{"grype_matches":[{"artifact":{"id":"811a2c1dbb7d9f4a","cpes":["cpe:2.3:a:apache:tika-core:1.28.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:tika_core:1.28.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:tika:1.28.4:*:*:*:*:*:*:*"],"name":"tika-core","purl":"pkg:maven/org.apache.tika/tika-core@1.28.4","type":"java-archive","version":"1.28.4","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.tika","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.confluence-flyingpdf-plugin-18.7.56.jar:org.apache.tika:tika-core","manifestName":"","pomArtifactID":"tika-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.confluence-flyingpdf-plugin-18.7.56.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.confluence-flyingpdf-plugin-18.7.56.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f58c-gq56-vjjf","versionConstraint":">=1.13,<=3.2.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tika:tika-core","version":"1.28.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f58c-gq56-vjjf","fix":{"state":"fixed","versions":["3.2.2"],"available":[{"date":"2025-12-06","kind":"first-observed","version":"3.2.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","metrics":{"baseScore":10},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66516","cwe":"CWE-611","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-66516","date":"2026-11-02","epss":0.88976,"percentile":0.99779}],"risk":84.5272,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-66516","https://cve.org/CVERecord?id=CVE-2025-54988","https://lists.apache.org/thread/s5x3k93nhbkqzztp1olxotoyjpdlps9k"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f58c-gq56-vjjf","description":"Apache Tika has XXE vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-66516","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66516","cwe":"CWE-611","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-66516","date":"2026-11-02","epss":0.88976,"percentile":0.99779}],"urls":["https://cve.org/CVERecord?id=CVE-2025-54988","https://lists.apache.org/thread/s5x3k93nhbkqzztp1olxotoyjpdlps9k"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66516","description":"Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. \n\nThis CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. \n\nFirst, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. \n\nSecond, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the \"org.apache.tika:tika-parsers\" module."}]},{"artifact":{"id":"49239cfd8299a013","cpes":["cpe:2.3:a:apache:tika-core:2.4.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:tika_core:2.4.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:tika:2.4.1:*:*:*:*:*:*:*"],"name":"tika-core","purl":"pkg:maven/org.apache.tika/tika-core@2.4.1","type":"java-archive","version":"2.4.1","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.tika","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.webdav.webdav-plugin-18.7.17.jar:org.apache.tika:tika-core","manifestName":"","pomArtifactID":"tika-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.webdav.webdav-plugin-18.7.17.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.webdav.webdav-plugin-18.7.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f58c-gq56-vjjf","versionConstraint":">=1.13,<=3.2.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tika:tika-core","version":"2.4.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f58c-gq56-vjjf","fix":{"state":"fixed","versions":["3.2.2"],"available":[{"date":"2025-12-06","kind":"first-observed","version":"3.2.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","metrics":{"baseScore":10},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66516","cwe":"CWE-611","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-66516","date":"2026-11-02","epss":0.88976,"percentile":0.99779}],"risk":84.5272,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-66516","https://cve.org/CVERecord?id=CVE-2025-54988","https://lists.apache.org/thread/s5x3k93nhbkqzztp1olxotoyjpdlps9k"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f58c-gq56-vjjf","description":"Apache Tika has XXE vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-66516","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66516","cwe":"CWE-611","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-66516","date":"2026-11-02","epss":0.88976,"percentile":0.99779}],"urls":["https://cve.org/CVERecord?id=CVE-2025-54988","https://lists.apache.org/thread/s5x3k93nhbkqzztp1olxotoyjpdlps9k"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66516","description":"Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. \n\nThis CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. \n\nFirst, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. \n\nSecond, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the \"org.apache.tika:tika-parsers\" module."}]},{"artifact":{"id":"0eb1f81fbf22bec0","cpes":["cpe:2.3:a:apache:tika-core:2.7.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:tika_core:2.7.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:2.7.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:tika:2.7.0:*:*:*:*:*:*:*"],"name":"tika-core","purl":"pkg:maven/org.apache.tika/tika-core@2.7.0","type":"java-archive","version":"2.7.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tika","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.tika_tika-core-2.7.0.jar","manifestName":"","pomArtifactID":"tika-core","archiveDigests":[{"value":"e9e8f1a7dc833e633fb2c717e8fa811e3e9dbf4a","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.tika_tika-core-2.7.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.tika_tika-core-2.7.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f58c-gq56-vjjf","versionConstraint":">=1.13,<=3.2.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tika:tika-core","version":"2.7.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f58c-gq56-vjjf","fix":{"state":"fixed","versions":["3.2.2"],"available":[{"date":"2025-12-06","kind":"first-observed","version":"3.2.