hibernate/hibernate-validator/commit/05f795bb7cf18856004f40e5042709e550ed0d6e","https://github.com/hibernate/hibernate-validator/commit/254858d9dcc4e7cd775d1b0f47f482218077c5e1","https://github.com/hibernate/hibernate-validator/commit/d2db40b9e7d22c7a0b44d7665242dfc7b4d14d78","https://github.com/hibernate/hibernate-validator/commit/e076293b0ee1bfa97b6e67d05ad9eee1ad77e893","https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#section-hibernateconstraintvalidatorcontext","https://github.com/hibernate/hibernate-validator/compare/6.1.7.Final...6.2.0.Final","https://hibernate.atlassian.net/browse/HV-1816","https://hibernate.org/validator/documentation/migration-guide/#6-2-0-cr1","https://in.relation.to/2021/01/06/hibernate-validator-700-62-final-released/#expression-language","https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428","https://www.cve.org/CVERecord?id=CVE-2020-5245","https://www.cve.org/CVERecord?id=CVE-2025-4428"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7v6m-28jr-rg84","description":"Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language"},"relatedVulnerabilities":[{"id":"CVE-2025-35036","cvss":[{"type":"Secondary","source":"9119a7d8-5eab-497f-8521-727c672e3725","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"9119a7d8-5eab-497f-8521-727c672e3725","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-35036","cwe":"CWE-94","type":"Secondary","source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"epss":[{"cve":"CVE-2025-35036","date":"2026-11-02","epss":0.00781,"percentile":0.55957}],"urls":["https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#section-hibernateconstraintvalidatorcontext","https://github.com/hibernate/hibernate-validator/commit/05f795bb7cf18856004f40e5042709e550ed0d6e","https://github.com/hibernate/hibernate-validator/commit/254858d9dcc4e7cd775d1b0f47f482218077c5e1","https://github.com/hibernate/hibernate-validator/commit/d2db40b9e7d22c7a0b44d7665242dfc7b4d14d78","https://github.com/hibernate/hibernate-validator/commit/e076293b0ee1bfa97b6e67d05ad9eee1ad77e893","https://github.com/hibernate/hibernate-validator/compare/6.1.7.Final...6.2.0.Final","https://github.com/hibernate/hibernate-validator/pull/1138","https://hibernate.atlassian.net/browse/HV-1816","https://hibernate.org/validator/documentation/migration-guide/#6-2-0-cr1","https://in.relation.to/2021/01/06/hibernate-validator-700-62-final-released/#expression-language","https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/","https://www.cve.org/CVERecord?id=CVE-2020-5245","https://www.cve.org/CVERecord?id=CVE-2025-4428"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-35036","description":"Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data."}]},{"artifact":{"id":"b5450f20753746a3","cpes":["cpe:2.3:a:org.hibernate.validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:org.hibernate.validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate-validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate-validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate_validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate_validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:org.hibernate.validator:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate-validator:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate_validator:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:validator:validator:6.0.23.Final:*:*:*:*:*:*:*"],"name":"hibernate-validator","purl":"pkg:maven/org.hibernate.validator/hibernate-validator@6.0.23.Final","type":"java-archive","version":"6.0.23.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"org.hibernate.validator","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-rest-module-7.2.0.jar:org.hibernate.validator:hibernate-validator","manifestName":"","pomArtifactID":"hibernate-validator","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-rest-module-7.2.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-rest-module-7.2.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.2.0.CR1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7v6m-28jr-rg84","versionConstraint":"<6.2.0.CR1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.hibernate.validator:hibernate-validator","version":"6.0.23.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7v6m-28jr-rg84","fix":{"state":"fixed","versions":["6.2.0.CR1"],"available":[{"date":"2025-06-05","kind":"first-observed","version":"6.2.0.CR1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-35036","cwe":"CWE-94","type":"Secondary","source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"epss":[{"cve":"CVE-2025-35036","date":"2026-11-02","epss":0.00781,"percentile":0.55957}],"risk":0.47250499999999995,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-35036","https://github.com/hibernate/hibernate-validator/pull/1138","https://github.com/hibernate/hibernate-validator/commit/05f795bb7cf18856004f40e5042709e550ed0d6e","https://github.com/hibernate/hibernate-validator/commit/254858d9dcc4e7cd775d1b0f47f482218077c5e1","https://github.com/hibernate/hibernate-validator/commit/d2db40b9e7d22c7a0b44d7665242dfc7b4d14d78","https://github.com/hibernate/hibernate-validator/commit/e076293b0ee1bfa97b6e67d05ad9eee1ad77e893","https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#section-hibernateconstraintvalidatorcontext","https://github.com/hibernate/hibernate-validator/compare/6.1.7.Final...6.2.0.Final","https://hibernate.atlassian.net/browse/HV-1816","https://hibernate.org/validator/documentation/migration-guide/#6-2-0-cr1","https://in.relation.to/2021/01/06/hibernate-validator-700-62-final-released/#expression-language","https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428","https://www.cve.org/CVERecord?id=CVE-2020-5245","https://www.cve.org/CVERecord?id=CVE-2025-4428"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7v6m-28jr-rg84","description":"Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language"},"relatedVulnerabilities":[{"id":"CVE-2025-35036","cvss":[{"type":"Secondary","source":"9119a7d8-5eab-497f-8521-727c672e3725","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"9119a7d8-5eab-497f-8521-727c672e3725","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-35036","cwe":"CWE-94","type":"Secondary","source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"epss":[{"cve":"CVE-2025-35036","date":"2026-11-02","epss":0.00781,"percentile":0.55957}],"urls":["https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#section-hibernateconstraintvalidatorcontext","https://github.com/hibernate/hibernate-validator/commit/05f795bb7cf18856004f40e5042709e550ed0d6e","https://github.com/hibernate/hibernate-validator/commit/254858d9dcc4e7cd775d1b0f47f482218077c5e1","https://github.com/hibernate/hibernate-validator/commit/d2db40b9e7d22c7a0b44d7665242dfc7b4d14d78","https://github.com/hibernate/hibernate-validator/commit/e076293b0ee1bfa97b6e67d05ad9eee1ad77e893","https://github.com/hibernate/hibernate-validator/compare/6.1.7.Final...6.2.0.Final","https://github.com/hibernate/hibernate-validator/pull/1138","https://hibernate.atlassian.net/browse/HV-1816","https://hibernate.org/validator/documentation/migration-guide/#6-2-0-cr1","https://in.relation.to/2021/01/06/hibernate-validator-700-62-final-released/#expression-language","https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/","https://www.cve.org/CVERecord?id=CVE-2020-5245","https://www.cve.org/CVERecord?id=CVE-2025-4428"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-35036","description":"Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data."}]},{"artifact":{"id":"4d0c3abee3ce4445","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-remote-event-common-plugin-7.0.1.jar:META-INF/lib/jackson-databind-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"01e71fddbc80bb86f71a6345ac1e8ab8a00e7134","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-remote-event-common-plugin-7.0.1.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-remote-event-common-plugin-7.0.1.jar:META-INF/lib/jackson-databind-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"abf07cd44e688c5e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/opensearch/lib/tools/upgrade-cli/jackson-databind-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"01e71fddbc80bb86f71a6345ac1e8ab8a00e7134","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/lib/tools/upgrade-cli/jackson-databind-2.14.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/lib/tools/upgrade-cli/jackson-databind-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"96e49eed88feacc3","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/opensearch/modules/ingest-geoip/jackson-databind-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"01e71fddbc80bb86f71a6345ac1e8ab8a00e7134","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/modules/ingest-geoip/jackson-databind-2.14.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/modules/ingest-geoip/jackson-databind-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"148d0e1e06039376","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/jackson-databind-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"01e71fddbc80bb86f71a6345ac1e8ab8a00e7134","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/jackson-databind-2.14.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/jackson-databind-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"67df6d98175155b6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/signalfx-java-1.0.36.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/signalfx-java-1.0.36.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"90999fe659e21a85","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-plugin-2.4.3.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-plugin-2.4.3.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-plugin-2.4.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"6c1f803e9e3094a1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/applinks-plugin-9.2.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/applinks-plugin-9.2.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/applinks-plugin-9.2.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"17a6603b2c8c52c8","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/jackson-databind-2.15.3.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"a734bc2c47a9453c4efa772461a3aeb273c010d9","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/jackson-databind-2.15.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"7fb7ae836158dda2","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1","type":"java-archive","version":"2.16.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/jackson-databind-2.16.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"02a16efeb840c45af1e2f31753dfe76795278b73","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/jackson-databind-2.16.1.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/jackson-databind-2.16.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"2655c2da825d89d6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1","type":"java-archive","version":"2.16.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-search-8.18.0.jar:META-INF/lib/jackson-databind-2.16.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"02a16efeb840c45af1e2f31753dfe76795278b73","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-search-8.18.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-search-8.18.0.jar:META-INF/lib/jackson-databind-2.16.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"3a060baa137f74ea","cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@17.0.10%2B7?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk17u.git","type":"binary","version":"17.0.10+7","language":"","licenses":[],"metadata":{"release":{"fullVersion":"17.0.10+7","javaVersion":"17.0.10","semanticVersion":"17.0.10+7","javaRuntimeVersion":"17.0.10+7"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:8b8fefae6897ed4bfb12e519d4bdcaca9564779609395dcc3238ea1d369600aa","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"17.0.12"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-21140","versionConstraint":"< 1.8.0_422||>= 1.9, < 8.0.422||>= 12, < 17.0.12||>= 18, < 21.0.4||>= 22, < 22.0.2||>= 9, < 11.0.24 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"17.0.10+7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-21140","fix":{"state":"fixed","versions":["1.8.0_422","8.0.422","11.0.24","17.0.12","21.0.4","22.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_422"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.422"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.12"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.4"},{"date":"2025-09-04","kind":"first-observed","version":"22.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.24"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21140","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-21140","date":"2026-11-02","epss":0.0094,"percentile":0.60947}],"risk":0.4606,"urls":["https://security.netapp.com/advisory/ntap-20240719-0008/","https://www.oracle.com/security-alerts/cpujul2024.html","https://openjdk.org/groups/vulnerability/advisories/2024-07-16"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21140","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"3a060baa137f74ea","cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@17.0.10%2B7?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk17u.git","type":"binary","version":"17.0.10+7","language":"","licenses":[],"metadata":{"release":{"fullVersion":"17.0.10+7","javaVersion":"17.0.10","semanticVersion":"17.0.10+7","javaRuntimeVersion":"17.0.10+7"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:8b8fefae6897ed4bfb12e519d4bdcaca9564779609395dcc3238ea1d369600aa","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"17.0.11"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-21011","versionConstraint":"< 1.8.0_412||>= 1.9, < 8.0.412||>= 12, < 17.0.11||>= 18, < 21.0.3||>= 22, < 22.0.1||>= 9, < 11.0.23 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"17.0.10+7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-21011","fix":{"state":"fixed","versions":["1.8.0_412","8.0.412","11.0.23","17.0.11","21.0.3","22.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_412"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.412"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.11"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.3"},{"date":"2025-09-04","kind":"first-observed","version":"22.0.1"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.23"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21011","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-21011","date":"2026-11-02","epss":0.01372,"percentile":0.71959}],"risk":0.4596199999999999,"urls":["https://lists.debian.org/debian-lts-announce/2024/04/msg00014.html","https://security.netapp.com/advisory/ntap-20240426-0004/","https://www.oracle.com/security-alerts/cpuapr2024.html","https://openjdk.org/groups/vulnerability/advisories/2024-04-16"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21011","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22;   Oracle GraalVM Enterprise Edition: 20.3.13 and  21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"0fc5ab4c86eb7ea7","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/ubuntu/libssl-dev@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.29"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63072","versionConstraint":"< 3.0.2-0ubuntu1.29 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-63072","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.29"],"available":[{"date":"2026-08-25","kind":"advisory","version":"3.0.2-0ubuntu1.29"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-11-02","epss":0.00916,"percentile":0.60196}],"risk":0.45799999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63072"},"relatedVulnerabilities":[{"id":"CVE-2026-63072","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-11-02","epss":0.00916,"percentile":0.60196}],"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"080c8716011e8bcc","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.29"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63072","versionConstraint":"< 3.0.2-0ubuntu1.29 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-63072","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.29"],"available":[{"date":"2026-08-25","kind":"advisory","version":"3.0.2-0ubuntu1.29"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-11-02","epss":0.00916,"percentile":0.60196}],"risk":0.45799999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63072"},"relatedVulnerabilities":[{"id":"CVE-2026-63072","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-11-02","epss":0.00916,"percentile":0.60196}],"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"e6933be022de0634","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.14:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.14?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.14","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.29"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63072","versionConstraint":"< 3.0.2-0ubuntu1.29 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.14"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-63072","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.29"],"available":[{"date":"2026-08-25","kind":"advisory","version":"3.0.2-0ubuntu1.29"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-11-02","epss":0.00916,"percentile":0.60196}],"risk":0.45799999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63072"},"relatedVulnerabilities":[{"id":"CVE-2026-63072","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-11-02","epss":0.00916,"percentile":0.60196}],"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"3a060baa137f74ea","cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@17.0.10%2B7?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk17u.git","type":"binary","version":"17.0.10+7","language":"","licenses":[],"metadata":{"release":{"fullVersion":"17.0.10+7","javaVersion":"17.0.10","semanticVersion":"17.0.10+7","javaRuntimeVersion":"17.0.10+7"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:8b8fefae6897ed4bfb12e519d4bdcaca9564779609395dcc3238ea1d369600aa","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"17.0.13"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-21235","versionConstraint":"< 1.8.0_432||>= 1.9, < 8.0.432||>= 12, < 17.0.13||>= 18, < 21.0.5||>= 22, < 23.0.1||>= 9, < 11.0.25 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"17.0.10+7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-21235","fix":{"state":"fixed","versions":["1.8.0_432","8.0.432","11.0.25","17.0.13","21.0.5","23.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_432"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.432"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.13"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.5"},{"date":"2025-09-04","kind":"first-observed","version":"23.0.1"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.25"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21235","date":"2026-11-02","epss":0.00929,"percentile":0.60587}],"risk":0.45521,"urls":["https://www.oracle.com/security-alerts/cpuoct2024.html","https://lists.debian.org/debian-lts-announce/2024/10/msg00018.html","https://lists.debian.org/debian-lts-announce/2024/10/msg00020.html","https://openjdk.org/groups/vulnerability/advisories/2024-10-15"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21235","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23;   Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23;   Oracle GraalVM Enterprise Edition: 20.3.15 and  21.3.11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"e7bc2f8da2f20189","cpes":["cpe:2.3:a:org.springframework.security:spring-security-crypto:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_crypto:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-crypto:spring-security-crypto:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-crypto:spring_security_crypto:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_crypto:spring-security-crypto:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_crypto:spring_security_crypto:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-crypto:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_crypto:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-crypto:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_crypto:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-crypto:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_crypto:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-crypto:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_crypto:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-crypto:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_crypto:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-crypto:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_crypto:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:security:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:5.8.9:*:*:*:*:*:*:*"],"name":"spring-security-crypto","purl":"pkg:maven/org.springframework.security/spring-security-crypto@5.8.9","type":"java-archive","version":"5.8.9","language":"java","licenses":[],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-security-crypto-5.8.9.jar","manifestName":"","pomArtifactID":"spring-security-crypto","archiveDigests":[{"value":"62aa602e4f5ca8f9032ce8288a45d5b4010bb756","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-security-crypto-5.8.9.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-security-crypto-5.8.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.8.18"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mg83-c7gq-rv5c","versionConstraint":">=5.8.0,<=5.8.17 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-crypto","version":"5.8.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mg83-c7gq-rv5c","fix":{"state":"fixed","versions":["5.8.18"],"available":[{"date":"2025-03-21","kind":"first-observed","version":"5.8.18"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22228","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22228","date":"2026-11-02","epss":0.0061,"percentile":0.49214}],"risk":0.45445,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-22228","https://spring.io/security/cve-2025-22228","https://github.com/spring-projects/spring-security/commit/46f0dc6dfc8402cd556c598fdf2d31f9d46cdbf3","https://security.netapp.com/advisory/ntap-20250425-0009"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mg83-c7gq-rv5c","description":"Spring Security Does Not Enforce Password Length"},"relatedVulnerabilities":[{"id":"CVE-2025-22228","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22228","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22228","date":"2026-11-02","epss":0.0061,"percentile":0.49214}],"urls":["https://spring.io/security/cve-2025-22228","https://security.netapp.com/advisory/ntap-20250425-0009/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22228","description":"BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same."}]},{"artifact":{"id":"842dbc9fb51686ce","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.4:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.4?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.4","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-32990","versionConstraint":"< 3.7.3-4ubuntu1.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.4"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-32990","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.7"],"available":[{"date":"2025-07-14","kind":"advisory","version":"3.7.3-4ubuntu1.