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","metrics":{"baseScore":10},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66516","cwe":"CWE-611","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-66516","date":"2026-11-02","epss":0.88976,"percentile":0.99779}],"risk":84.5272,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-66516","https://cve.org/CVERecord?id=CVE-2025-54988","https://lists.apache.org/thread/s5x3k93nhbkqzztp1olxotoyjpdlps9k"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f58c-gq56-vjjf","description":"Apache Tika has XXE vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-66516","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66516","cwe":"CWE-611","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-66516","date":"2026-11-02","epss":0.88976,"percentile":0.99779}],"urls":["https://cve.org/CVERecord?id=CVE-2025-54988","https://lists.apache.org/thread/s5x3k93nhbkqzztp1olxotoyjpdlps9k"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66516","description":"Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. \n\nThis CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. \n\nFirst, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. \n\nSecond, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the \"org.apache.tika:tika-parsers\" module."}]},{"artifact":{"id":"3058891d9c69e832","cpes":["cpe:2.3:a:com.atlassian.confluence:confluence:8.7.2:*:*:*:*:*:*:*","cpe:2.3:a:confluence:confluence:8.7.2:*:*:*:*:*:*:*","cpe:2.3:a:atlassian:confluence:8.7.2:*:*:*:*:*:*:*"],"name":"confluence","purl":"pkg:maven/com.atlassian.confluence/confluence@8.7.2","type":"java-archive","version":"8.7.2","language":"java","licenses":[],"metadata":{"pomGroupID":"com.atlassian.confluence","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","manifestName":"","pomArtifactID":"confluence","archiveDigests":[{"value":"afaf3eba1f92068ba7584de95e3aafadc7dc66c5","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.2.26"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-21589","versionConstraint":">= 5.10.0, < 9.2.26||>= 9.3.0, < 10.2.19 (maven)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.atlassian.confluence:confluence","version":"8.7.2"},"language":"java","namespace":"nvd:language:java"}}],"vulnerability":{"id":"CVE-2026-21589","fix":{"state":"fixed","versions":["9.2.26","10.2.19"],"available":[{"date":"2026-10-16","kind":"first-observed","version":"9.2.26"},{"date":"2026-10-16","kind":"first-observed","version":"10.2.19"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@atlassian.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21589","cwe":"CWE-552","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-21589","date":"2026-11-02","epss":0.99477,"percentile":0.99943}],"risk":83.47500000000001,"urls":["https://jira.atlassian.com/browse/BAM-26567","https://jira.atlassian.com/browse/BSERV-20604","https://jira.atlassian.com/browse/CONFSERVER-104488","https://jira.atlassian.com/browse/CRUC-8741","https://jira.atlassian.com/browse/CWD-6610","https://jira.atlassian.com/browse/FE-7583","https://jira.atlassian.com/browse/JRASERVER-79546","https://jira.atlassian.com/browse/JSDSERVER-16809","https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589"],"severity":"High","namespace":"nvd:language:java","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21589","description":"This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.","knownExploited":[{"cve":"CVE-2026-21589","cwes":["CWE-552"],"urls":["https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com","https://nvd.nist.gov/vuln/detail/CVE-2026-21589"],"notes":"BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-10-18","product":"Multiple Products","dateAdded":"2026-10-15","vendorProject":"Atlassian","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[]},{"artifact":{"id":"2ea0ddce9d769b21","cpes":["cpe:2.3:a:libbrotli1:libbrotli1:1.0.9-2build6:*:*:*:*:*:*:*"],"name":"libbrotli1","purl":"pkg:deb/ubuntu/libbrotli1@1.0.9-2build6?arch=amd64&distro=ubuntu-22.04&upstream=brotli","type":"deb","version":"1.0.9-2build6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libbrotli1/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libbrotli1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbrotli1:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libbrotli1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"brotli"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.9-2ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111497","versionConstraint":"< 1.0.9-2ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"brotli","version":"1.0.9-2build6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-111497","fix":{"state":"fixed","versions":["1.0.9-2ubuntu0.1"],"available":[{"date":"2026-10-26","kind":"advisory","version":"1.0.9-2ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-111497","cwe":"CWE-252","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-111497","cwe":"CWE-787","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-111497","date":"2026-11-02","epss":0.82641,"percentile":0.99667}],"risk":78.75000000000001,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-111497","knownExploited":[{"cve":"CVE-2026-111497","cwes":["CWE-252","CWE-787"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-111497"],"notes":"This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/google/brotli/releases/tag/v1.2.1; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-10","product":"Brotli","dateAdded":"2026-10-27","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2026-111497","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111497","cwe":"CWE-252","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-111497","cwe":"CWE-787","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-111497","date":"2026-11-02","epss":0.82641,"percentile":0.99667}],"urls":["https://github.com/andybalholm/brotli/releases/tag/v1.2.7","https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high","http://www.openwall.com/lists/oss-security/2026/10/23/25","http://www.openwall.com/lists/oss-security/2026/10/24/6","http://www.openwall.com/lists/oss-security/2026/10/26/12","http://www.openwall.com/lists/oss-security/2026/10/26/13","http://www.openwall.com/lists/oss-security/2026/10/26/16","https://broccoli2shell.com","https://github.com/advisories/GHSA-9v8h-qqgm-4m35","https://github.com/dotnet/announcements/issues/494","https://github.com/google/brotli/releases/tag/v1.0.10","https://github.com/google/brotli/releases/tag/v1.1.1","https://github.com/google/brotli/releases/tag/v1.2.1","https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html","https://patchtheplanet.org/brotli","https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497","https://cert-portal.siemens.com/productcert/html/ssa-045512.html","https://cert-portal.siemens.com/productcert/html/ssa-443410.html","https://cert-portal.siemens.com/productcert/html/ssa-898633.html","https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","knownExploited":[{"cve":"CVE-2026-111497","cwes":["CWE-252","CWE-787"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-111497"],"notes":"This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/google/brotli/releases/tag/v1.2.1; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-10","product":"Brotli","dateAdded":"2026-10-27","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"3058891d9c69e832","cpes":["cpe:2.3:a:com.atlassian.confluence:confluence:8.7.2:*:*:*:*:*:*:*","cpe:2.3:a:confluence:confluence:8.7.2:*:*:*:*:*:*:*","cpe:2.3:a:atlassian:confluence:8.7.2:*:*:*:*:*:*:*"],"name":"confluence","purl":"pkg:maven/com.atlassian.confluence/confluence@8.7.2","type":"java-archive","version":"8.7.2","language":"java","licenses":[],"metadata":{"pomGroupID":"com.atlassian.confluence","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","manifestName":"","pomArtifactID":"confluence","archiveDigests":[{"value":"afaf3eba1f92068ba7584de95e3aafadc7dc66c5","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.9.