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-32990","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32990","date":"2026-11-02","epss":0.00896,"percentile":0.59553}],"risk":0.44799999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-32990"},"relatedVulnerabilities":[{"id":"CVE-2025-32990","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-32990","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32990","date":"2026-11-02","epss":0.00896,"percentile":0.59553}],"urls":["https://access.redhat.com/errata/RHSA-2025:16115","https://access.redhat.com/errata/RHSA-2025:16116","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:17348","https://access.redhat.com/errata/RHSA-2025:17361","https://access.redhat.com/errata/RHSA-2025:17415","https://access.redhat.com/errata/RHSA-2025:19088","https://access.redhat.com/errata/RHSA-2025:22529","https://access.redhat.com/errata/RHSA-2026:7477","https://access.redhat.com/security/cve/CVE-2025-32990","https://bugzilla.redhat.com/show_bug.cgi?id=2359620","https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html","http://www.openwall.com/lists/oss-security/2025/07/11/3","https://lists.debian.org/debian-lts-announce/2025/08/msg00005.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-32990","description":"A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system."}]},{"artifact":{"id":"1a5a42fb71782e42","cpes":["cpe:2.3:a:org.springframework.security:spring-security-web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:spring-security-web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:spring_security_web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:spring-security-web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:spring_security_web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_web:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:security:security:5.8.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:5.8.9:*:*:*:*:*:*:*"],"name":"spring-security-web","purl":"pkg:maven/org.springframework.security/spring-security-web@5.8.9","type":"java-archive","version":"5.8.9","language":"java","licenses":[],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-security-web-5.8.9.jar","manifestName":"","pomArtifactID":"spring-security-web","archiveDigests":[{"value":"241ebc4e7e14c56550ca58694d572fe11e103f59","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-security-web-5.8.9.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-security-web-5.8.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mf92-479x-3373","versionConstraint":">=5.8.0,<=5.8.16 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-web","version":"5.8.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mf92-479x-3373","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22732","cwe":"CWE-425","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-22732","date":"2026-11-02","epss":0.00489,"percentile":0.42111}],"risk":0.442545,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-22732","https://spring.io/security/cve-2026-22732"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mf92-479x-3373","description":"Spring Security HTTP Headers Are not Written Under Some Conditions"},"relatedVulnerabilities":[{"id":"CVE-2026-22732","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22732","cwe":"CWE-425","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-22732","date":"2026-11-02","epss":0.00489,"percentile":0.42111}],"urls":["https://spring.io/security/cve-2026-22732"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22732","description":"When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. \nThis issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers:\n\n: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3."}]},{"artifact":{"id":"7bccd4346e7df4e4","cpes":["cpe:2.3:a:org.springframework:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring_web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring_web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-web:5.3.31:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_web:5.3.31:*:*:*:*:*:*:*"],"name":"spring-web","purl":"pkg:maven/org.springframework/spring-web@5.3.31","type":"java-archive","version":"5.3.31","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-web-5.3.31.jar","manifestName":"","pomArtifactID":"spring-web","archiveDigests":[{"value":"3bf73c385a1f2f4a0d482149d6a205e854cec497","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-web-5.3.31.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/spring-web-5.3.31.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.3.38"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2rmj-mq67-h97g","versionConstraint":"<5.3.38 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-web","version":"5.3.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-2rmj-mq67-h97g","fix":{"state":"fixed","versions":["5.3.38"],"available":[{"date":"2024-09-25","kind":"first-observed","version":"5.3.38"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38809","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-38809","date":"2026-11-02","epss":0.00852,"percentile":0.58253}],"risk":0.43878,"urls":["https://github.com/spring-projects/spring-framework/issues/33372","https://github.com/spring-projects/spring-framework/commit/582bfccbb72e5c8959a0b472d1dc7d03a20520f3","https://github.com/spring-projects/spring-framework/commit/8d16a50907c11f7e6b407d878a26e84eba08a533","https://github.com/spring-projects/spring-framework/commit/bb17ad8314b81850a939fd265fb53b3361705e85","https://spring.io/security/cve-2024-38809","https://nvd.nist.gov/vuln/detail/CVE-2024-38809"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2rmj-mq67-h97g","description":"Spring Framework DoS via conditional HTTP request"},"relatedVulnerabilities":[{"id":"CVE-2024-38809","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38809","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-38809","date":"2026-11-02","epss":0.00852,"percentile":0.58253}],"urls":["https://spring.io/security/cve-2024-38809","https://security.netapp.com/advisory/ntap-20240920-0003/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-38809","description":"Applications that parse ETags from \"If-Match\" or \"If-None-Match\" request headers are vulnerable to DoS attack.\n\nUsers of affected versions should upgrade to the corresponding fixed version.\n\nUsers of older, unsupported versions could enforce a size limit on \"If-Match\" and \"If-None-Match\" headers, e.g. through a Filter."}]},{"artifact":{"id":"c3fa74972d5ed94c","cpes":["cpe:2.3:a:net.minidev.json-smart:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:net.minidev.json-smart:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:net.minidev:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:net.minidev:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json-smart:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json-smart:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json_smart:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json_smart:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:minidev:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:minidev:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json:json_smart:2.5.0:*:*:*:*:*:*:*"],"name":"json-smart","purl":"pkg:maven/net.minidev/json-smart@2.5.0","type":"java-archive","version":"2.5.0","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"net.minidev","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar:META-INF/lib/json-smart-2.5.0.jar","manifestName":"","pomArtifactID":"json-smart","archiveDigests":[{"value":"57a64f421b472849c40e77d2e7cce3a141b41e99","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar:META-INF/lib/json-smart-2.5.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.5.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pq2g-wx69-c263","versionConstraint":">=2.5.0,<2.5.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"net.minidev:json-smart","version":"2.5.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pq2g-wx69-c263","fix":{"state":"fixed","versions":["2.5.2"],"available":[{"date":"2025-02-13","kind":"first-observed","version":"2.5.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-57699","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-57699","date":"2026-11-02","epss":0.00582,"percentile":0.47827}],"risk":0.4365,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-57699","https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699","https://nvd.nist.gov/vuln/detail/cve-2023-1370","https://github.com/netplex/json-smart-v2/issues/232","https://github.com/netplex/json-smart-v2/issues/233","https://github.com/netplex/json-smart-v2/issues/236","https://github.com/netplex/json-smart-v2/releases/tag/2.5.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pq2g-wx69-c263","description":"Netplex Json-smart Uncontrolled Recursion vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-57699","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-57699","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-57699","date":"2026-11-02","epss":0.00582,"percentile":0.47827}],"urls":["https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699","https://nvd.nist.gov/vuln/detail/cve-2023-1370"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-57699","description":"A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370."}]},{"artifact":{"id":"673318971151af0f","cpes":["cpe:2.3:a:net.minidev:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:net.minidev:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json-smart:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json-smart:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json_smart:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json_smart:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:minidev:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:minidev:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json:json_smart:2.5.0:*:*:*:*:*:*:*"],"name":"json-smart","purl":"pkg:maven/net.minidev/json-smart@2.5.0","type":"java-archive","version":"2.5.0","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"net.minidev","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/jwt-plugin-3.3.2.jar:net.minidev:json-smart","manifestName":"","pomArtifactID":"json-smart","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/jwt-plugin-3.3.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/jwt-plugin-3.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.5.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pq2g-wx69-c263","versionConstraint":">=2.5.0,<2.5.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"net.minidev:json-smart","version":"2.5.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pq2g-wx69-c263","fix":{"state":"fixed","versions":["2.5.2"],"available":[{"date":"2025-02-13","kind":"first-observed","version":"2.5.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-57699","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-57699","date":"2026-11-02","epss":0.00582,"percentile":0.47827}],"risk":0.4365,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-57699","https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699","https://nvd.nist.gov/vuln/detail/cve-2023-1370","https://github.com/netplex/json-smart-v2/issues/232","https://github.com/netplex/json-smart-v2/issues/233","https://github.com/netplex/json-smart-v2/issues/236","https://github.com/netplex/json-smart-v2/releases/tag/2.5.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pq2g-wx69-c263","description":"Netplex Json-smart Uncontrolled Recursion vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-57699","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-57699","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-57699","date":"2026-11-02","epss":0.00582,"percentile":0.47827}],"urls":["https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699","https://nvd.nist.gov/vuln/detail/cve-2023-1370"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-57699","description":"A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370."}]},{"artifact":{"id":"481755dc9e9f891c","cpes":["cpe:2.3:a:net.minidev.json-smart:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:net.minidev.json-smart:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:net.minidev:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:net.minidev:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json-smart:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json-smart:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json_smart:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json_smart:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:minidev:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:minidev:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json:json_smart:2.5.0:*:*:*:*:*:*:*"],"name":"json-smart","purl":"pkg:maven/net.minidev/json-smart@2.5.0","type":"java-archive","version":"2.5.0","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"net.minidev","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/json-smart-2.5.0.jar","manifestName":"","pomArtifactID":"json-smart","archiveDigests":[{"value":"57a64f421b472849c40e77d2e7cce3a141b41e99","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/json-smart-2.5.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/json-smart-2.5.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.5.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pq2g-wx69-c263","versionConstraint":">=2.5.0,<2.5.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"net.minidev:json-smart","version":"2.5.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pq2g-wx69-c263","fix":{"state":"fixed","versions":["2.5.2"],"available":[{"date":"2025-02-13","kind":"first-observed","version":"2.5.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-57699","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-57699","date":"2026-11-02","epss":0.00582,"percentile":0.47827}],"risk":0.4365,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-57699","https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699","https://nvd.nist.gov/vuln/detail/cve-2023-1370","https://github.com/netplex/json-smart-v2/issues/232","https://github.com/netplex/json-smart-v2/issues/233","https://github.com/netplex/json-smart-v2/issues/236","https://github.com/netplex/json-smart-v2/releases/tag/2.5.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pq2g-wx69-c263","description":"Netplex Json-smart Uncontrolled Recursion vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-57699","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-57699","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-57699","date":"2026-11-02","epss":0.00582,"percentile":0.47827}],"urls":["https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699","https://nvd.nist.gov/vuln/detail/cve-2023-1370"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-57699","description":"A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370."}]},{"artifact":{"id":"3a060baa137f74ea","cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@17.0.10%2B7?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk17u.git","type":"binary","version":"17.0.10+7","language":"","licenses":[],"metadata":{"release":{"fullVersion":"17.0.10+7","javaVersion":"17.0.10","semanticVersion":"17.0.10+7","javaRuntimeVersion":"17.0.10+7"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:8b8fefae6897ed4bfb12e519d4bdcaca9564779609395dcc3238ea1d369600aa","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"17.0.11"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-21068","versionConstraint":"< 1.8.0_412||>= 1.9, < 8.0.412||>= 12, < 17.0.11||>= 18, < 21.0.3||>= 22, < 22.0.1||>= 9, < 11.0.23 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"17.0.10+7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-21068","fix":{"state":"fixed","versions":["1.8.0_412","8.0.412","11.0.23","17.0.11","21.0.3","22.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_412"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.412"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.11"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.3"},{"date":"2025-09-04","kind":"first-observed","version":"22.0.1"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.23"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21068","date":"2026-11-02","epss":0.013,"percentile":0.70442}],"risk":0.43549999999999994,"urls":["https://lists.debian.org/debian-lts-announce/2024/04/msg00014.html","https://security.netapp.com/advisory/ntap-20240426-0004/","https://www.oracle.com/security-alerts/cpuapr2024.html","https://openjdk.org/groups/vulnerability/advisories/2024-04-16"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21068","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2 and  22; Oracle GraalVM Enterprise Edition: 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"b5184c36b907334a","cpes":["cpe:2.3:a:apache:log4j-core:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:2.17.1:*:*:*:*:*:*:*"],"name":"log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1","type":"java-archive","version":"2.17.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.logging.log4j","virtualPath":"/opt/atlassian/bitbucket/opensearch/lib/log4j-core-2.17.1.jar","manifestName":"","pomArtifactID":"log4j-core","archiveDigests":[{"value":"779f60f3844dadc3ef597976fcb1e5127b1f343d","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/lib/log4j-core-2.17.1.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/lib/log4j-core-2.17.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.25.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vc5p-v9hr-52mj","versionConstraint":">=2.0-beta9,<2.25.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.17.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vc5p-v9hr-52mj","fix":{"state":"fixed","versions":["2.25.3"],"available":[{"date":"2025-12-20","kind":"first-observed","version":"2.25.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68161","cwe":"CWE-297","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-68161","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-68161","date":"2026-11-02","epss":0.00767,"percentile":0.55523}],"risk":0.43335499999999993,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-68161","https://github.com/apache/logging-log4j2/pull/4002","https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","https://logging.apache.org/security.html#CVE-2025-68161","https://github.com/apache/logging-log4j2/commit/3b93748497e1adbbd027fda8a5e7268ec5d0d578","http://www.openwall.com/lists/oss-security/2025/12/18/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vc5p-v9hr-52mj","description":"Apache Log4j does not verify the TLS hostname in its Socket Appender"},"relatedVulnerabilities":[{"id":"CVE-2025-68161","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68161","cwe":"CWE-297","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-68161","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-68161","date":"2026-11-02","epss":0.00767,"percentile":0.55523}],"urls":["https://github.com/apache/logging-log4j2/pull/4002","https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","https://logging.apache.org/security.html#CVE-2025-68161","http://www.openwall.com/lists/oss-security/2025/12/18/1","https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68161","description":"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the  verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName  configuration attribute or the  log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName  system property is set to true.\n\nThis issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:\n\n  *  The attacker is able to intercept or redirect network traffic between the client and the log receiver.\n  *  The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).\n\n\nUsers are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.\n\nAs an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates."}]},{"artifact":{"id":"bc7238cfe0245871","cpes":["cpe:2.3:a:apache:log4j-core:2.18.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.18.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.18.0:*:*:*:*:*:*:*"],"name":"log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0","type":"java-archive","version":"2.18.0","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.logging.log4j","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar:org.apache.logging.log4j:log4j-core","manifestName":"","pomArtifactID":"log4j-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.25.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vc5p-v9hr-52mj","versionConstraint":">=2.0-beta9,<2.25.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.18.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vc5p-v9hr-52mj","fix":{"state":"fixed","versions":["2.25.3"],"available":[{"date":"2025-12-20","kind":"first-observed","version":"2.25.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68161","cwe":"CWE-297","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-68161","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-68161","date":"2026-11-02","epss":0.00767,"percentile":0.55523}],"risk":0.43335499999999993,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-68161","https://github.com/apache/logging-log4j2/pull/4002","https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","https://logging.apache.org/security.html#CVE-2025-68161","https://github.com/apache/logging-log4j2/commit/3b93748497e1adbbd027fda8a5e7268ec5d0d578","http://www.openwall.com/lists/oss-security/2025/12/18/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vc5p-v9hr-52mj","description":"Apache Log4j does not verify the TLS hostname in its Socket Appender"},"relatedVulnerabilities":[{"id":"CVE-2025-68161","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68161","cwe":"CWE-297","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-68161","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-68161","date":"2026-11-02","epss":0.00767,"percentile":0.55523}],"urls":["https://github.com/apache/logging-log4j2/pull/4002","https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","https://logging.apache.org/security.html#CVE-2025-68161","http://www.openwall.com/lists/oss-security/2025/12/18/1","https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68161","description":"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the  verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName  configuration attribute or the  log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName  system property is set to true.\n\nThis issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:\n\n  *  The attacker is able to intercept or redirect network traffic between the client and the log receiver.\n  *  The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).\n\n\nUsers are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.\n\nAs an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates."}]},{"artifact":{"id":"c37764faf81b0045","cpes":["cpe:2.3:a:apache:log4j-core:2.22.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.22.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.22.0:*:*:*:*:*:*:*"],"name":"log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.22.0","type":"java-archive","version":"2.22.0","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.logging.log4j","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:org.apache.logging.log4j:log4j-core","manifestName":"","pomArtifactID":"log4j-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.25.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vc5p-v9hr-52mj","versionConstraint":">=2.0-beta9,<2.25.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.22.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vc5p-v9hr-52mj","fix":{"state":"fixed","versions":["2.25.3"],"available":[{"date":"2025-12-20","kind":"first-observed","version":"2.25.