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-21683","versionConstraint":">= 7.20.0, <= 7.20.3||>= 8.0.0, <= 8.0.4||>= 8.1.0, <= 8.1.4||>= 8.2.0, <= 8.2.3||>= 8.3.0, <= 8.3.4||>= 8.4.0, <= 8.4.5||>= 8.6.0, <= 8.6.2||>= 8.9.0, < 8.9.3||= 8.7.1||= 8.7.2||= 8.8.0||= 8.8.1 (maven)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.atlassian.confluence:confluence","version":"8.7.2"},"language":"java","namespace":"nvd:language:java"}},{"fix":{"suggestedVersion":"8.9.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-21683","versionConstraint":">= 7.20.0, <= 7.20.3||>= 8.0.0, <= 8.0.4||>= 8.1.0, <= 8.1.4||>= 8.2.0, <= 8.2.3||>= 8.3.0, <= 8.3.4||>= 8.4.0, <= 8.4.5||>= 8.6.0, <= 8.6.2||>= 8.9.0, <= 8.9.2||= 8.7.1||= 8.7.2||= 8.8.0||= 8.8.1 (maven)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.atlassian.confluence:confluence","version":"8.7.2"},"language":"java","namespace":"nvd:language:java"}}],"vulnerability":{"id":"CVE-2024-21683","fix":{"state":"fixed","versions":["8.9.3"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"8.9.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@atlassian.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21683","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-21683","date":"2026-11-02","epss":0.88267,"percentile":0.99768}],"risk":71.937605,"urls":["https://confluence.atlassian.com/pages/viewpage.action?pageId=1409286211","https://jira.atlassian.com/browse/CONFSERVER-95832"],"severity":"High","namespace":"nvd:language:java","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21683","description":"This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server.\n\nThis RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. \n\nAtlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html\n\nYou can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives.\n\nThis vulnerability was found internally."},"relatedVulnerabilities":[]},{"artifact":{"id":"cecd721853682098","cpes":["cpe:2.3:a:apache:struts2-core:6.3.0.2-atlassian-3:*:*:*:*:*:*:*","cpe:2.3:a:apache:struts2_core:6.3.0.2-atlassian-3:*:*:*:*:*:*:*","cpe:2.3:a:apache:2-core:6.3.0.2-atlassian-3:*:*:*:*:*:*:*","cpe:2.3:a:apache:2_core:6.3.0.2-atlassian-3:*:*:*:*:*:*:*","cpe:2.3:a:apache:struts:6.3.0.2-atlassian-3:*:*:*:*:*:*:*"],"name":"struts2-core","purl":"pkg:maven/org.apache.struts/struts2-core@6.3.0.2-atlassian-3","type":"java-archive","version":"6.3.0.2-atlassian-3","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.struts","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.struts_struts2-core-6.3.0.2-atlassian-3.jar","manifestName":"","pomArtifactID":"struts2-core","archiveDigests":[{"value":"1924a6457f174e518d1232a7b82996a2c9101441","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.struts_struts2-core-6.3.0.2-atlassian-3.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.struts_struts2-core-6.3.0.2-atlassian-3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.4.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-43mq-6xmg-29vm","versionConstraint":"<6.4.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.struts:struts2-core","version":"6.3.0.2-atlassian-3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-43mq-6xmg-29vm","fix":{"state":"fixed","versions":["6.4.0"],"available":[{"date":"2024-12-12","kind":"first-observed","version":"6.4.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:A/V:C/RE:L/U:Red","metrics":{"baseScore":9.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-53677","cwe":"CWE-434","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-53677","date":"2026-11-02","epss":0.72367,"percentile":0.99438}],"risk":67.48222750000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-53677","https://cwiki.apache.org/confluence/display/WW/S2-067","https://struts.apache.org/core-developers/file-upload","https://security.netapp.com/advisory/ntap-20250103-0005","https://github.com/apache/struts/commit/1ecfbae46543a83e131404f8dcc84b3d0d554854","https://github.com/apache/struts/commit/3ef9ade8902a63bb560892453eeca02bfddefc78","https://github.com/apache/struts/commit/930fef7679d7247db9e460c146b1698a9d7ad1e4","https://www.dynatrace.com/news/blog/the-anatomy-of-broken-apache-struts-2-a-technical-deep-dive-into-cve-2024-53677"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-43mq-6xmg-29vm","description":"Apache Struts file upload logic is flawed"},"relatedVulnerabilities":[{"id":"CVE-2024-53677","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:C/RE:L/U:Red","metrics":{"baseScore":9.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-53677","cwe":"CWE-434","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-53677","date":"2026-11-02","epss":0.72367,"percentile":0.99438}],"urls":["https://cwiki.apache.org/confluence/display/WW/S2-067","https://security.netapp.com/advisory/ntap-20250103-0005/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-53677","description":"File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.\n\nThis issue affects Apache Struts: from 2.0.0 before 6.4.0.\n\nUsers are recommended to upgrade to version 6.4.0 at least and migrate to the new  file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.\n\nYou can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067"}]},{"artifact":{"id":"02cefa104fb0261b","cpes":["cpe:2.3:a:libfreetype6:libfreetype6:2.11.1\\+dfsg-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libfreetype6","purl":"pkg:deb/ubuntu/libfreetype6@2.11.1%2Bdfsg-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=freetype","type":"deb","version":"2.11.1+dfsg-1ubuntu0.2","language":"","licenses":["BSD-3-Clause","BSL-1.0","FSFAP","FTL","GPL-2","GPL-2+","GPL-3","GPL-3+","MIT","OpenGroup-BSD-like","Public-Domain","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libfreetype6/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libfreetype6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libfreetype6:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libfreetype6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"freetype"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.11.1+dfsg-1ubuntu0.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-27363","versionConstraint":"< 2.11.1+dfsg-1ubuntu0.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"freetype","version":"2.11.1+dfsg-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-27363","fix":{"state":"fixed","versions":["2.11.1+dfsg-1ubuntu0.3"],"available":[{"date":"2025-03-17","kind":"advisory","version":"2.11.1+dfsg-1ubuntu0.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-27363","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-27363","date":"2026-11-02","epss":0.27775,"percentile":0.98092}],"risk":52.5,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-27363","knownExploited":[{"cve":"CVE-2025-27363","cwes":["CWE-787"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-27363"],"notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://source.android.com/docs/security/bulletin/2025-05-01","dueDate":"2025-05-27","product":"FreeType","dateAdded":"2025-05-06","vendorProject":"FreeType","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2025-27363","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve-assign@fb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-27363","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-27363","date":"2026-11-02","epss":0.27775,"percentile":0.98092}],"urls":["https://www.facebook.com/security/advisories/cve-2025-27363","http://www.openwall.com/lists/oss-security/2025/03/13/1","http://www.openwall.com/lists/oss-security/2025/03/13/11","http://www.openwall.com/lists/oss-security/2025/03/13/12","http://www.openwall.com/lists/oss-security/2025/03/13/2","http://www.openwall.com/lists/oss-security/2025/03/13/3","http://www.openwall.com/lists/oss-security/2025/03/13/8","http://www.openwall.com/lists/oss-security/2025/03/14/1","http://www.openwall.com/lists/oss-security/2025/03/14/2","http://www.openwall.com/lists/oss-security/2025/03/14/3","http://www.openwall.com/lists/oss-security/2025/03/14/4","http://www.openwall.com/lists/oss-security/2025/05/06/3","http://www.openwall.com/lists/oss-security/2026/04/16/5","http://www.openwall.com/lists/oss-security/2026/04/19/3","https://lists.debian.org/debian-lts-announce/2025/03/msg00030.html","https://source.android.com/docs/security/bulletin/2025-05-01","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27363"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27363","description":"An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.","knownExploited":[{"cve":"CVE-2025-27363","cwes":["CWE-787"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-27363"],"notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://source.android.com/docs/security/bulletin/2025-05-01","dueDate":"2025-05-27","product":"FreeType","dateAdded":"2025-05-06","vendorProject":"FreeType","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"f02275b79327efaf","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2961","versionConstraint":"< 2.35-0ubuntu3.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-2961","fix":{"state":"fixed","versions":["2.35-0ubuntu3.7"],"available":[{"date":"2024-04-18","kind":"advisory","version":"2.35-0ubuntu3.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"risk":44.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2961"},"relatedVulnerabilities":[{"id":"CVE-2024-2961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/17/9","http://www.openwall.com/lists/oss-security/2024/04/18/4","http://www.openwall.com/lists/oss-security/2024/04/24/2","http://www.openwall.com/lists/oss-security/2024/05/27/1","http://www.openwall.com/lists/oss-security/2024/05/27/2","http://www.openwall.com/lists/oss-security/2024/05/27/3","http://www.openwall.com/lists/oss-security/2024/05/27/4","http://www.openwall.com/lists/oss-security/2024/05/27/5","http://www.openwall.com/lists/oss-security/2024/05/27/6","http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/","https://security.netapp.com/advisory/ntap-20240531-0002/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004","https://www.ambionics.io/blog/iconv-cve-2024-2961-p1","https://www.ambionics.io/blog/iconv-cve-2024-2961-p2","https://www.ambionics.io/blog/iconv-cve-2024-2961-p3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."}]},{"artifact":{"id":"8da7e53d1801cfa5","cpes":["cpe:2.3:a:libc6:libc6:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2961","versionConstraint":"< 2.35-0ubuntu3.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-2961","fix":{"state":"fixed","versions":["2.35-0ubuntu3.7"],"available":[{"date":"2024-04-18","kind":"advisory","version":"2.35-0ubuntu3.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"risk":44.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2961"},"relatedVulnerabilities":[{"id":"CVE-2024-2961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/17/9","http://www.openwall.com/lists/oss-security/2024/04/18/4","http://www.openwall.com/lists/oss-security/2024/04/24/2","http://www.openwall.com/lists/oss-security/2024/05/27/1","http://www.openwall.com/lists/oss-security/2024/05/27/2","http://www.openwall.com/lists/oss-security/2024/05/27/3","http://www.openwall.com/lists/oss-security/2024/05/27/4","http://www.openwall.com/lists/oss-security/2024/05/27/5","http://www.openwall.com/lists/oss-security/2024/05/27/6","http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/","https://security.netapp.com/advisory/ntap-20240531-0002/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004","https://www.ambionics.io/blog/iconv-cve-2024-2961-p1","https://www.ambionics.io/blog/iconv-cve-2024-2961-p2","https://www.ambionics.io/blog/iconv-cve-2024-2961-p3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."}]},{"artifact":{"id":"a88b7869c938a730","cpes":["cpe:2.3:a:locales:locales:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/ubuntu/locales@2.35-0ubuntu3.6?arch=all&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2961","versionConstraint":"< 2.35-0ubuntu3.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-2961","fix":{"state":"fixed","versions":["2.35-0ubuntu3.7"],"available":[{"date":"2024-04-18","kind":"advisory","version":"2.35-0ubuntu3.