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68161","cwe":"CWE-297","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-68161","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-68161","date":"2026-11-02","epss":0.00767,"percentile":0.55523}],"risk":0.43335499999999993,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-68161","https://github.com/apache/logging-log4j2/pull/4002","https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","https://logging.apache.org/security.html#CVE-2025-68161","https://github.com/apache/logging-log4j2/commit/3b93748497e1adbbd027fda8a5e7268ec5d0d578","http://www.openwall.com/lists/oss-security/2025/12/18/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vc5p-v9hr-52mj","description":"Apache Log4j does not verify the TLS hostname in its Socket Appender"},"relatedVulnerabilities":[{"id":"CVE-2025-68161","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68161","cwe":"CWE-297","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-68161","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-68161","date":"2026-11-02","epss":0.00767,"percentile":0.55523}],"urls":["https://github.com/apache/logging-log4j2/pull/4002","https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","https://logging.apache.org/security.html#CVE-2025-68161","http://www.openwall.com/lists/oss-security/2025/12/18/1","https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68161","description":"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the  verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName  configuration attribute or the  log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName  system property is set to true.\n\nThis issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:\n\n  *  The attacker is able to intercept or redirect network traffic between the client and the log receiver.\n  *  The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).\n\n\nUsers are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.\n\nAs an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.115"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mgp5-rv84-w37q","versionConstraint":">=9.0.83,<9.0.115 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mgp5-rv84-w37q","fix":{"state":"fixed","versions":["9.0.115"],"available":[{"date":"2026-03-20","kind":"first-observed","version":"9.0.115"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24734","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-24734","cwe":"CWE-295","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-24734","date":"2026-11-02","epss":0.00575,"percentile":0.47453}],"risk":0.43125,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-24734","https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mgp5-rv84-w37q","description":"Apache Tomcat has an Improper Input Validation vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-24734","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24734","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-24734","cwe":"CWE-295","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-24734","date":"2026-11-02","epss":0.00575,"percentile":0.47453}],"urls":["https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml","https://access.redhat.com/errata/RHSA-2026:19054","https://access.redhat.com/errata/RHSA-2026:26323","https://access.redhat.com/errata/RHSA-2026:36790","https://access.redhat.com/errata/RHSA-2026:5611","https://access.redhat.com/errata/RHSA-2026:5612","https://access.redhat.com/errata/RHSA-2026:6569","https://access.redhat.com/errata/RHSA-2026:8334","https://access.redhat.com/security/cve/CVE-2026-24734","https://bugzilla.redhat.com/show_bug.cgi?id=2440426","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24734.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24734","description":"Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.\n\nWhen using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.\n\nThis issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.\n\nApache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.\n\nApache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-02","epss":0.00859,"percentile":0.58481}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-02","epss":0.00859,"percentile":0.58481}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-02","epss":0.00859,"percentile":0.58481}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-02","epss":0.00859,"percentile":0.58481}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-02","epss":0.00859,"percentile":0.58481}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-02","epss":0.00859,"percentile":0.58481}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-02","epss":0.00859,"percentile":0.58481}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-02","epss":0.00859,"percentile":0.58481}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"a9973ccde29805f2","cpes":["cpe:2.3:a:apache:tomcat-embed-core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_embed_core:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:embed:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat.embed","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","manifestName":"","pomArtifactID":"tomcat-embed-core","archiveDigests":[{"value":"d771e4343b0515c67dab2a09fe02f5d47550153f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/tomcat-embed-core-9.0.83.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.110"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hgrr-935x-pq79","versionConstraint":">=9.0.0.M1,<9.0.110 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hgrr-935x-pq79","fix":{"state":"fixed","versions":["9.0.110"],"available":[{"date":"2025-10-29","kind":"first-observed","version":"9.0.110"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61795","cwe":"CWE-404","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-61795","date":"2026-11-02","epss":0.01249,"percentile":0.69371}],"risk":0.42466,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-61795","https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp","https://github.com/apache/tomcat/commit/1cdf5f730ede75a0759492f179ac21ca4ff68e06","https://github.com/apache/tomcat/commit/af6e9181620304c0d818121c29c074e1330610d0","https://github.com/apache/tomcat/commit/afa422bd7ca1eef0f507259c682fd876494d9c3b","https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.47","https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.12","https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.110","http://www.openwall.com/lists/oss-security/2025/10/27/6","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hgrr-935x-pq79","description":"Apache Tomcat Vulnerable to Improper Resource Shutdown or Release"},"relatedVulnerabilities":[{"id":"CVE-2025-61795","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61795","cwe":"CWE-404","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-61795","date":"2026-11-02","epss":0.01249,"percentile":0.69371}],"urls":["https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp","http://www.openwall.com/lists/oss-security/2025/10/27/6","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61795","description":"Improper Resource Shutdown or Release vulnerability in Apache Tomcat.\n\nIf an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue."}]},{"artifact":{"id":"3a060baa137f74ea","cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@17.0.10%2B7?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk17u.git","type":"binary","version":"17.0.10+7","language":"","licenses":[],"metadata":{"release":{"fullVersion":"17.0.10+7","javaVersion":"17.0.10","semanticVersion":"17.0.10+7","javaRuntimeVersion":"17.0.10+7"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:8b8fefae6897ed4bfb12e519d4bdcaca9564779609395dcc3238ea1d369600aa","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"17.0.12"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-21145","versionConstraint":"< 1.8.0_422||>= 1.9, < 8.0.422||>= 12, < 17.0.12||>= 18, < 21.0.4||>= 22, < 22.0.2||>= 9, < 11.0.24 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"17.0.10+7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-21145","fix":{"state":"fixed","versions":["1.8.0_422","8.0.422","11.0.24","17.0.12","21.0.4","22.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_422"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.422"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.12"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.4"},{"date":"2025-09-04","kind":"first-observed","version":"22.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.24"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-21145","date":"2026-11-02","epss":0.00864,"percentile":0.58622}],"risk":0.42335999999999996,"urls":["https://security.netapp.com/advisory/ntap-20240719-0008/","https://www.oracle.com/security-alerts/cpujul2024.html","https://openjdk.org/groups/vulnerability/advisories/2024-07-16"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21145","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"3a060baa137f74ea","cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@17.0.10%2B7?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk17u.git","type":"binary","version":"17.0.10+7","language":"","licenses":[],"metadata":{"release":{"fullVersion":"17.0.10+7","javaVersion":"17.0.10","semanticVersion":"17.0.10+7","javaRuntimeVersion":"17.0.10+7"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:8b8fefae6897ed4bfb12e519d4bdcaca9564779609395dcc3238ea1d369600aa","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"17.0.12"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-21138","versionConstraint":"< 1.8.0_422||>= 1.9, < 8.0.422||>= 12, < 17.0.12||>= 18, < 21.0.4||>= 22, < 22.0.2||>= 9, < 11.0.24 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"17.0.10+7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-21138","fix":{"state":"fixed","versions":["1.8.0_422","8.0.422","11.0.24","17.0.12","21.0.4","22.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_422"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.422"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.12"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.4"},{"date":"2025-09-04","kind":"first-observed","version":"22.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.24"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21138","date":"2026-11-02","epss":0.01257,"percentile":0.69557}],"risk":0.421095,"urls":["https://security.netapp.com/advisory/ntap-20240719-0008/","https://www.oracle.com/security-alerts/cpujul2024.html","https://openjdk.org/groups/vulnerability/advisories/2024-07-16"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21138","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"7ddef62d4838b990","cpes":["cpe:2.3:a:binutils:binutils:2.38-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/ubuntu/binutils@2.38-4ubuntu2.5?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"2.38-4ubuntu2.5","language":"","licenses":["sha256:677c595f0afa160e1021627e7dcdcd1eb1741963b58d6cdf706eb3bacf9a9297"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/binutils.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-13716","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"binutils","version":"2.38-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2017-13716","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-13716","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13716","date":"2026-11-02","epss":0.01399,"percentile":0.72468}],"risk":0.4197,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-13716"},"relatedVulnerabilities":[{"id":"CVE-2017-13716","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13716","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13716","date":"2026-11-02","epss":0.01399,"percentile":0.72468}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=22009"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13716","description":"The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd)."}]},{"artifact":{"id":"0b306f675dd49cda","cpes":["cpe:2.3:a:binutils-common:binutils-common:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-common:binutils_common:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_common:binutils-common:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_common:binutils_common:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils:binutils-common:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils:binutils_common:2.38-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"binutils-common","purl":"pkg:deb/ubuntu/binutils-common@2.38-4ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=binutils","type":"deb","version":"2.38-4ubuntu2.5","language":"","licenses":["sha256:677c595f0afa160e1021627e7dcdcd1eb1741963b58d6cdf706eb3bacf9a9297"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils-common/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/binutils-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils-common:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/binutils-common:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"binutils"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13716","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"binutils","version":"2.38-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2017-13716","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-13716","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13716","date":"2026-11-02","epss":0.01399,"percentile":0.72468}],"risk":0.4197,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-13716"},"relatedVulnerabilities":[{"id":"CVE-2017-13716","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13716","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13716","date":"2026-11-02","epss":0.01399,"percentile":0.72468}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=22009"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13716","description":"The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd)."}]},{"artifact":{"id":"429e3b6c0ca6ddcd","cpes":["cpe:2.3:a:binutils-x86-64-linux-gnu:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86-64-linux-gnu:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86_64_linux_gnu:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86_64_linux_gnu:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86-64-linux:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86-64-linux:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86_64_linux:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86_64_linux:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86-64:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86-64:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86_64:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86_64:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"binutils-x86-64-linux-gnu","purl":"pkg:deb/ubuntu/binutils-x86-64-linux-gnu@2.38-4ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=binutils","type":"deb","version":"2.38-4ubuntu2.5","language":"","licenses":["sha256:677c595f0afa160e1021627e7dcdcd1eb1741963b58d6cdf706eb3bacf9a9297"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils-common/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/binutils-x86-64-linux-gnu/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils-x86-64-linux-gnu.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/binutils-x86-64-linux-gnu.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils-x86-64-linux-gnu.list","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/binutils-x86-64-linux-gnu.list"}],"upstreams":[{"name":"binutils"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13716","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"binutils","version":"2.38-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2017-13716","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-13716","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13716","date":"2026-11-02","epss":0.01399,"percentile":0.72468}],"risk":0.4197,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-13716"},"relatedVulnerabilities":[{"id":"CVE-2017-13716","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13716","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13716","date":"2026-11-02","epss":0.01399,"percentile":0.72468}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=22009"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13716","description":"The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd)."}]},{"artifact":{"id":"0e2fd27b95a08338","cpes":["cpe:2.3:a:libbinutils:libbinutils:2.38-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libbinutils","purl":"pkg:deb/ubuntu/libbinutils@2.38-4ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=binutils","type":"deb","version":"2.38-4ubuntu2.5","language":"","licenses":["sha256:677c595f0afa160e1021627e7dcdcd1eb1741963b58d6cdf706eb3bacf9a9297"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils-common/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libbinutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbinutils:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libbinutils:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"binutils"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13716","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"binutils","version":"2.38-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2017-13716","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-13716","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13716","date":"2026-11-02","epss":0.01399,"percentile":0.72468}],"risk":0.4197,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-13716"},"relatedVulnerabilities":[{"id":"CVE-2017-13716","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13716","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13716","date":"2026-11-02","epss":0.01399,"percentile":0.72468}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=22009"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13716","description":"The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd)."}]},{"artifact":{"id":"d1ba13dc069671f5","cpes":["cpe:2.3:a:libctf-nobfd0:libctf-nobfd0:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libctf-nobfd0:libctf_nobfd0:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libctf_nobfd0:libctf-nobfd0:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libctf_nobfd0:libctf_nobfd0:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libctf:libctf-nobfd0:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libctf:libctf_nobfd0:2.38-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libctf-nobfd0","purl":"pkg:deb/ubuntu/libctf-nobfd0@2.38-4ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=binutils","type":"deb","version":"2.38-4ubuntu2.5","language":"","licenses":["sha256:677c595f0afa160e1021627e7dcdcd1eb1741963b58d6cdf706eb3bacf9a9297"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libctf-nobfd0/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libctf-nobfd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libctf-nobfd0:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libctf-nobfd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"binutils"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13716","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"binutils","version":"2.38-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2017-13716","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-13716","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13716","date":"2026-11-02","epss":0.01399,"percentile":0.72468}],"risk":0.4197,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-13716"},"relatedVulnerabilities":[{"id":"CVE-2017-13716","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13716","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13716","date":"2026-11-02","epss":0.01399,"percentile":0.72468}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=22009"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13716","description":"The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd)."}]},{"artifact":{"id":"1f1bf67e128b3351","cpes":["cpe:2.3:a:libctf0:libctf0:2.38-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libctf0","purl":"pkg:deb/ubuntu/libctf0@2.38-4ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=binutils","type":"deb","version":"2.38-4ubuntu2.5","language":"","licenses":["sha256:677c595f0afa160e1021627e7dcdcd1eb1741963b58d6cdf706eb3bacf9a9297"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils-common/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libctf0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libctf0:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libctf0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"binutils"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13716","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"binutils","version":"2.38-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2017-13716","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-13716","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13716","date":"2026-11-02","epss":0.01399,"percentile":0.72468}],"risk":0.4197,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-13716"},"relatedVulnerabilities":[{"id":"CVE-2017-13716","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13716","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13716","date":"2026-11-02","epss":0.01399,"percentile":0.72468}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=22009"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13716","description":"The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd)."}]},{"artifact":{"id":"c1e86990bac3051c","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.75","type":"java-archive","version":"1.75","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"df22e1b6a9f6b218913f5b68dd16641344397fe0","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.78"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4h8f-2wvx-gg5w","versionConstraint":">=1.61,<1.78 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.75"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4h8f-2wvx-gg5w","fix":{"state":"fixed","versions":["1.78"],"available":[{"date":"2024-05-04","kind":"first-observed","version":"1.78"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-34447","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-34447","date":"2026-11-02","epss":0.0077,"percentile":0.55647}],"risk":0.4196500000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-34447","https://www.bouncycastle.org/latest_releases.html","https://github.com/bcgit/bc-java/issues/1656","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9034447","http://security.netapp.com/advisory/ntap-20240614-0007"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4h8f-2wvx-gg5w","description":"Bouncy Castle Java Cryptography API vulnerable to DNS poisoning"},"relatedVulnerabilities":[{"id":"CVE-2024-34447","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-34447","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-34447","date":"2026-11-02","epss":0.0077,"percentile":0.55647}],"urls":["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9034447","https://security.netapp.com/advisory/ntap-20240614-0007/","https://www.bouncycastle.org/latest_releases.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-34447","description":"An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning."}]},{"artifact":{"id":"fa5d59af15dd3ec9","cpes":["cpe:2.3:a:org.bouncycastle:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-lts8on:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-lts8on:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_lts8on:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_lts8on:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*"],"name":"bcprov-lts8on","purl":"pkg:maven/org.bouncycastle/bcprov-lts8on@2.73.3","type":"java-archive","version":"2.73.3","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/bcprov-lts8on-2.73.3.jar","manifestName":"","pomArtifactID":"bcprov-lts8on","archiveDigests":[{"value":"124e14ab29a240cd074d4e15ee55c360edd0e1d0","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/bcprov-lts8on-2.73.3.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/bcprov-lts8on-2.73.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.73.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4h8f-2wvx-gg5w","versionConstraint":"<2.73.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-lts8on","version":"2.73.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4h8f-2wvx-gg5w","fix":{"state":"fixed","versions":["2.73.6"],"available":[{"date":"2025-06-25","kind":"first-observed","version":"2.73.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-34447","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-34447","date":"2026-11-02","epss":0.0077,"percentile":0.55647}],"risk":0.4196500000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-34447","https://www.bouncycastle.org/latest_releases.html","https://github.com/bcgit/bc-java/issues/1656","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9034447","http://security.netapp.com/advisory/ntap-20240614-0007"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4h8f-2wvx-gg5w","description":"Bouncy Castle Java Cryptography API vulnerable to DNS poisoning"},"relatedVulnerabilities":[{"id":"CVE-2024-34447","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-34447","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-34447","date":"2026-11-02","epss":0.0077,"percentile":0.55647}],"urls":["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9034447","https://security.netapp.com/advisory/ntap-20240614-0007/","https://www.bouncycastle.org/latest_releases.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-34447","description":"An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning."}]},{"artifact":{"id":"24e80c3d7117a69a","cpes":["cpe:2.3:a:org.bouncycastle:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-lts8on:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-lts8on:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_lts8on:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_lts8on:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*"],"name":"bcprov-lts8on","purl":"pkg:maven/org.bouncycastle/bcprov-lts8on@2.73.3","type":"java-archive","version":"2.73.3","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/bcprov-lts8on-2.73.3.jar","manifestName":"","pomArtifactID":"bcprov-lts8on","archiveDigests":[{"value":"124e14ab29a240cd074d4e15ee55c360edd0e1d0","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/bcprov-lts8on-2.73.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.73.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4h8f-2wvx-gg5w","versionConstraint":"<2.73.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-lts8on","version":"2.73.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4h8f-2wvx-gg5w","fix":{"state":"fixed","versions":["2.73.6"],"available":[{"date":"2025-06-25","kind":"first-observed","version":"2.73.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-34447","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-34447","date":"2026-11-02","epss":0.0077,"percentile":0.55647}],"risk":0.4196500000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-34447","https://www.bouncycastle.org/latest_releases.html","https://github.com/bcgit/bc-java/issues/1656","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9034447","http://security.netapp.com/advisory/ntap-20240614-0007"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4h8f-2wvx-gg5w","description":"Bouncy Castle Java Cryptography API vulnerable to DNS poisoning"},"relatedVulnerabilities":[{"id":"CVE-2024-34447","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-34447","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-34447","date":"2026-11-02","epss":0.0077,"percentile":0.55647}],"urls":["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9034447","https://security.netapp.com/advisory/ntap-20240614-0007/","https://www.bouncycastle.org/latest_releases.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-34447","description":"An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning."}]},{"artifact":{"id":"c1e86990bac3051c","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.75","type":"java-archive","version":"1.75","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"df22e1b6a9f6b218913f5b68dd16641344397fe0","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.78"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m44j-cfrm-g8qc","versionConstraint":">=1.73,<1.78 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.75"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-m44j-cfrm-g8qc","fix":{"state":"fixed","versions":["1.78"],"available":[{"date":"2024-05-15","kind":"first-observed","version":"1.78"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-30172","date":"2026-11-02","epss":0.00753,"percentile":0.55064}],"risk":0.4179149999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-30172","https://www.bouncycastle.org/latest_releases.html","https://github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9030172","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9030172","https://security.netapp.com/advisory/ntap-20240614-0007","https://github.com/bcgit/bc-java/commit/9c165791b68a204678b48ec11e4e579754c2ea49","https://github.com/bcgit/bc-java/commit/ebe1c75579170072dc59b8dee2b55ce31663178f","https://github.com/bcgit/bc-java/commit/1b9fd9b545e691bfb3941a9f6a797660c8860f02"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m44j-cfrm-g8qc","description":"Bouncy Castle crafted signature and public key can be used to trigger an infinite loop"},"relatedVulnerabilities":[{"id":"CVE-2024-30172","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-30172","date":"2026-11-02","epss":0.00753,"percentile":0.55064}],"urls":["https://security.netapp.com/advisory/ntap-20240614-0007/","https://www.bouncycastle.org/latest_releases.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-30172","description":"An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key."}]},{"artifact":{"id":"9e28ead69d9888a7","cpes":["cpe:2.3:a:jonathan-hedley:jsoup:1.17.2:*:*:*:*:*:*:*","cpe:2.3:a:jonathan_hedley:jsoup:1.17.2:*:*:*:*:*:*:*","cpe:2.3:a:org.jsoup:jsoup:1.17.2:*:*:*:*:*:*:*","cpe:2.3:a:jsoup:jsoup:1.17.2:*:*:*:*:*:*:*"],"name":"jsoup","purl":"pkg:maven/org.jsoup/jsoup@1.17.2","type":"java-archive","version":"1.17.2","language":"java","licenses":["https://jsoup.org/license"],"metadata":{"pomGroupID":"org.jsoup","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/jsoup-1.17.2.jar","manifestName":"","pomArtifactID":"jsoup","archiveDigests":[{"value":"1e75b08d7019546a954f1e359477f916f537a34d","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/jsoup-1.17.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/jsoup-1.17.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.23.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-65r4-943x-97jj","versionConstraint":"<1.23.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jsoup:jsoup","version":"1.17.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-65r4-943x-97jj","fix":{"state":"fixed","versions":["1.23.2"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"1.23.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75140","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75140","date":"2026-11-02","epss":0.00525,"percentile":0.4452}],"risk":0.40950000000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-75140","https://github.com/jhy/jsoup/pull/2556","https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder","https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-65r4-943x-97jj","description":"jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations"},"relatedVulnerabilities":[{"id":"CVE-2026-75140","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75140","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75140","date":"2026-11-02","epss":0.00525,"percentile":0.4452}],"urls":["https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","https://github.com/jhy/jsoup/pull/2556","https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75140","description":"jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application."}]},{"artifact":{"id":"7f5afd36e2a50847","cpes":["cpe:2.3:a:curl:curl:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.18"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-8096","versionConstraint":"< 7.81.0-1ubuntu1.18 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-8096","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.18"],"available":[{"date":"2024-09-16","kind":"advisory","version":"7.81.0-1ubuntu1.18"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-8096","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8096","date":"2026-11-02","epss":0.00817,"percentile":0.57117}],"risk":0.40850000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8096"},"relatedVulnerabilities":[{"id":"CVE-2024-8096","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8096","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8096","date":"2026-11-02","epss":0.00817,"percentile":0.57117}],"urls":["https://curl.se/docs/CVE-2024-8096.html","https://curl.se/docs/CVE-2024-8096.json","https://hackerone.com/reports/2669852","http://www.openwall.com/lists/oss-security/2024/09/11/1","https://lists.debian.org/debian-lts-announce/2024/11/msg00008.html","https://security.netapp.com/advisory/ntap-20241011-0005/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://github.com/curl/curl/commit/aeb1a281cab13c7ba"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8096","description":"When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine.  If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate."}]},{"artifact":{"id":"f75f86e9282bbba5","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.18"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8096","versionConstraint":"< 7.81.0-1ubuntu1.18 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-8096","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.18"],"available":[{"date":"2024-09-16","kind":"advisory","version":"7.81.0-1ubuntu1.18"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-8096","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8096","date":"2026-11-02","epss":0.00817,"percentile":0.57117}],"risk":0.40850000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8096"},"relatedVulnerabilities":[{"id":"CVE-2024-8096","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8096","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8096","date":"2026-11-02","epss":0.00817,"percentile":0.57117}],"urls":["https://curl.se/docs/CVE-2024-8096.html","https://curl.se/docs/CVE-2024-8096.json","https://hackerone.com/reports/2669852","http://www.openwall.com/lists/oss-security/2024/09/11/1","https://lists.debian.org/debian-lts-announce/2024/11/msg00008.html","https://security.netapp.com/advisory/ntap-20241011-0005/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://github.com/curl/curl/commit/aeb1a281cab13c7ba"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8096","description":"When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine.  If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate."}]},{"artifact":{"id":"eebde1772607afd6","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.18"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8096","versionConstraint":"< 7.81.0-1ubuntu1.18 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-8096","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.18"],"available":[{"date":"2024-09-16","kind":"advisory","version":"7.81.0-1ubuntu1.18"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-8096","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8096","date":"2026-11-02","epss":0.00817,"percentile":0.57117}],"risk":0.40850000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8096"},"relatedVulnerabilities":[{"id":"CVE-2024-8096","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8096","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8096","date":"2026-11-02","epss":0.00817,"percentile":0.57117}],"urls":["https://curl.se/docs/CVE-2024-8096.html","https://curl.se/docs/CVE-2024-8096.json","https://hackerone.com/reports/2669852","http://www.openwall.com/lists/oss-security/2024/09/11/1","https://lists.debian.org/debian-lts-announce/2024/11/msg00008.html","https://security.netapp.com/advisory/ntap-20241011-0005/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://github.com/curl/curl/commit/aeb1a281cab13c7ba"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8096","description":"When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine.  If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate."}]},{"artifact":{"id":"6c6ae95c8b3d93fb","cpes":["cpe:2.3:a:libcurl4-gnutls-dev:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4-gnutls-dev:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls_dev:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls_dev:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4-gnutls:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4-gnutls:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4_gnutls:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4:libcurl4-gnutls-dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl4:libcurl4_gnutls_dev:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl4-gnutls-dev","purl":"pkg:deb/ubuntu/libcurl4-gnutls-dev@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4-gnutls-dev/copyright","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/usr/share/doc/libcurl4-gnutls-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4-gnutls-dev:amd64.md5sums","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/info/libcurl4-gnutls-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.18"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8096","versionConstraint":"< 7.81.0-1ubuntu1.18 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-8096","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.18"],"available":[{"date":"2024-09-16","kind":"advisory","version":"7.81.0-1ubuntu1.18"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-8096","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8096","date":"2026-11-02","epss":0.00817,"percentile":0.57117}],"risk":0.40850000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8096"},"relatedVulnerabilities":[{"id":"CVE-2024-8096","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8096","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8096","date":"2026-11-02","epss":0.00817,"percentile":0.57117}],"urls":["https://curl.se/docs/CVE-2024-8096.html","https://curl.se/docs/CVE-2024-8096.json","https://hackerone.com/reports/2669852","http://www.openwall.com/lists/oss-security/2024/09/11/1","https://lists.debian.org/debian-lts-announce/2024/11/msg00008.html","https://security.netapp.com/advisory/ntap-20241011-0005/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://github.com/curl/curl/commit/aeb1a281cab13c7ba"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8096","description":"When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine.  If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate."}]},{"artifact":{"id":"7ddef62d4838b990","cpes":["cpe:2.3:a:binutils:binutils:2.38-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/ubuntu/binutils@2.38-4ubuntu2.5?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"2.38-4ubuntu2.5","language":"","licenses":["sha256:677c595f0afa160e1021627e7dcdcd1eb1741963b58d6cdf706eb3bacf9a9297"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/binutils.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.38-4ubuntu2.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-1153","versionConstraint":"< 2.38-4ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"binutils","version":"2.38-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-1153","fix":{"state":"fixed","versions":["2.38-4ubuntu2.8"],"available":[{"date":"2025-04-07","kind":"advisory","version":"2.38-4ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-1153","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1153","date":"2026-11-02","epss":0.01357,"percentile":0.71665}],"risk":0.4071,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1153"},"relatedVulnerabilities":[{"id":"CVE-2025-1153","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1153","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1153","date":"2026-11-02","epss":0.01357,"percentile":0.71665}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=32603","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150","https://vuldb.com/?ctiid.295057","https://vuldb.com/?id.295057","https://vuldb.com/?submit.489991","https://www.gnu.org/","https://security.netapp.com/advisory/ntap-20250404-0005/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1153","description":"A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 2.45 is able to address this issue. The identifier of the patch is 8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150. It is recommended to upgrade the affected component."}]},{"artifact":{"id":"0b306f675dd49cda","cpes":["cpe:2.3:a:binutils-common:binutils-common:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-common:binutils_common:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_common:binutils-common:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_common:binutils_common:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils:binutils-common:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils:binutils_common:2.38-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"binutils-common","purl":"pkg:deb/ubuntu/binutils-common@2.38-4ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=binutils","type":"deb","version":"2.38-4ubuntu2.5","language":"","licenses":["sha256:677c595f0afa160e1021627e7dcdcd1eb1741963b58d6cdf706eb3bacf9a9297"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils-common/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/binutils-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils-common:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/binutils-common:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"binutils"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.38-4ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1153","versionConstraint":"< 2.38-4ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"binutils","version":"2.38-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-1153","fix":{"state":"fixed","versions":["2.38-4ubuntu2.8"],"available":[{"date":"2025-04-07","kind":"advisory","version":"2.38-4ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-1153","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1153","date":"2026-11-02","epss":0.01357,"percentile":0.71665}],"risk":0.4071,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1153"},"relatedVulnerabilities":[{"id":"CVE-2025-1153","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1153","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1153","date":"2026-11-02","epss":0.01357,"percentile":0.71665}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=32603","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150","https://vuldb.com/?ctiid.295057","https://vuldb.com/?id.295057","https://vuldb.com/?submit.489991","https://www.gnu.org/","https://security.netapp.com/advisory/ntap-20250404-0005/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1153","description":"A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 2.45 is able to address this issue. The identifier of the patch is 8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150. It is recommended to upgrade the affected component."}]},{"artifact":{"id":"429e3b6c0ca6ddcd","cpes":["cpe:2.3:a:binutils-x86-64-linux-gnu:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86-64-linux-gnu:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86_64_linux_gnu:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86_64_linux_gnu:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86-64-linux:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86-64-linux:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86_64_linux:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86_64_linux:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86-64:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86-64:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86_64:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86_64:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"binutils-x86-64-linux-gnu","purl":"pkg:deb/ubuntu/binutils-x86-64-linux-gnu@2.38-4ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=binutils","type":"deb","version":"2.38-4ubuntu2.5","language":"","licenses":["sha256:677c595f0afa160e1021627e7dcdcd1eb1741963b58d6cdf706eb3bacf9a9297"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils-common/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/binutils-x86-64-linux-gnu/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils-x86-64-linux-gnu.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/binutils-x86-64-linux-gnu.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils-x86-64-linux-gnu.list","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/binutils-x86-64-linux-gnu.list"}],"upstreams":[{"name":"binutils"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.38-4ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1153","versionConstraint":"< 2.38-4ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"binutils","version":"2.38-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-1153","fix":{"state":"fixed","versions":["2.38-4ubuntu2.8"],"available":[{"date":"2025-04-07","kind":"advisory","version":"2.38-4ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-1153","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1153","date":"2026-11-02","epss":0.01357,"percentile":0.71665}],"risk":0.4071,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1153"},"relatedVulnerabilities":[{"id":"CVE-2025-1153","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1153","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1153","date":"2026-11-02","epss":0.01357,"percentile":0.71665}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=32603","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150","https://vuldb.com/?ctiid.295057","https://vuldb.com/?id.295057","https://vuldb.com/?submit.489991","https://www.gnu.org/","https://security.netapp.com/advisory/ntap-20250404-0005/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1153","description":"A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 2.45 is able to address this issue. The identifier of the patch is 8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150. It is recommended to upgrade the affected component."