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"risk":44.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2961"},"relatedVulnerabilities":[{"id":"CVE-2024-2961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/17/9","http://www.openwall.com/lists/oss-security/2024/04/18/4","http://www.openwall.com/lists/oss-security/2024/04/24/2","http://www.openwall.com/lists/oss-security/2024/05/27/1","http://www.openwall.com/lists/oss-security/2024/05/27/2","http://www.openwall.com/lists/oss-security/2024/05/27/3","http://www.openwall.com/lists/oss-security/2024/05/27/4","http://www.openwall.com/lists/oss-security/2024/05/27/5","http://www.openwall.com/lists/oss-security/2024/05/27/6","http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/","https://security.netapp.com/advisory/ntap-20240531-0002/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004","https://www.ambionics.io/blog/iconv-cve-2024-2961-p1","https://www.ambionics.io/blog/iconv-cve-2024-2961-p2","https://www.ambionics.io/blog/iconv-cve-2024-2961-p3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."}]},{"artifact":{"id":"8714e648b2fbdcd7","cpes":["cpe:2.3:a:libnghttp2-14:libnghttp2-14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2-14:libnghttp2_14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2_14:libnghttp2-14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2_14:libnghttp2_14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2:libnghttp2-14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2:libnghttp2_14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*"],"name":"libnghttp2-14","purl":"pkg:deb/ubuntu/libnghttp2-14@1.43.0-1ubuntu0.1?arch=amd64&distro=ubuntu-22.04&upstream=nghttp2","type":"deb","version":"1.43.0-1ubuntu0.1","language":"","licenses":["BSD-2-clause","Expat","GPL-3","GPL-3+","MIT","SIL-OFL-1.1","all-permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnghttp2-14/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libnghttp2-14/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnghttp2-14:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libnghttp2-14:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nghttp2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.43.0-1ubuntu0.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-28182","versionConstraint":"< 1.43.0-1ubuntu0.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nghttp2","version":"1.43.0-1ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-28182","fix":{"state":"fixed","versions":["1.43.0-1ubuntu0.2"],"available":[{"date":"2024-04-25","kind":"advisory","version":"1.43.0-1ubuntu0.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-28182","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-28182","date":"2026-11-02","epss":0.8496,"percentile":0.99712}],"risk":42.480000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28182"},"relatedVulnerabilities":[{"id":"CVE-2024-28182","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28182","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-28182","date":"2026-11-02","epss":0.8496,"percentile":0.99712}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/03/16","https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0","https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9","https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q","https://lists.debian.org/debian-lts-announce/2024/04/msg00026.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/","https://lists.debian.org/debian-lts-announce/2024/09/msg00041.html","https://www.kb.cert.org/vuls/id/421644","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-784301.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28182","description":"nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync.  This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability."}]},{"artifact":{"id":"a8f1f07e02daddd2","cpes":["cpe:2.3:a:org.springframework:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring_webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring_webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_webmvc:5.3.30:*:*:*:*:*:*:*"],"name":"spring-webmvc","purl":"pkg:maven/org.springframework/spring-webmvc@5.3.30","type":"java-archive","version":"5.3.30","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-webmvc-5.3.30.jar","manifestName":"","pomArtifactID":"spring-webmvc","archiveDigests":[{"value":"67ad9ebc6189c91942a52328f58d824cd3171fd9","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-webmvc-5.3.30.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-webmvc-5.3.30.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-g5vr-rgqm-vf78","versionConstraint":"<=5.3.40 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-webmvc","version":"5.3.30"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-g5vr-rgqm-vf78","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38819","cwe":"CWE-22","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2024-38819","date":"2026-11-02","epss":0.56463,"percentile":0.99057}],"risk":42.347249999999995,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-38819","https://spring.io/security/cve-2024-38819","https://github.com/spring-projects/spring-framework/issues/33689","https://github.com/spring-projects/spring-framework/commit/3bfbe30a7814c9ea1556d40df9bd87ddb3ba372d","https://github.com/spring-projects/spring-framework/commit/fb7890d73975a3d9e0763e0926df2bd0a608e87e","https://security.netapp.com/advisory/ntap-20250110-0010"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","description":"Spring Framework Path Traversal vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-38819","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38819","cwe":"CWE-22","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2024-38819","date":"2026-11-02","epss":0.56463,"percentile":0.99057}],"urls":["https://spring.io/security/cve-2024-38819","https://security.netapp.com/advisory/ntap-20250110-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-38819","description":"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running."