}]},{"artifact":{"id":"0e2fd27b95a08338","cpes":["cpe:2.3:a:libbinutils:libbinutils:2.38-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libbinutils","purl":"pkg:deb/ubuntu/libbinutils@2.38-4ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=binutils","type":"deb","version":"2.38-4ubuntu2.5","language":"","licenses":["sha256:677c595f0afa160e1021627e7dcdcd1eb1741963b58d6cdf706eb3bacf9a9297"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils-common/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libbinutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbinutils:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libbinutils:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"binutils"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.38-4ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1153","versionConstraint":"< 2.38-4ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"binutils","version":"2.38-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-1153","fix":{"state":"fixed","versions":["2.38-4ubuntu2.8"],"available":[{"date":"2025-04-07","kind":"advisory","version":"2.38-4ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-1153","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1153","date":"2026-11-02","epss":0.01357,"percentile":0.71665}],"risk":0.4071,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1153"},"relatedVulnerabilities":[{"id":"CVE-2025-1153","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1153","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1153","date":"2026-11-02","epss":0.01357,"percentile":0.71665}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=32603","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150","https://vuldb.com/?ctiid.295057","https://vuldb.com/?id.295057","https://vuldb.com/?submit.489991","https://www.gnu.org/","https://security.netapp.com/advisory/ntap-20250404-0005/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1153","description":"A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 2.45 is able to address this issue. The identifier of the patch is 8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150. It is recommended to upgrade the affected component."}]},{"artifact":{"id":"d1ba13dc069671f5","cpes":["cpe:2.3:a:libctf-nobfd0:libctf-nobfd0:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libctf-nobfd0:libctf_nobfd0:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libctf_nobfd0:libctf-nobfd0:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libctf_nobfd0:libctf_nobfd0:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libctf:libctf-nobfd0:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libctf:libctf_nobfd0:2.38-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libctf-nobfd0","purl":"pkg:deb/ubuntu/libctf-nobfd0@2.38-4ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=binutils","type":"deb","version":"2.38-4ubuntu2.5","language":"","licenses":["sha256:677c595f0afa160e1021627e7dcdcd1eb1741963b58d6cdf706eb3bacf9a9297"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libctf-nobfd0/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libctf-nobfd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libctf-nobfd0:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libctf-nobfd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"binutils"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.38-4ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1153","versionConstraint":"< 2.38-4ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"binutils","version":"2.38-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-1153","fix":{"state":"fixed","versions":["2.38-4ubuntu2.8"],"available":[{"date":"2025-04-07","kind":"advisory","version":"2.38-4ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-1153","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1153","date":"2026-11-02","epss":0.01357,"percentile":0.71665}],"risk":0.4071,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1153"},"relatedVulnerabilities":[{"id":"CVE-2025-1153","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1153","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1153","date":"2026-11-02","epss":0.01357,"percentile":0.71665}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=32603","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150","https://vuldb.com/?ctiid.295057","https://vuldb.com/?id.295057","https://vuldb.com/?submit.489991","https://www.gnu.org/","https://security.netapp.com/advisory/ntap-20250404-0005/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1153","description":"A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 2.45 is able to address this issue. The identifier of the patch is 8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150. It is recommended to upgrade the affected component."}]},{"artifact":{"id":"1f1bf67e128b3351","cpes":["cpe:2.3:a:libctf0:libctf0:2.38-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libctf0","purl":"pkg:deb/ubuntu/libctf0@2.38-4ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=binutils","type":"deb","version":"2.38-4ubuntu2.5","language":"","licenses":["sha256:677c595f0afa160e1021627e7dcdcd1eb1741963b58d6cdf706eb3bacf9a9297"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils-common/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libctf0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libctf0:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libctf0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"binutils"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.38-4ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1153","versionConstraint":"< 2.38-4ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"binutils","version":"2.38-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-1153","fix":{"state":"fixed","versions":["2.38-4ubuntu2.8"],"available":[{"date":"2025-04-07","kind":"advisory","version":"2.38-4ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-1153","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1153","date":"2026-11-02","epss":0.01357,"percentile":0.71665}],"risk":0.4071,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1153"},"relatedVulnerabilities":[{"id":"CVE-2025-1153","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1153","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1153","date":"2026-11-02","epss":0.01357,"percentile":0.71665}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=32603","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150","https://vuldb.com/?ctiid.295057","https://vuldb.com/?id.295057","https://vuldb.com/?submit.489991","https://www.gnu.org/","https://security.netapp.com/advisory/ntap-20250404-0005/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1153","description":"A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 2.45 is able to address this issue. The identifier of the patch is 8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150. It is recommended to upgrade the affected component."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-0397","versionConstraint":"< 3.10.12-1~22.04.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-0397","fix":{"state":"fixed","versions":["3.10.12-1~22.04.5"],"available":[{"date":"2024-07-30","kind":"advisory","version":"3.10.12-1~22.04.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-11-02","epss":0.0081,"percentile":0.56931}],"risk":0.40499999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-0397"},"relatedVulnerabilities":[{"id":"CVE-2024-0397","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-11-02","epss":0.0081,"percentile":0.56931}],"urls":["http://www.openwall.com/lists/oss-security/2024/06/17/2","https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d","https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524","https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e","https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286","https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa","https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab","https://github.com/python/cpython/issues/114572","https://github.com/python/cpython/pull/114573","https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20250411-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0397","description":"A defect was discovered in the Python “ssl” module where there is a memory\nrace condition with the ssl.SSLContext methods “cert_store_stats()” and\n“get_ca_certs()”. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-0397","versionConstraint":"< 3.10.12-1~22.04.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-0397","fix":{"state":"fixed","versions":["3.10.12-1~22.04.5"],"available":[{"date":"2024-07-30","kind":"advisory","version":"3.10.12-1~22.04.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-11-02","epss":0.0081,"percentile":0.56931}],"risk":0.40499999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-0397"},"relatedVulnerabilities":[{"id":"CVE-2024-0397","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-11-02","epss":0.0081,"percentile":0.56931}],"urls":["http://www.openwall.com/lists/oss-security/2024/06/17/2","https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d","https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524","https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e","https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286","https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa","https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab","https://github.com/python/cpython/issues/114572","https://github.com/python/cpython/pull/114573","https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20250411-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0397","description":"A defect was discovered in the Python “ssl” module where there is a memory\nrace condition with the ssl.SSLContext methods “cert_store_stats()” and\n“get_ca_certs()”. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-0397","versionConstraint":"< 3.10.12-1~22.04.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-0397","fix":{"state":"fixed","versions":["3.10.12-1~22.04.5"],"available":[{"date":"2024-07-30","kind":"advisory","version":"3.10.12-1~22.04.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-11-02","epss":0.0081,"percentile":0.56931}],"risk":0.40499999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-0397"},"relatedVulnerabilities":[{"id":"CVE-2024-0397","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-11-02","epss":0.0081,"percentile":0.56931}],"urls":["http://www.openwall.com/lists/oss-security/2024/06/17/2","https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d","https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524","https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e","https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286","https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa","https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab","https://github.com/python/cpython/issues/114572","https://github.com/python/cpython/pull/114573","https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20250411-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0397","description":"A defect was discovered in the Python “ssl” module where there is a memory\nrace condition with the ssl.SSLContext methods “cert_store_stats()” and\n“get_ca_certs()”. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-0397","versionConstraint":"< 3.10.12-1~22.04.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-0397","fix":{"state":"fixed","versions":["3.10.12-1~22.04.5"],"available":[{"date":"2024-07-30","kind":"advisory","version":"3.10.12-1~22.04.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-11-02","epss":0.0081,"percentile":0.56931}],"risk":0.40499999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-0397"},"relatedVulnerabilities":[{"id":"CVE-2024-0397","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-11-02","epss":0.0081,"percentile":0.56931}],"urls":["http://www.openwall.com/lists/oss-security/2024/06/17/2","https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d","https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524","https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e","https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286","https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa","https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab","https://github.com/python/cpython/issues/114572","https://github.com/python/cpython/pull/114573","https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20250411-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0397","description":"A defect was discovered in the Python “ssl” module where there is a memory\nrace condition with the ssl.SSLContext methods “cert_store_stats()” and\n“get_ca_certs()”. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5."}]},{"artifact":{"id":"8714e648b2fbdcd7","cpes":["cpe:2.3:a:libnghttp2-14:libnghttp2-14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2-14:libnghttp2_14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2_14:libnghttp2-14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2_14:libnghttp2_14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2:libnghttp2-14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2:libnghttp2_14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*"],"name":"libnghttp2-14","purl":"pkg:deb/ubuntu/libnghttp2-14@1.43.0-1ubuntu0.1?arch=amd64&distro=ubuntu-22.04&upstream=nghttp2","type":"deb","version":"1.43.0-1ubuntu0.1","language":"","licenses":["BSD-2-clause","Expat","GPL-3","GPL-3+","MIT","SIL-OFL-1.1","all-permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnghttp2-14/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libnghttp2-14/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnghttp2-14:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libnghttp2-14:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nghttp2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.43.0-1ubuntu0.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27135","versionConstraint":"< 1.43.0-1ubuntu0.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nghttp2","version":"1.43.0-1ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-27135","fix":{"state":"fixed","versions":["1.43.0-1ubuntu0.3"],"available":[{"date":"2026-05-05","kind":"advisory","version":"1.43.0-1ubuntu0.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-27135","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27135","cwe":"CWE-617","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27135","date":"2026-11-02","epss":0.00805,"percentile":0.56771}],"risk":0.40249999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-27135"},"relatedVulnerabilities":[{"id":"CVE-2026-27135","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27135","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27135","cwe":"CWE-617","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27135","date":"2026-11-02","epss":0.00805,"percentile":0.56771}],"urls":["https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1","https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6","http://www.openwall.com/lists/oss-security/2026/03/20/3","https://lists.debian.org/debian-lts-announce/2026/05/msg00025.html","https://access.redhat.com/errata/RHSA-2026:10065","https://access.redhat.com/errata/RHSA-2026:11768","https://access.redhat.com/errata/RHSA-2026:13812","https://access.redhat.com/errata/RHSA-2026:14773","https://access.redhat.com/errata/RHSA-2026:14937","https://access.redhat.com/errata/RHSA-2026:15087","https://access.redhat.com/errata/RHSA-2026:16008","https://access.redhat.com/errata/RHSA-2026:16009","https://access.redhat.com/errata/RHSA-2026:16030","https://access.redhat.com/errata/RHSA-2026:16174","https://access.redhat.com/errata/RHSA-2026:17596","https://access.redhat.com/errata/RHSA-2026:19724","https://access.redhat.com/errata/RHSA-2026:19725","https://access.redhat.com/errata/RHSA-2026:20040","https://access.redhat.com/errata/RHSA-2026:20087","https://access.redhat.com/errata/RHSA-2026:21656","https://access.redhat.com/errata/RHSA-2026:21690","https://access.redhat.com/errata/RHSA-2026:21695","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:27200","https://access.redhat.com/errata/RHSA-2026:27201","https://access.redhat.com/errata/RHSA-2026:6190","https://access.redhat.com/errata/RHSA-2026:7080","https://access.redhat.com/errata/RHSA-2026:7123","https://access.redhat.com/errata/RHSA-2026:7302","https://access.redhat.com/errata/RHSA-2026:7310","https://access.redhat.com/errata/RHSA-2026:7350","https://access.redhat.com/errata/RHSA-2026:7666","https://access.redhat.com/errata/RHSA-2026:7667","https://access.redhat.com/errata/RHSA-2026:7668","https://access.redhat.com/errata/RHSA-2026:7670","https://access.redhat.com/errata/RHSA-2026:7675","https://access.redhat.com/errata/RHSA-2026:7896","https://access.redhat.com/errata/RHSA-2026:7983","https://access.redhat.com/errata/RHSA-2026:8339","https://access.redhat.com/errata/RHSA-2026:8538","https://access.redhat.com/errata/RHSA-2026:8539","https://access.redhat.com/errata/RHSA-2026:8540","https://access.redhat.com/errata/RHSA-2026:8541","https://access.redhat.com/errata/RHSA-2026:8545","https://access.redhat.com/errata/RHSA-2026:8546","https://access.redhat.com/errata/RHSA-2026:8547","https://access.redhat.com/errata/RHSA-2026:8548","https://access.redhat.com/errata/RHSA-2026:8868","https://access.redhat.com/errata/RHSA-2026:9711","https://access.redhat.com/errata/RHSA-2026:9832","https://access.redhat.com/errata/RHSA-2026:9874","https://access.redhat.com/security/cve/CVE-2026-27135","https://bugzilla.redhat.com/show_bug.cgi?id=2448754","https://cert-portal.siemens.com/productcert/html/ssa-019113.html","https://cert-portal.siemens.com/productcert/html/ssa-457936.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27135.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27135","description":"nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available."}]},{"artifact":{"id":"842dbc9fb51686ce","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.4:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.4?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.4","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3832","versionConstraint":"< 3.7.3-4ubuntu1.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.4"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-3832","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.9"],"available":[{"date":"2026-05-20","kind":"advisory","version":"3.7.3-4ubuntu1.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-3832","cwe":"CWE-179","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3832","date":"2026-11-02","epss":0.00804,"percentile":0.56743}],"risk":0.402,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3832"},"relatedVulnerabilities":[{"id":"CVE-2026-3832","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3832","cwe":"CWE-179","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3832","date":"2026-11-02","epss":0.00804,"percentile":0.56743}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-3832","https://bugzilla.redhat.com/show_bug.cgi?id=2445762","https://gitlab.com/gnutls/gnutls/-/issues/1801"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3832","description":"A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12084","versionConstraint":"< 3.10.12-1~22.04.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-12084","fix":{"state":"fixed","versions":["3.10.12-1~22.04.14"],"available":[{"date":"2026-02-05","kind":"advisory","version":"3.10.12-1~22.04.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-11-02","epss":0.00799,"percentile":0.56543}],"risk":0.3995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12084"},"relatedVulnerabilities":[{"id":"CVE-2025-12084","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-11-02","epss":0.00799,"percentile":0.56543}],"urls":["https://github.com/python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0","https://github.com/python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4","https://github.com/python/cpython/commit/27648a1818749ef44c420afe6173af6868715437","https://github.com/python/cpython/commit/41f468786762348960486c166833a218a0a436af","https://github.com/python/cpython/commit/57937a8e5e293f0dcba5115f7b7a11b1e0c9a273","https://github.com/python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907","https://github.com/python/cpython/commit/9c9dda6625a2a90d2a06c657eee021d6be19842d","https://github.com/python/cpython/commit/a46c10ec9d4050ab67b8a932e0859a2ea60c3cb8","https://github.com/python/cpython/commit/a696ba8b4d42fd632afc9bc88ad830a2e4cceed8","https://github.com/python/cpython/commit/c97e87593063d84a2bd9fe7068b30eb44de23dc0","https://github.com/python/cpython/commit/ddcd2acd85d891a53e281c773b3093f9db953964","https://github.com/python/cpython/commit/e91c11449cad34bac3ea55ee09ca557691d92b53","https://github.com/python/cpython/issues/142145","https://github.com/python/cpython/pull/142146"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12084","description":"When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12084","versionConstraint":"< 3.10.12-1~22.04.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-12084","fix":{"state":"fixed","versions":["3.10.12-1~22.04.14"],"available":[{"date":"2026-02-05","kind":"advisory","version":"3.10.12-1~22.04.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-11-02","epss":0.00799,"percentile":0.56543}],"risk":0.3995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12084"},"relatedVulnerabilities":[{"id":"CVE-2025-12084","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-11-02","epss":0.00799,"percentile":0.56543}],"urls":["https://github.com/python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0","https://github.com/python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4","https://github.com/python/cpython/commit/27648a1818749ef44c420afe6173af6868715437","https://github.com/python/cpython/commit/41f468786762348960486c166833a218a0a436af","https://github.com/python/cpython/commit/57937a8e5e293f0dcba5115f7b7a11b1e0c9a273","https://github.com/python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907","https://github.com/python/cpython/commit/9c9dda6625a2a90d2a06c657eee021d6be19842d","https://github.com/python/cpython/commit/a46c10ec9d4050ab67b8a932e0859a2ea60c3cb8","https://github.com/python/cpython/commit/a696ba8b4d42fd632afc9bc88ad830a2e4cceed8","https://github.com/python/cpython/commit/c97e87593063d84a2bd9fe7068b30eb44de23dc0","https://github.com/python/cpython/commit/ddcd2acd85d891a53e281c773b3093f9db953964","https://github.com/python/cpython/commit/e91c11449cad34bac3ea55ee09ca557691d92b53","https://github.com/python/cpython/issues/142145","https://github.com/python/cpython/pull/142146"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12084","description":"When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-12084","versionConstraint":"< 3.10.12-1~22.04.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-12084","fix":{"state":"fixed","versions":["3.10.12-1~22.04.14"],"available":[{"date":"2026-02-05","kind":"advisory","version":"3.10.12-1~22.04.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-11-02","epss":0.00799,"percentile":0.56543}],"risk":0.3995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12084"},"relatedVulnerabilities":[{"id":"CVE-2025-12084","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-11-02","epss":0.00799,"percentile":0.56543}],"urls":["https://github.com/python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0","https://github.com/python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4","https://github.com/python/cpython/commit/27648a1818749ef44c420afe6173af6868715437","https://github.com/python/cpython/commit/41f468786762348960486c166833a218a0a436af","https://github.com/python/cpython/commit/57937a8e5e293f0dcba5115f7b7a11b1e0c9a273","https://github.com/python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907","https://github.com/python/cpython/commit/9c9dda6625a2a90d2a06c657eee021d6be19842d","https://github.com/python/cpython/commit/a46c10ec9d4050ab67b8a932e0859a2ea60c3cb8","https://github.com/python/cpython/commit/a696ba8b4d42fd632afc9bc88ad830a2e4cceed8","https://github.com/python/cpython/commit/c97e87593063d84a2bd9fe7068b30eb44de23dc0","https://github.com/python/cpython/commit/ddcd2acd85d891a53e281c773b3093f9db953964","https://github.com/python/cpython/commit/e91c11449cad34bac3ea55ee09ca557691d92b53","https://github.com/python/cpython/issues/142145","https://github.com/python/cpython/pull/142146"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12084","description":"When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12084","versionConstraint":"< 3.10.12-1~22.04.