}]},{"artifact":{"id":"4d5407177cb8d0dd","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.21"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15467","versionConstraint":"< 3.0.2-0ubuntu1.21 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-15467","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.21"],"available":[{"date":"2026-01-27","kind":"advisory","version":"3.0.2-0ubuntu1.21"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-15467","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-15467","cwe":"CWE-120","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-15467","date":"2026-11-02","epss":0.74793,"percentile":0.99505}],"risk":37.396499999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15467"},"relatedVulnerabilities":[{"id":"CVE-2025-15467","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15467","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-15467","cwe":"CWE-120","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-15467","date":"2026-11-02","epss":0.74793,"percentile":0.99505}],"urls":["https://github.com/openssl/openssl/commit/2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703","https://github.com/openssl/openssl/commit/5f26d4202f5b89664c5c3f3c62086276026ba9a9","https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3","https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e","https://github.com/openssl/openssl/commit/d0071a0799f20cc8101730145349ed4487c268dc","https://openssl-library.org/news/secadv/20260127.txt","http://www.openwall.com/lists/oss-security/2026/01/27/10","http://www.openwall.com/lists/oss-security/2026/02/25/6","https://access.redhat.com/errata/RHSA-2026:1472","https://access.redhat.com/errata/RHSA-2026:1473","https://access.redhat.com/errata/RHSA-2026:1496","https://access.redhat.com/errata/RHSA-2026:1503","https://access.redhat.com/errata/RHSA-2026:1519","https://access.redhat.com/errata/RHSA-2026:1594","https://access.redhat.com/errata/RHSA-2026:1733","https://access.redhat.com/errata/RHSA-2026:1736","https://access.redhat.com/errata/RHSA-2026:2072","https://access.redhat.com/errata/RHSA-2026:2077","https://access.redhat.com/errata/RHSA-2026:2485","https://access.redhat.com/errata/RHSA-2026:2563","https://access.redhat.com/errata/RHSA-2026:2633","https://access.redhat.com/errata/RHSA-2026:2659","https://access.redhat.com/errata/RHSA-2026:2671","https://access.redhat.com/errata/RHSA-2026:2844","https://access.redhat.com/errata/RHSA-2026:2974","https://access.redhat.com/errata/RHSA-2026:2995","https://access.redhat.com/errata/RHSA-2026:3228","https://access.redhat.com/errata/RHSA-2026:3415","https://access.redhat.com/errata/RHSA-2026:3461","https://access.redhat.com/errata/RHSA-2026:3462","https://access.redhat.com/errata/RHSA-2026:4419","https://access.redhat.com/errata/RHSA-2026:4943","https://access.redhat.com/errata/RHSA-2026:6481","https://access.redhat.com/errata/RHSA-2026:7261","https://access.redhat.com/security/cve/CVE-2025-15467","https://bugzilla.redhat.com/show_bug.cgi?id=2430376","https://cert-portal.siemens.com/productcert/html/ssa-434797.html","https://cert-portal.siemens.com/productcert/html/ssa-734552.html","https://github.com/guiimoraes/CVE-2025-15467","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15467.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15467","description":"Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue."}]},{"artifact":{"id":"1014a67cbf322356","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.21"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-15467","versionConstraint":"< 3.0.2-0ubuntu1.21 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-15467","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.21"],"available":[{"date":"2026-01-27","kind":"advisory","version":"3.0.2-0ubuntu1.21"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-15467","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-15467","cwe":"CWE-120","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-15467","date":"2026-11-02","epss":0.74793,"percentile":0.99505}],"risk":37.396499999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15467"},"relatedVulnerabilities":[{"id":"CVE-2025-15467","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15467","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-15467","cwe":"CWE-120","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-15467","date":"2026-11-02","epss":0.74793,"percentile":0.99505}],"urls":["https://github.com/openssl/openssl/commit/2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703","https://github.com/openssl/openssl/commit/5f26d4202f5b89664c5c3f3c62086276026ba9a9","https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3","https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e","https://github.com/openssl/openssl/commit/d0071a0799f20cc8101730145349ed4487c268dc","https://openssl-library.org/news/secadv/20260127.txt","http://www.openwall.com/lists/oss-security/2026/01/27/10","http://www.openwall.com/lists/oss-security/2026/02/25/6","https://access.redhat.com/errata/RHSA-2026:1472","https://access.redhat.com/errata/RHSA-2026:1473","https://access.redhat.com/errata/RHSA-2026:1496","https://access.redhat.com/errata/RHSA-2026:1503","https://access.redhat.com/errata/RHSA-2026:1519","https://access.redhat.com/errata/RHSA-2026:1594","https://access.redhat.com/errata/RHSA-2026:1733","https://access.redhat.com/errata/RHSA-2026:1736","https://access.redhat.com/errata/RHSA-2026:2072","https://access.redhat.com/errata/RHSA-2026:2077","https://access.redhat.com/errata/RHSA-2026:2485","https://access.redhat.com/errata/RHSA-2026:2563","https://access.redhat.com/errata/RHSA-2026:2633","https://access.redhat.com/errata/RHSA-2026:2659","https://access.redhat.com/errata/RHSA-2026:2671","https://access.redhat.com/errata/RHSA-2026:2844","https://access.redhat.com/errata/RHSA-2026:2974","https://access.redhat.com/errata/RHSA-2026:2995","https://access.redhat.com/errata/RHSA-2026:3228","https://access.redhat.com/errata/RHSA-2026:3415","https://access.redhat.com/errata/RHSA-2026:3461","https://access.redhat.com/errata/RHSA-2026:3462","https://access.redhat.com/errata/RHSA-2026:4419","https://access.redhat.com/errata/RHSA-2026:4943","https://access.redhat.com/errata/RHSA-2026:6481","https://access.redhat.com/errata/RHSA-2026:7261","https://access.redhat.com/security/cve/CVE-2025-15467","https://bugzilla.redhat.com/show_bug.cgi?id=2430376","https://cert-portal.siemens.com/productcert/html/ssa-434797.html","https://cert-portal.siemens.com/productcert/html/ssa-734552.html","https://github.com/guiimoraes/CVE-2025-15467","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15467.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15467","description":"Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue."}]},{"artifact":{"id":"01ef732d98327202","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.37.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.37.