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-12084","fix":{"state":"fixed","versions":["3.10.12-1~22.04.14"],"available":[{"date":"2026-02-05","kind":"advisory","version":"3.10.12-1~22.04.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-11-02","epss":0.00799,"percentile":0.56543}],"risk":0.3995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12084"},"relatedVulnerabilities":[{"id":"CVE-2025-12084","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-11-02","epss":0.00799,"percentile":0.56543}],"urls":["https://github.com/python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0","https://github.com/python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4","https://github.com/python/cpython/commit/27648a1818749ef44c420afe6173af6868715437","https://github.com/python/cpython/commit/41f468786762348960486c166833a218a0a436af","https://github.com/python/cpython/commit/57937a8e5e293f0dcba5115f7b7a11b1e0c9a273","https://github.com/python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907","https://github.com/python/cpython/commit/9c9dda6625a2a90d2a06c657eee021d6be19842d","https://github.com/python/cpython/commit/a46c10ec9d4050ab67b8a932e0859a2ea60c3cb8","https://github.com/python/cpython/commit/a696ba8b4d42fd632afc9bc88ad830a2e4cceed8","https://github.com/python/cpython/commit/c97e87593063d84a2bd9fe7068b30eb44de23dc0","https://github.com/python/cpython/commit/ddcd2acd85d891a53e281c773b3093f9db953964","https://github.com/python/cpython/commit/e91c11449cad34bac3ea55ee09ca557691d92b53","https://github.com/python/cpython/issues/142145","https://github.com/python/cpython/pull/142146"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12084","description":"When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents."}]},{"artifact":{"id":"dd3ad14efa4e20df","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.12.7:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.12.7","type":"java-archive","version":"2.12.7","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.12.7"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"bf339193a9b89a74","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.13.4:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4","type":"java-archive","version":"2.13.4","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.13.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"1f24ff152d9d512b","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.13.4:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4","type":"java-archive","version":"2.13.4","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar:META-INF/lib/jackson-core-2.13.4.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"0cf934c681294b97ef6d80082faeefbe1edadf56","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar:META-INF/lib/jackson-core-2.13.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.13.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"7c53929246646eb2","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.13.4:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4","type":"java-archive","version":"2.13.4","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.13.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"d5dad70ff1dc3167","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/opensearch/lib/tools/upgrade-cli/jackson-core-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"f804090e6399ce0cf78242db086017512dd71fcc","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/lib/tools/upgrade-cli/jackson-core-2.14.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/lib/tools/upgrade-cli/jackson-core-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"28e056c063a8cae2","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/opensearch/lib/jackson-core-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"f804090e6399ce0cf78242db086017512dd71fcc","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/lib/jackson-core-2.14.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/lib/jackson-core-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"c2bb7ab35650cdc1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-remote-event-common-plugin-7.0.1.jar:META-INF/lib/jackson-core-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"f804090e6399ce0cf78242db086017512dd71fcc","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-remote-event-common-plugin-7.0.1.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-remote-event-common-plugin-7.0.1.jar:META-INF/lib/jackson-core-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"349bca0b17d723cc","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/signalfx-java-1.0.36.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/signalfx-java-1.0.36.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"1479a57a02318dd8","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/applinks-plugin-9.2.0.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/applinks-plugin-9.2.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/applinks-plugin-9.2.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"77534c1a8447a627","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-plugin-2.4.3.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-plugin-2.4.3.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-plugin-2.4.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"9c185ac7f05e47cf","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/jackson-core-2.15.3.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"60d600567c1862840397bf9ff5a92398edc5797b","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/jackson-core-2.15.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"4a2b87695d4431ef","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.16.1:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.1","type":"java-archive","version":"2.16.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-search-8.18.0.jar:META-INF/lib/jackson-core-2.16.1.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"9456bb3cdd0f79f91a5f730a1b1bb041a380c91f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-search-8.18.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-search-8.18.0.jar:META-INF/lib/jackson-core-2.16.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.16.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"8fd410251e4f9e0a","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.16.1:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.1","type":"java-archive","version":"2.16.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/jackson-core-2.16.1.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"9456bb3cdd0f79f91a5f730a1b1bb041a380c91f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/jackson-core-2.16.1.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/jackson-core-2.16.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.16.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"7ddef62d4838b990","cpes":["cpe:2.3:a:binutils:binutils:2.38-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/ubuntu/binutils@2.38-4ubuntu2.5?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"2.38-4ubuntu2.5","language":"","licenses":["sha256:677c595f0afa160e1021627e7dcdcd1eb1741963b58d6cdf706eb3bacf9a9297"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/binutils.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.38-4ubuntu2.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-1178","versionConstraint":"< 2.38-4ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"binutils","version":"2.38-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-1178","fix":{"state":"fixed","versions":["2.38-4ubuntu2.8"],"available":[{"date":"2025-04-07","kind":"advisory","version":"2.38-4ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-1178","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1178","date":"2026-11-02","epss":0.00797,"percentile":0.5648}],"risk":0.39849999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1178"},"relatedVulnerabilities":[{"id":"CVE-2025-1178","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1178","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1178","date":"2026-11-02","epss":0.00797,"percentile":0.5648}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15914","https://sourceware.org/bugzilla/show_bug.cgi?id=32638","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=75086e9de1707281172cc77f178e7949a4414ed0","https://vuldb.com/?ctiid.295081","https://vuldb.com/?id.295081","https://vuldb.com/?submit.495369","https://www.gnu.org/","https://security.netapp.com/advisory/ntap-20250411-0008/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1178","description":"A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is the function bfd_putl64 of the file libbfd.c of the component ld. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 75086e9de1707281172cc77f178e7949a4414ed0. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"0b306f675dd49cda","cpes":["cpe:2.3:a:binutils-common:binutils-common:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-common:binutils_common:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_common:binutils-common:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_common:binutils_common:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils:binutils-common:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils:binutils_common:2.38-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"binutils-common","purl":"pkg:deb/ubuntu/binutils-common@2.38-4ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=binutils","type":"deb","version":"2.38-4ubuntu2.5","language":"","licenses":["sha256:677c595f0afa160e1021627e7dcdcd1eb1741963b58d6cdf706eb3bacf9a9297"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils-common/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/binutils-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils-common:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/binutils-common:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"binutils"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.38-4ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1178","versionConstraint":"< 2.38-4ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"binutils","version":"2.38-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-1178","fix":{"state":"fixed","versions":["2.38-4ubuntu2.8"],"available":[{"date":"2025-04-07","kind":"advisory","version":"2.38-4ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-1178","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1178","date":"2026-11-02","epss":0.00797,"percentile":0.5648}],"risk":0.39849999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1178"},"relatedVulnerabilities":[{"id":"CVE-2025-1178","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1178","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1178","date":"2026-11-02","epss":0.00797,"percentile":0.5648}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15914","https://sourceware.org/bugzilla/show_bug.cgi?id=32638","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=75086e9de1707281172cc77f178e7949a4414ed0","https://vuldb.com/?ctiid.295081","https://vuldb.com/?id.295081","https://vuldb.com/?submit.495369","https://www.gnu.org/","https://security.netapp.com/advisory/ntap-20250411-0008/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1178","description":"A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is the function bfd_putl64 of the file libbfd.c of the component ld. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 75086e9de1707281172cc77f178e7949a4414ed0. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"429e3b6c0ca6ddcd","cpes":["cpe:2.3:a:binutils-x86-64-linux-gnu:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86-64-linux-gnu:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86_64_linux_gnu:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86_64_linux_gnu:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86-64-linux:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86-64-linux:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86_64_linux:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86_64_linux:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86-64:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86-64:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86_64:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86_64:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils-x86:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils_x86:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils:binutils-x86-64-linux-gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:binutils:binutils_x86_64_linux_gnu:2.38-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"binutils-x86-64-linux-gnu","purl":"pkg:deb/ubuntu/binutils-x86-64-linux-gnu@2.38-4ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=binutils","type":"deb","version":"2.38-4ubuntu2.5","language":"","licenses":["sha256:677c595f0afa160e1021627e7dcdcd1eb1741963b58d6cdf706eb3bacf9a9297"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils-common/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/binutils-x86-64-linux-gnu/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils-x86-64-linux-gnu.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/binutils-x86-64-linux-gnu.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils-x86-64-linux-gnu.list","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/binutils-x86-64-linux-gnu.list"}],"upstreams":[{"name":"binutils"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.38-4ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1178","versionConstraint":"< 2.38-4ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"binutils","version":"2.38-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-1178","fix":{"state":"fixed","versions":["2.38-4ubuntu2.8"],"available":[{"date":"2025-04-07","kind":"advisory","version":"2.38-4ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-1178","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1178","date":"2026-11-02","epss":0.00797,"percentile":0.5648}],"risk":0.39849999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1178"},"relatedVulnerabilities":[{"id":"CVE-2025-1178","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1178","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1178","date":"2026-11-02","epss":0.00797,"percentile":0.5648}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15914","https://sourceware.org/bugzilla/show_bug.cgi?id=32638","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=75086e9de1707281172cc77f178e7949a4414ed0","https://vuldb.com/?ctiid.295081","https://vuldb.com/?id.295081","https://vuldb.com/?submit.495369","https://www.gnu.org/","https://security.netapp.com/advisory/ntap-20250411-0008/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1178","description":"A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is the function bfd_putl64 of the file libbfd.c of the component ld. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 75086e9de1707281172cc77f178e7949a4414ed0. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"0e2fd27b95a08338","cpes":["cpe:2.3:a:libbinutils:libbinutils:2.38-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libbinutils","purl":"pkg:deb/ubuntu/libbinutils@2.38-4ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=binutils","type":"deb","version":"2.38-4ubuntu2.5","language":"","licenses":["sha256:677c595f0afa160e1021627e7dcdcd1eb1741963b58d6cdf706eb3bacf9a9297"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils-common/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libbinutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbinutils:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libbinutils:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"binutils"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.38-4ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1178","versionConstraint":"< 2.38-4ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"binutils","version":"2.38-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-1178","fix":{"state":"fixed","versions":["2.38-4ubuntu2.8"],"available":[{"date":"2025-04-07","kind":"advisory","version":"2.38-4ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-1178","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1178","date":"2026-11-02","epss":0.00797,"percentile":0.5648}],"risk":0.39849999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1178"},"relatedVulnerabilities":[{"id":"CVE-2025-1178","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1178","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1178","date":"2026-11-02","epss":0.00797,"percentile":0.5648}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15914","https://sourceware.org/bugzilla/show_bug.cgi?id=32638","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=75086e9de1707281172cc77f178e7949a4414ed0","https://vuldb.com/?ctiid.295081","https://vuldb.com/?id.295081","https://vuldb.com/?submit.495369","https://www.gnu.org/","https://security.netapp.com/advisory/ntap-20250411-0008/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1178","description":"A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is the function bfd_putl64 of the file libbfd.c of the component ld. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 75086e9de1707281172cc77f178e7949a4414ed0. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"d1ba13dc069671f5","cpes":["cpe:2.3:a:libctf-nobfd0:libctf-nobfd0:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libctf-nobfd0:libctf_nobfd0:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libctf_nobfd0:libctf-nobfd0:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libctf_nobfd0:libctf_nobfd0:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libctf:libctf-nobfd0:2.38-4ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libctf:libctf_nobfd0:2.38-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libctf-nobfd0","purl":"pkg:deb/ubuntu/libctf-nobfd0@2.38-4ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=binutils","type":"deb","version":"2.38-4ubuntu2.5","language":"","licenses":["sha256:677c595f0afa160e1021627e7dcdcd1eb1741963b58d6cdf706eb3bacf9a9297"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libctf-nobfd0/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libctf-nobfd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libctf-nobfd0:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libctf-nobfd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"binutils"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.38-4ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1178","versionConstraint":"< 2.38-4ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"binutils","version":"2.38-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-1178","fix":{"state":"fixed","versions":["2.38-4ubuntu2.8"],"available":[{"date":"2025-04-07","kind":"advisory","version":"2.38-4ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-1178","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1178","date":"2026-11-02","epss":0.00797,"percentile":0.5648}],"risk":0.39849999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1178"},"relatedVulnerabilities":[{"id":"CVE-2025-1178","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1178","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1178","date":"2026-11-02","epss":0.00797,"percentile":0.5648}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15914","https://sourceware.org/bugzilla/show_bug.cgi?id=32638","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=75086e9de1707281172cc77f178e7949a4414ed0","https://vuldb.com/?ctiid.295081","https://vuldb.com/?id.295081","https://vuldb.com/?submit.495369","https://www.gnu.org/","https://security.netapp.com/advisory/ntap-20250411-0008/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1178","description":"A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is the function bfd_putl64 of the file libbfd.c of the component ld. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 75086e9de1707281172cc77f178e7949a4414ed0. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"1f1bf67e128b3351","cpes":["cpe:2.3:a:libctf0:libctf0:2.38-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libctf0","purl":"pkg:deb/ubuntu/libctf0@2.38-4ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=binutils","type":"deb","version":"2.38-4ubuntu2.5","language":"","licenses":["sha256:677c595f0afa160e1021627e7dcdcd1eb1741963b58d6cdf706eb3bacf9a9297"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils-common/copyright","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/usr/share/doc/libctf0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libctf0:amd64.md5sums","layerID":"sha256:ab995379f7a6002e58a65bcfcb21060cf124c01e603f8b84a26ddbf5222ebf12","accessPath":"/var/lib/dpkg/info/libctf0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"binutils"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.38-4ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1178","versionConstraint":"< 2.38-4ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"binutils","version":"2.38-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-1178","fix":{"state":"fixed","versions":["2.38-4ubuntu2.8"],"available":[{"date":"2025-04-07","kind":"advisory","version":"2.38-4ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-1178","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1178","date":"2026-11-02","epss":0.00797,"percentile":0.5648}],"risk":0.39849999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1178"},"relatedVulnerabilities":[{"id":"CVE-2025-1178","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1178","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1178","date":"2026-11-02","epss":0.00797,"percentile":0.5648}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15914","https://sourceware.org/bugzilla/show_bug.cgi?id=32638","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=75086e9de1707281172cc77f178e7949a4414ed0","https://vuldb.com/?ctiid.295081","https://vuldb.com/?id.295081","https://vuldb.com/?submit.495369","https://www.gnu.org/","https://security.netapp.com/advisory/ntap-20250411-0008/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1178","description":"A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is the function bfd_putl64 of the file libbfd.c of the component ld. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 75086e9de1707281172cc77f178e7949a4414ed0. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"b7b3356925d8b3a0","cpes":["cpe:2.3:a:bouncycastle-org:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bc_fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc_fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc_fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc_fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc_fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc_fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc_fips:1.0.2.4:*:*:*:*:*:*:*"],"name":"bc-fips","purl":"pkg:maven/org.bouncycastle/bc-fips@1.0.2.4","type":"java-archive","version":"1.0.2.4","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/atlassian/bitbucket/opensearch/lib/tools/plugin-cli/bc-fips-1.0.2.4.jar","manifestName":"","pomArtifactID":"bc-fips","archiveDigests":[{"value":"9008d04fc13da6455e6a792935b93b629757335d","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/lib/tools/plugin-cli/bc-fips-1.0.2.4.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/lib/tools/plugin-cli/bc-fips-1.0.2.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.0.2.