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.37.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.37.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.37.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.37.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.37.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=sqlite3","type":"deb","version":"3.37.2-2ubuntu0.3","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.37.2-2ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6965","versionConstraint":"< 3.37.2-2ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"sqlite3","version":"3.37.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-6965","fix":{"state":"fixed","versions":["3.37.2-2ubuntu0.5"],"available":[{"date":"2025-07-28","kind":"advisory","version":"3.37.2-2ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-6965","cwe":"CWE-197","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-6965","date":"2026-11-02","epss":0.73452,"percentile":0.99465}],"risk":36.726,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6965"},"relatedVulnerabilities":[{"id":"CVE-2025-6965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L","metrics":{"baseScore":7.7,"impactScore":5.3,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:Green","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6965","cwe":"CWE-197","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-6965","date":"2026-11-02","epss":0.73452,"percentile":0.99465}],"urls":["https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8","http://seclists.org/fulldisclosure/2025/Sep/49","http://seclists.org/fulldisclosure/2025/Sep/53","http://seclists.org/fulldisclosure/2025/Sep/56","http://seclists.org/fulldisclosure/2025/Sep/57","http://seclists.org/fulldisclosure/2025/Sep/58","http://www.openwall.com/lists/oss-security/2025/09/06/1","https://cert-portal.siemens.com/productcert/html/ssa-225816.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-765416.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6965","description":"There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above."}]},{"artifact":{"id":"c87a73d6229303b3","cpes":["cpe:2.3:a:apache:tomcat-coyote:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_coyote:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-coyote","purl":"pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat","virtualPath":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","manifestName":"","pomArtifactID":"tomcat-coyote","archiveDigests":[{"value":"20f6014eba726230cc33ce7f0248b3261b7bae58","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.104"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3p2h-wqq4-wf4h","versionConstraint":">=9.0.76,<=9.0.102 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat:tomcat-coyote","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3p2h-wqq4-wf4h","fix":{"state":"fixed","versions":["9.0.104"],"available":[{"date":"2025-04-30","kind":"first-observed","version":"9.0.104"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-31650","cwe":"CWE-459","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-31650","cwe":"CWE-459","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-31650","date":"2026-11-02","epss":0.61322,"percentile":0.99164}],"risk":35.566759999999995,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-31650","https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826","http://www.openwall.com/lists/oss-security/2025/04/28/2","https://github.com/apache/tomcat/commit/1eef1dc459c45f1e421d8bd25ef340fc1cc34edc","https://github.com/apache/tomcat/commit/40ae788c2e64d018b4e58cd4210bb96434d0100d","https://github.com/apache/tomcat/commit/75554da2fc5574862510ae6f0d7b3d78937f1d40","https://github.com/apache/tomcat/commit/8cc3b8fb3f2d8d4d6a757e014f19d1fafa948a60","https://github.com/apache/tomcat/commit/b7674782679e1514a0d154166b1d04d38aaac4a9","https://github.com/apache/tomcat/commit/b98e74f517b36929f4208506e5adad22cb767baa","https://github.com/apache/tomcat/commit/cba1a0fe1289ee7f5dd46c61c38d1e1ac5437bff","https://github.com/apache/tomcat/commit/ded0285b96b4d3f5560dfc8856ad5ec4a9b50ba9","https://github.com/apache/tomcat/commit/f619e6a05029538886d5a9d987925d573b5bb8c2","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3p2h-wqq4-wf4h","description":"Apache Tomcat Denial of Service via invalid HTTP priority header"},"relatedVulnerabilities":[{"id":"CVE-2025-31650","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-31650","cwe":"CWE-459","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-31650","cwe":"CWE-459","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-31650","date":"2026-11-02","epss":0.61322,"percentile":0.99164}],"urls":["https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826","http://www.openwall.com/lists/oss-security/2025/04/28/2","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-31650","description":"Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.\n\nThis issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.90 though 8.5.100.\n\n\nUsers are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue."}]},{"artifact":{"id":"4d5407177cb8d0dd","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.18"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-6119","versionConstraint":"< 3.0.2-0ubuntu1.18 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6119","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.18"],"available":[{"date":"2024-09-03","kind":"advisory","version":"3.0.2-0ubuntu1.18"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6119","cwe":"CWE-843","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-6119","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6119","date":"2026-11-02","epss":0.66582,"percentile":0.99287}],"risk":33.291,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6119"},"relatedVulnerabilities":[{"id":"CVE-2024-6119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6119","cwe":"CWE-843","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-6119","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6119","date":"2026-11-02","epss":0.66582,"percentile":0.99287}],"urls":["https://github.com/openssl/openssl/commit/05f360d9e849a1b277db628f1f13083a7f8dd04f","https://github.com/openssl/openssl/commit/06d1dc3fa96a2ba5a3e22735a033012aadc9f0d6","https://github.com/openssl/openssl/commit/621f3729831b05ee828a3203eddb621d014ff2b2","https://github.com/openssl/openssl/commit/7dfcee2cd2a63b2c64b9b4b0850be64cb695b0a0","https://openssl-library.org/news/secadv/20240903.txt","http://www.openwall.com/lists/oss-security/2024/09/03/4","https://lists.freebsd.org/archives/freebsd-security/2024-September/000303.html","https://security.netapp.com/advisory/ntap-20240912-0001/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6119","description":"Issue summary: Applications performing certificate name checks (e.g., TLS\nclients checking server certificates) may attempt to read an invalid memory\naddress resulting in abnormal termination of the application process.