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9pwp-9qqc-pr26","versionConstraint":"<1.0.2.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bc-fips","version":"1.0.2.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9pwp-9qqc-pr26","fix":{"state":"fixed","versions":["1.0.2.7"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.0.2.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-11-02","epss":0.0043,"percentile":0.37242}],"risk":0.3913,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8763","https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE-2026-8763","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763","https://github.com/bcgit/bc-java/releases/tag/r1rv85v2"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9pwp-9qqc-pr26","description":"Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI"},"relatedVulnerabilities":[{"id":"CVE-2026-8763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-11-02","epss":0.0043,"percentile":0.37242}],"urls":["https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8763","description":"In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"c1e86990bac3051c","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.75","type":"java-archive","version":"1.75","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"df22e1b6a9f6b218913f5b68dd16641344397fe0","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9pwp-9qqc-pr26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.75"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9pwp-9qqc-pr26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-11-02","epss":0.0043,"percentile":0.37242}],"risk":0.3913,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8763","https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE-2026-8763","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763","https://github.com/bcgit/bc-java/releases/tag/r1rv85v2"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9pwp-9qqc-pr26","description":"Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI"},"relatedVulnerabilities":[{"id":"CVE-2026-8763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-11-02","epss":0.0043,"percentile":0.37242}],"urls":["https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8763","description":"In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"fa5d59af15dd3ec9","cpes":["cpe:2.3:a:org.bouncycastle:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-lts8on:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-lts8on:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_lts8on:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_lts8on:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*"],"name":"bcprov-lts8on","purl":"pkg:maven/org.bouncycastle/bcprov-lts8on@2.73.3","type":"java-archive","version":"2.73.3","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/bcprov-lts8on-2.73.3.jar","manifestName":"","pomArtifactID":"bcprov-lts8on","archiveDigests":[{"value":"124e14ab29a240cd074d4e15ee55c360edd0e1d0","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/bcprov-lts8on-2.73.3.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/bcprov-lts8on-2.73.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.73.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9pwp-9qqc-pr26","versionConstraint":"<2.73.12 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-lts8on","version":"2.73.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9pwp-9qqc-pr26","fix":{"state":"fixed","versions":["2.73.12"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"2.73.12"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-11-02","epss":0.0043,"percentile":0.37242}],"risk":0.3913,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8763","https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE-2026-8763","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763","https://github.com/bcgit/bc-java/releases/tag/r1rv85v2"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9pwp-9qqc-pr26","description":"Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI"},"relatedVulnerabilities":[{"id":"CVE-2026-8763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-11-02","epss":0.0043,"percentile":0.37242}],"urls":["https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8763","description":"In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"24e80c3d7117a69a","cpes":["cpe:2.3:a:org.bouncycastle:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-lts8on:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-lts8on:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_lts8on:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_lts8on:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*"],"name":"bcprov-lts8on","purl":"pkg:maven/org.bouncycastle/bcprov-lts8on@2.73.3","type":"java-archive","version":"2.73.3","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/bcprov-lts8on-2.73.3.jar","manifestName":"","pomArtifactID":"bcprov-lts8on","archiveDigests":[{"value":"124e14ab29a240cd074d4e15ee55c360edd0e1d0","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/bcprov-lts8on-2.73.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.73.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9pwp-9qqc-pr26","versionConstraint":"<2.73.12 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-lts8on","version":"2.73.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9pwp-9qqc-pr26","fix":{"state":"fixed","versions":["2.73.12"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"2.73.12"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-11-02","epss":0.0043,"percentile":0.37242}],"risk":0.3913,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8763","https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE-2026-8763","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763","https://github.com/bcgit/bc-java/releases/tag/r1rv85v2"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9pwp-9qqc-pr26","description":"Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI"},"relatedVulnerabilities":[{"id":"CVE-2026-8763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-11-02","epss":0.0043,"percentile":0.37242}],"urls":["https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8763","description":"In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"3a060baa137f74ea","cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@17.0.10%2B7?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk17u.git","type":"binary","version":"17.0.10+7","language":"","licenses":[],"metadata":{"release":{"fullVersion":"17.0.10+7","javaVersion":"17.0.10","semanticVersion":"17.0.10+7","javaRuntimeVersion":"17.0.10+7"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:8b8fefae6897ed4bfb12e519d4bdcaca9564779609395dcc3238ea1d369600aa","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"17.0.18"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-21932","versionConstraint":"< 1.8.0_482||>= 1.9, < 8.0.482||>= 12, < 17.0.18||>= 18, < 21.0.10||>= 22, < 25.0.2||>= 9, < 11.0.30 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"17.0.10+7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-21932","fix":{"state":"fixed","versions":["1.8.0_482","8.0.482","11.0.30","17.0.18","21.0.10","25.0.2"],"available":[{"date":"2026-01-27","kind":"first-observed","version":"1.8.0_482"},{"date":"2026-01-27","kind":"first-observed","version":"8.0.482"},{"date":"2026-01-27","kind":"first-observed","version":"17.0.18"},{"date":"2026-01-27","kind":"first-observed","version":"21.0.10"},{"date":"2026-01-27","kind":"first-observed","version":"25.0.2"},{"date":"2026-01-27","kind":"first-observed","version":"11.0.30"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21932","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-21932","date":"2026-11-02","epss":0.00525,"percentile":0.4453}],"risk":0.391125,"urls":["https://www.oracle.com/security-alerts/cpujan2026.html","https://access.redhat.com/errata/RHSA-2026:0849","https://access.redhat.com/errata/RHSA-2026:0896","https://access.redhat.com/errata/RHSA-2026:0898","https://access.redhat.com/errata/RHSA-2026:0900","https://access.redhat.com/errata/RHSA-2026:1606","https://access.redhat.com/security/cve/CVE-2026-21932","https://bugzilla.redhat.com/show_bug.cgi?id=2429925","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21932.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21932","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX).  Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and  21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"76093a39750fc559","cpes":["cpe:2.3:a:com.hazelcast.osgi.impl.Activator:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast\\,-inc-:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast\\,_inc_:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:com.hazelcast:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:Activator:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:impl:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:osgi:hazelcast:5.2.2:*:*:*:*:*:*:*"],"name":"hazelcast","purl":"pkg:maven/com.hazelcast/hazelcast@5.2.2","type":"java-archive","version":"5.2.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.hazelcast","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar","manifestName":"","pomArtifactID":"hazelcast","archiveDigests":[{"value":"2467e0dc93a2cc4c911ca1b95913384bf891b95d","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.2.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xh6m-7cr7-xx66","versionConstraint":">=5.2.0,<=5.2.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.hazelcast:hazelcast","version":"5.2.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xh6m-7cr7-xx66","fix":{"state":"fixed","versions":["5.2.5"],"available":[{"date":"2024-02-28","kind":"first-observed","version":"5.2.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45859","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-45859","date":"2026-11-02","epss":0.00518,"percentile":0.44061}],"risk":0.39109,"urls":["https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66","https://nvd.nist.gov/vuln/detail/CVE-2023-45859","https://github.com/hazelcast/hazelcast/pull/25509"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xh6m-7cr7-xx66","description":"Missing permission checks on Hazelcast client protocol"},"relatedVulnerabilities":[{"id":"CVE-2023-45859","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45859","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-45859","date":"2026-11-02","epss":0.00518,"percentile":0.44061}],"urls":["https://github.com/hazelcast/hazelcast/pull/25509","https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45859","description":"In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster."}]},{"artifact":{"id":"eaaf707db378cc79","cpes":["cpe:2.3:a:apache:cxf-core:3.5.5:*:*:*:*:*:*:*","cpe:2.3:a:apache:cxf_core:3.5.5:*:*:*:*:*:*:*","cpe:2.3:a:apache:cxf:3.5.5:*:*:*:*:*:*:*"],"name":"cxf-core","purl":"pkg:maven/org.apache.cxf/cxf-core@3.5.5","type":"java-archive","version":"3.5.5","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.cxf","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/cxf-core-3.5.5.jar","manifestName":"","pomArtifactID":"cxf-core","archiveDigests":[{"value":"6920f145ab2e1b4a539da1658dcd26385b73564b","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/cxf-core-3.5.5.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/cxf-core-3.5.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-36wv-v2qp-v4g4","versionConstraint":"<3.5.11 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.cxf:cxf-core","version":"3.5.5"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-36wv-v2qp-v4g4","fix":{"state":"fixed","versions":["3.5.11"],"available":[{"date":"2025-07-17","kind":"first-observed","version":"3.5.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48795","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48795","date":"2026-11-02","epss":0.00735,"percentile":0.5444}],"risk":0.38955,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48795","https://lists.apache.org/thread/vo5qv02mvv5plmb6z2xf1ktjmrpv3jmn","https://github.com/apache/cxf/pull/2258","https://github.com/apache/cxf/commit/1c1d687f8e295f433a3592a3bc0b0a63c432bfde","http://www.openwall.com/lists/oss-security/2025/07/15/3"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-36wv-v2qp-v4g4","description":"Apache CXF is vulnerable to DoS attacks as entire files are read into memory and logged"},"relatedVulnerabilities":[{"id":"CVE-2025-48795","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48795","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48795","date":"2026-11-02","epss":0.00735,"percentile":0.5444}],"urls":["https://lists.apache.org/thread/vo5qv02mvv5plmb6z2xf1ktjmrpv3jmn","http://www.openwall.com/lists/oss-security/2025/07/15/3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48795","description":"Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was introduced which means that the entire temporary file is read into memory and then logged. An attacker might be able to exploit this to cause a denial of service attack by causing an out of memory exception. In addition, it is possible to configure CXF to encrypt temporary files to prevent sensitive credentials from being cached unencrypted on the local filesystem, however this bug means that the cached files are written out to logs unencrypted.\n\nUsers are recommended to upgrade to versions 3.5.11, 3.6.6, 4.0.7 or 4.1.1, which fixes this issue."}]},{"artifact":{"id":"76093a39750fc559","cpes":["cpe:2.3:a:com.hazelcast.osgi.impl.Activator:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast\\,-inc-:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast\\,_inc_:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:com.hazelcast:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:Activator:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:impl:hazelcast:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:osgi:hazelcast:5.2.2:*:*:*:*:*:*:*"],"name":"hazelcast","purl":"pkg:maven/com.hazelcast/hazelcast@5.2.2","type":"java-archive","version":"5.2.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.hazelcast","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar","manifestName":"","pomArtifactID":"hazelcast","archiveDigests":[{"value":"2467e0dc93a2cc4c911ca1b95913384bf891b95d","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/hazelcast-5.2.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.2.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8h4x-xvjp-vf99","versionConstraint":">=5.2.0,<=5.2.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.hazelcast:hazelcast","version":"5.2.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-8h4x-xvjp-vf99","fix":{"state":"fixed","versions":["5.2.5"],"available":[{"date":"2024-02-28","kind":"first-observed","version":"5.2.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45860","cwe":"CWE-89","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-45860","date":"2026-11-02","epss":0.00544,"percentile":0.45665}],"risk":0.38896,"urls":["https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99","https://nvd.nist.gov/vuln/detail/CVE-2023-45860","https://github.com/hazelcast/hazelcast/pull/25348","https://github.com/hazelcast/hazelcast/commit/98be233e79cf4bc1ff3c7126a9189988bd0e87bd"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8h4x-xvjp-vf99","description":"Hazelcast Platform permission checking in CSV File Source connector"},"relatedVulnerabilities":[{"id":"CVE-2023-45860","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45860","cwe":"CWE-89","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-45860","date":"2026-11-02","epss":0.00544,"percentile":0.45665}],"urls":["https://github.com/hazelcast/hazelcast/pull/25348","https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45860","description":"In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem."}]},{"artifact":{"id":"eae37dd4ad8fc905","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http2-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"cbf1a430ea44dbdedbcde16b185cbb95f28d72c7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http2-4.1.100.Final.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/netty-codec-http2-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c2gf-v879-257j","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c2gf-v879-257j","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-11","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48043","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-772","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48043","date":"2026-11-02","epss":0.00753,"percentile":0.55074}],"risk":0.387795,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j","https://nvd.nist.gov/vuln/detail/CVE-2026-48043","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/security/cve/CVE-2026-48043","https://bugzilla.redhat.com/show_bug.cgi?id=2488442","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53806","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:53645","https://github.com/netty/netty/commit/db6138b168699736a6463c367e12ad0a4c36a25e","https://github.com/netty/netty/commit/3d45a1e4e8eb99144f716e54be5ac57e525fa7ca"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c2gf-v879-257j","description":"netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-48043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48043","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-772","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48043","date":"2026-11-02","epss":0.00753,"percentile":0.55074}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-48043","https://bugzilla.redhat.com/show_bug.cgi?id=2488442","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48043","description":"Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"77f4a1a56c253c3b","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c2gf-v879-257j","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c2gf-v879-257j","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-11","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48043","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-772","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48043","date":"2026-11-02","epss":0.00753,"percentile":0.55074}],"risk":0.387795,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j","https://nvd.nist.gov/vuln/detail/CVE-2026-48043","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/security/cve/CVE-2026-48043","https://bugzilla.redhat.com/show_bug.cgi?id=2488442","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53806","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:53645","https://github.com/netty/netty/commit/db6138b168699736a6463c367e12ad0a4c36a25e","https://github.com/netty/netty/commit/3d45a1e4e8eb99144f716e54be5ac57e525fa7ca"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c2gf-v879-257j","description":"netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-48043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48043","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-772","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48043","date":"2026-11-02","epss":0.00753,"percentile":0.55074}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-48043","https://bugzilla.redhat.com/show_bug.cgi?id=2488442","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48043","description":"Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"d8682c7fc9d4337d","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http2-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"cbf1a430ea44dbdedbcde16b185cbb95f28d72c7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/netty-codec-http2-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c2gf-v879-257j","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c2gf-v879-257j","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-11","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48043","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-772","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48043","date":"2026-11-02","epss":0.00753,"percentile":0.55074}],"risk":0.387795,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j","https://nvd.nist.gov/vuln/detail/CVE-2026-48043","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/security/cve/CVE-2026-48043","https://bugzilla.redhat.com/show_bug.cgi?id=2488442","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53806","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:53645","https://github.com/netty/netty/commit/db6138b168699736a6463c367e12ad0a4c36a25e","https://github.com/netty/netty/commit/3d45a1e4e8eb99144f716e54be5ac57e525fa7ca"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c2gf-v879-257j","description":"netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-48043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48043","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-772","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48043","date":"2026-11-02","epss":0.00753,"percentile":0.55074}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-48043","https://bugzilla.redhat.com/show_bug.cgi?id=2488442","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48043","description":"Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"842dbc9fb51686ce","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.4:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.4?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.4","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6395","versionConstraint":"< 3.7.3-4ubuntu1.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.4"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-6395","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.7"],"available":[{"date":"2025-07-14","kind":"advisory","version":"3.7.3-4ubuntu1.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-6395","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6395","date":"2026-11-02","epss":0.00771,"percentile":0.5566}],"risk":0.3855,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6395"},"relatedVulnerabilities":[{"id":"CVE-2025-6395","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6395","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6395","date":"2026-11-02","epss":0.00771,"percentile":0.5566}],"urls":["https://access.redhat.com/errata/RHSA-2025:16115","https://access.redhat.com/errata/RHSA-2025:16116","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:17348","https://access.redhat.com/errata/RHSA-2025:17361","https://access.redhat.com/errata/RHSA-2025:17415","https://access.redhat.com/errata/RHSA-2025:19088","https://access.redhat.com/errata/RHSA-2025:22529","https://access.redhat.com/security/cve/CVE-2025-6395","https://bugzilla.redhat.com/show_bug.cgi?id=2376755","https://gitlab.com/gnutls/gnutls/-/issues/1718","https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html","http://www.openwall.com/lists/oss-security/2025/07/11/3","https://lists.debian.org/debian-lts-announce/2025/08/msg00005.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6395","description":"A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite()."}]},{"artifact":{"id":"3a060baa137f74ea","cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@17.0.10%2B7?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk17u.git","type":"binary","version":"17.0.10+7","language":"","licenses":[],"metadata":{"release":{"fullVersion":"17.0.10+7","javaVersion":"17.0.10","semanticVersion":"17.0.10+7","javaRuntimeVersion":"17.0.10+7"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:8b8fefae6897ed4bfb12e519d4bdcaca9564779609395dcc3238ea1d369600aa","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"17.0.13"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-21217","versionConstraint":"< 1.8.0_432||>= 1.9, < 8.0.432||>= 12, < 17.0.13||>= 18, < 21.0.5||>= 22, < 23.0.1||>= 9, < 11.0.25 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:17.0.10:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"17.0.10+7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-21217","fix":{"state":"fixed","versions":["1.8.0_432","8.0.432","11.0.25","17.0.13","21.0.5","23.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_432"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.432"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.13"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.5"},{"date":"2025-09-04","kind":"first-observed","version":"23.0.1"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.25"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21217","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-21217","date":"2026-11-02","epss":0.01149,"percentile":0.66877}],"risk":0.38491499999999995,"urls":["https://www.oracle.com/security-alerts/cpuoct2024.html","https://lists.debian.org/debian-lts-announce/2024/10/msg00018.html","https://lists.debian.org/debian-lts-announce/2024/10/msg00020.html","https://openjdk.org/groups/vulnerability/advisories/2024-10-15"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21217","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization).  Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle GraalVM Enterprise Edition: 20.3.15 and  21.3.11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"b7b3356925d8b3a0","cpes":["cpe:2.3:a:bouncycastle-org:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bc_fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc_fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc_fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc_fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc_fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc_fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc-fips:1.0.2.4:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc_fips:1.0.2.4:*:*:*:*:*:*:*"],"name":"bc-fips","purl":"pkg:maven/org.bouncycastle/bc-fips@1.0.2.4","type":"java-archive","version":"1.0.2.4","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/atlassian/bitbucket/opensearch/lib/tools/plugin-cli/bc-fips-1.0.2.4.jar","manifestName":"","pomArtifactID":"bc-fips","archiveDigests":[{"value":"9008d04fc13da6455e6a792935b93b629757335d","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/lib/tools/plugin-cli/bc-fips-1.0.2.4.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/lib/tools/plugin-cli/bc-fips-1.0.2.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.0.2.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qp49-qgx5-5m26","versionConstraint":"<1.0.2.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bc-fips","version":"1.0.2.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qp49-qgx5-5m26","fix":{"state":"fixed","versions":["1.0.2.7"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.0.2.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-11-02","epss":0.00493,"percentile":0.42362}],"risk":0.38454000000000005,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13506","https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qp49-qgx5-5m26","description":"Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard"},"relatedVulnerabilities":[{"id":"CVE-2026-13506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-11-02","epss":0.00493,"percentile":0.42362}],"urls":["https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13506","description":"In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"c1e86990bac3051c","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.75:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.75:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.75","type":"java-archive","version":"1.75","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"df22e1b6a9f6b218913f5b68dd16641344397fe0","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/bcprov-jdk15to18-1.75.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qp49-qgx5-5m26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.75"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qp49-qgx5-5m26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-11-02","epss":0.00493,"percentile":0.42362}],"risk":0.38454000000000005,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13506","https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qp49-qgx5-5m26","description":"Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard"},"relatedVulnerabilities":[{"id":"CVE-2026-13506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-11-02","epss":0.00493,"percentile":0.42362}],"urls":["https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13506","description":"In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"fa5d59af15dd3ec9","cpes":["cpe:2.3:a:org.bouncycastle:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-lts8on:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-lts8on:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_lts8on:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_lts8on:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*"],"name":"bcprov-lts8on","purl":"pkg:maven/org.bouncycastle/bcprov-lts8on@2.73.3","type":"java-archive","version":"2.73.3","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/bcprov-lts8on-2.73.3.jar","manifestName":"","pomArtifactID":"bcprov-lts8on","archiveDigests":[{"value":"124e14ab29a240cd074d4e15ee55c360edd0e1d0","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/bcprov-lts8on-2.73.3.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/bcprov-lts8on-2.73.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.73.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qp49-qgx5-5m26","versionConstraint":"<2.73.12 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-lts8on","version":"2.73.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qp49-qgx5-5m26","fix":{"state":"fixed","versions":["2.73.12"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"2.73.12"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-11-02","epss":0.00493,"percentile":0.42362}],"risk":0.38454000000000005,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13506","https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qp49-qgx5-5m26","description":"Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard"},"relatedVulnerabilities":[{"id":"CVE-2026-13506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-11-02","epss":0.00493,"percentile":0.42362}],"urls":["https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13506","description":"In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"24e80c3d7117a69a","cpes":["cpe:2.3:a:org.bouncycastle:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-lts8on:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-lts8on:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_lts8on:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_lts8on:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-lts8on:2.73.3:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_lts8on:2.73.3:*:*:*:*:*:*:*"],"name":"bcprov-lts8on","purl":"pkg:maven/org.bouncycastle/bcprov-lts8on@2.73.3","type":"java-archive","version":"2.73.3","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/bcprov-lts8on-2.73.3.jar","manifestName":"","pomArtifactID":"bcprov-lts8on","archiveDigests":[{"value":"124e14ab29a240cd074d4e15ee55c360edd0e1d0","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/bcprov-lts8on-2.73.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.73.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qp49-qgx5-5m26","versionConstraint":"<2.73.12 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-lts8on","version":"2.73.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qp49-qgx5-5m26","fix":{"state":"fixed","versions":["2.73.12"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"2.73.12"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-11-02","epss":0.00493,"percentile":0.42362}],"risk":0.38454000000000005,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13506","https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qp49-qgx5-5m26","description":"Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard"},"relatedVulnerabilities":[{"id":"CVE-2026-13506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-11-02","epss":0.00493,"percentile":0.42362}],"urls":["https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13506","description":"In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"842dbc9fb51686ce","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.4:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.4?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.4","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:1a102d1cac2bdae8a0160ac4365d4f8653e9d6da56c793a665d556ae07fb7f82","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5260","versionConstraint":"< 3.7.3-4ubuntu1.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.4"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-5260","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.9"],"available":[{"date":"2026-05-20","kind":"advisory","version":"3.7.3-4ubuntu1.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-5260","cwe":"CWE-126","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5260","date":"2026-11-02","epss":0.00769,"percentile":0.55599}],"risk":0.3845,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-5260"},"relatedVulnerabilities":[{"id":"CVE-2026-5260","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5260","cwe":"CWE-126","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5260","date":"2026-11-02","epss":0.00769,"percentile":0.55599}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:40762","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:67837","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:77320","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82811","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/errata/RHSA-2026:89197","https://access.redhat.com/errata/RHSA-2026:89232","https://access.redhat.com/errata/RHSA-2026:89333","https://access.redhat.com/errata/RHSA-2026:89651","https://access.redhat.com/security/cve/CVE-2026-5260","https://bugzilla.redhat.com/show_bug.cgi?id=2467450","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5260","description":"A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8194","versionConstraint":"< 3.10.12-1~22.04.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-8194","fix":{"state":"fixed","versions":["3.10.12-1~22.04.11"],"available":[{"date":"2025-08-21","kind":"advisory","version":"3.10.12-1~22.04.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-11-02","epss":0.00761,"percentile":0.55319}],"risk":0.3805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8194"},"relatedVulnerabilities":[{"id":"CVE-2025-8194","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-11-02","epss":0.00761,"percentile":0.55319}],"urls":["https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1","https://github.com/python/cpython/commit/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/commit/7040aa54f14676938970e10c5f74ea93cd56aa38","https://github.com/python/cpython/commit/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/commit/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/commit/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/commit/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227","https://github.com/python/cpython/issues/130577","https://github.com/python/cpython/pull/137027","https://mail.python.org/archives/list/security-announce@python.org/thread/ZULLF3IZ726XP5EY7XJ7YIN3K5MDYR2D/","http://www.openwall.com/lists/oss-security/2025/07/28/1","http://www.openwall.com/lists/oss-security/2025/07/28/2","https://github.com/python/cpython/pull/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/pull/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/pull/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/pull/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/pull/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/pull/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8194","description":"There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. \n\nThis vulnerability can be mitigated by including the following patch after importing the “tarfile” module:  https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1"}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8194","versionConstraint":"< 3.10.12-1~22.04.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-8194","fix":{"state":"fixed","versions":["3.10.12-1~22.04.11"],"available":[{"date":"2025-08-21","kind":"advisory","version":"3.10.12-1~22.04.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-11-02","epss":0.00761,"percentile":0.55319}],"risk":0.3805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8194"},"relatedVulnerabilities":[{"id":"CVE-2025-8194","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-11-02","epss":0.00761,"percentile":0.55319}],"urls":["https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1","https://github.com/python/cpython/commit/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/commit/7040aa54f14676938970e10c5f74ea93cd56aa38","https://github.com/python/cpython/commit/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/commit/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/commit/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/commit/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227","https://github.com/python/cpython/issues/130577","https://github.com/python/cpython/pull/137027","https://mail.python.org/archives/list/security-announce@python.org/thread/ZULLF3IZ726XP5EY7XJ7YIN3K5MDYR2D/","http://www.openwall.com/lists/oss-security/2025/07/28/1","http://www.openwall.com/lists/oss-security/2025/07/28/2","https://github.com/python/cpython/pull/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/pull/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/pull/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/pull/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/pull/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/pull/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8194","description":"There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. \n\nThis vulnerability can be mitigated by including the following patch after importing the “tarfile” module:  https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1"}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-8194","versionConstraint":"< 3.10.12-1~22.04.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-8194","fix":{"state":"fixed","versions":["3.10.12-1~22.04.11"],"available":[{"date":"2025-08-21","kind":"advisory","version":"3.10.12-1~22.04.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-11-02","epss":0.00761,"percentile":0.55319}],"risk":0.3805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8194"},"relatedVulnerabilities":[{"id":"CVE-2025-8194","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-11-02","epss":0.00761,"percentile":0.55319}],"urls":["https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1","https://github.com/python/cpython/commit/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/commit/7040aa54f14676938970e10c5f74ea93cd56aa38","https://github.com/python/cpython/commit/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/commit/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/commit/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/commit/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227","https://github.com/python/cpython/issues/130577","https://github.com/python/cpython/pull/137027","https://mail.python.org/archives/list/security-announce@python.org/thread/ZULLF3IZ726XP5EY7XJ7YIN3K5MDYR2D/","http://www.openwall.com/lists/oss-security/2025/07/28/1","http://www.openwall.com/lists/oss-security/2025/07/28/2","https://github.com/python/cpython/pull/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/pull/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/pull/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/pull/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/pull/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/pull/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8194","description":"There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. \n\nThis vulnerability can be mitigated by including the following patch after importing the “tarfile” module:  https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1"}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:8f65375eca0d5512bec1ddc658acf9d891045b7d7a1763b0450e9ea9ce74225f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:dca2983dd93bb545c6b3912b6c6eddf6231287df941da3afbcac393a434cc99f","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8194","versionConstraint":"< 3.10.12-1~22.04.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-8194","fix":{"state":"fixed","versions":["3.10.12-1~22.04.11"],"available":[{"date":"2025-08-21","kind":"advisory","version":"3.10.12-1~22.04.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-11-02","epss":0.00761,"percentile":0.55319}],"risk":0.3805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8194"},"relatedVulnerabilities":[{"id":"CVE-2025-8194","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-11-02","epss":0.00761,"percentile":0.55319}],"urls":["https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1","https://github.com/python/cpython/commit/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/commit/7040aa54f14676938970e10c5f74ea93cd56aa38","https://github.com/python/cpython/commit/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/commit/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/commit/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/commit/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227","https://github.com/python/cpython/issues/130577","https://github.com/python/cpython/pull/137027","https://mail.python.org/archives/list/security-announce@python.org/thread/ZULLF3IZ726XP5EY7XJ7YIN3K5MDYR2D/","http://www.openwall.com/lists/oss-security/2025/07/28/1","http://www.openwall.com/lists/oss-security/2025/07/28/2","https://github.com/python/cpython/pull/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/pull/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/pull/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/pull/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/pull/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/pull/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8194","description":"There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. \n\nThis vulnerability can be mitigated by including the following patch after importing the “tarfile” module:  https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1"}]},{"artifact":{"id":"44e84e19af66323e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.12.7.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1","type":"java-archive","version":"2.12.7.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/tools/atlassian-password/atlassian-password-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.12.7.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"bb77fcffb9ecc2cc","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2","type":"java-archive","version":"2.13.4.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar:META-INF/lib/jackson-databind-2.13.4.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"325c06bdfeb628cfb80ebaaf1a26cc1eb558a585","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-migration-plugin-1.3.138.jar:META-INF/lib/jackson-databind-2.13.4.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.13.4.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"0fb142b267f8963c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2","type":"java-archive","version":"2.13.4.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/analytics-client-8.4.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.13.4.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"4d0c3abee3ce4445","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-remote-event-common-plugin-7.0.1.jar:META-INF/lib/jackson-databind-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"01e71fddbc80bb86f71a6345ac1e8ab8a00e7134","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-remote-event-common-plugin-7.0.1.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/atlassian-remote-event-common-plugin-7.0.1.jar:META-INF/lib/jackson-databind-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"abf07cd44e688c5e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/opensearch/lib/tools/upgrade-cli/jackson-databind-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"01e71fddbc80bb86f71a6345ac1e8ab8a00e7134","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/lib/tools/upgrade-cli/jackson-databind-2.14.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/lib/tools/upgrade-cli/jackson-databind-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"96e49eed88feacc3","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/opensearch/modules/ingest-geoip/jackson-databind-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"01e71fddbc80bb86f71a6345ac1e8ab8a00e7134","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/modules/ingest-geoip/jackson-databind-2.14.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/modules/ingest-geoip/jackson-databind-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"148d0e1e06039376","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/jackson-databind-2.14.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"01e71fddbc80bb86f71a6345ac1e8ab8a00e7134","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/jackson-databind-2.14.2.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/opensearch/plugins/opensearch-security/jackson-databind-2.14.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"67df6d98175155b6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/signalfx-java-1.0.36.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/signalfx-java-1.0.36.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"17a6603b2c8c52c8","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/jackson-databind-2.15.3.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"a734bc2c47a9453c4efa772461a3aeb273c010d9","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/mesh/mesh-app.jar:BOOT-INF/lib/jackson-databind-2.15.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"6c1f803e9e3094a1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/applinks-plugin-9.2.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/applinks-plugin-9.2.0.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/applinks-plugin-9.2.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"90999fe659e21a85","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-plugin-2.4.3.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-plugin-2.4.3.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/atlassian-bundled-plugins/bitbucket-plugin-2.4.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"7fb7ae836158dda2","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1","type":"java-archive","version":"2.16.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/jackson-databind-2.16.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"02a16efeb840c45af1e2f31753dfe76795278b73","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/bitbucket/app/WEB-INF/lib/jackson-databind-2.16.1.jar","layerID":"sha256:f79fb4a1a671d5ac27cd328ac22389467ab50fa94910b0cc12b73d06b7942be6","accessPath":"/opt/atlassian/bitbucket/app/WEB-INF/lib/jackson-databind-2.16.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]}],"grade":"F","score":"0.00","as_of":"2026-11-04T07:08:21.135Z","grype_db_version":"2026-11-03T06:20:47.000Z"}