\n\nImpact summary: Abnormal termination of an application can a cause a denial of\nservice.\n\nApplications performing certificate name checks (e.g., TLS clients checking\nserver certificates) may attempt to read an invalid memory address when\ncomparing the expected name with an `otherName` subject alternative name of an\nX.509 certificate. This may result in an exception that terminates the\napplication program.\n\nNote that basic certificate chain validation (signatures, dates, ...) is not\naffected, the denial of service can occur only when the application also\nspecifies an expected DNS name, Email address or IP address.\n\nTLS servers rarely solicit client certificates, and even when they do, they\ngenerally don't perform a name check against a reference identifier (expected\nidentity), but rather extract the presented identity after checking the\ncertificate chain.  So TLS servers are generally not affected and the severity\nof the issue is Moderate.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"1014a67cbf322356","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.18"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-6119","versionConstraint":"< 3.0.2-0ubuntu1.18 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6119","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.18"],"available":[{"date":"2024-09-03","kind":"advisory","version":"3.0.2-0ubuntu1.18"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6119","cwe":"CWE-843","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-6119","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6119","date":"2026-11-02","epss":0.66582,"percentile":0.99287}],"risk":33.291,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6119"},"relatedVulnerabilities":[{"id":"CVE-2024-6119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6119","cwe":"CWE-843","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-6119","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6119","date":"2026-11-02","epss":0.66582,"percentile":0.99287}],"urls":["https://github.com/openssl/openssl/commit/05f360d9e849a1b277db628f1f13083a7f8dd04f","https://github.com/openssl/openssl/commit/06d1dc3fa96a2ba5a3e22735a033012aadc9f0d6","https://github.com/openssl/openssl/commit/621f3729831b05ee828a3203eddb621d014ff2b2","https://github.com/openssl/openssl/commit/7dfcee2cd2a63b2c64b9b4b0850be64cb695b0a0","https://openssl-library.org/news/secadv/20240903.txt","http://www.openwall.com/lists/oss-security/2024/09/03/4","https://lists.freebsd.org/archives/freebsd-security/2024-September/000303.html","https://security.netapp.com/advisory/ntap-20240912-0001/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6119","description":"Issue summary: Applications performing certificate name checks (e.g., TLS\nclients checking server certificates) may attempt to read an invalid memory\naddress resulting in abnormal termination of the application process.\n\nImpact summary: Abnormal termination of an application can a cause a denial of\nservice.\n\nApplications performing certificate name checks (e.g., TLS clients checking\nserver certificates) may attempt to read an invalid memory address when\ncomparing the expected name with an `otherName` subject alternative name of an\nX.509 certificate. This may result in an exception that terminates the\napplication program.\n\nNote that basic certificate chain validation (signatures, dates, ...) is not\naffected, the denial of service can occur only when the application also\nspecifies an expected DNS name, Email address or IP address.\n\nTLS servers rarely solicit client certificates, and even when they do, they\ngenerally don't perform a name check against a reference identifier (expected\nidentity), but rather extract the presented identity after checking the\ncertificate chain.  So TLS servers are generally not affected and the severity\nof the issue is Moderate.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"868c3562ab4f302a","cpes":["cpe:2.3:a:org.springframework:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring_web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring_web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_web:5.3.30:*:*:*:*:*:*:*"],"name":"spring-web","purl":"pkg:maven/org.springframework/spring-web@5.3.30","type":"java-archive","version":"5.3.30","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-web-5.3.30.jar","manifestName":"","pomArtifactID":"spring-web","archiveDigests":[{"value":"e1a1fd179650d4ccbf95d3f475bf1050a1a84484","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-web-5.3.30.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-web-5.3.30.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.0.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4wrc-f8pq-fpqp","versionConstraint":"<6.0.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-web","version":"5.3.30"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4wrc-f8pq-fpqp","fix":{"state":"fixed","versions":["6.0.0"],"available":[{"date":"2022-12-10","kind":"first-observed","version":"6.0.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1000027","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-1000027","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-1000027","date":"2026-11-02","epss":0.33179,"percentile":0.98367}],"risk":31.18826,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-1000027","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027","https://security-tracker.debian.org/tracker/CVE-2016-1000027","https://www.tenable.com/security/research/tra-2016-20","https://github.com/spring-projects/spring-framework/issues/24434","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-1231625331","https://github.com/spring-projects/spring-framework/commit/5cbe90b2cd91b866a5a9586e460f311860e11cfa","https://support.contrastsecurity.com/hc/en-us/articles/4402400830612-Spring-web-Java-Deserialization-CVE-2016-1000027","https://github.com/spring-projects/spring-framework/issues/21680","https://github.com/spring-projects/spring-framework/commit/2b051b8b321768a4cfef83077db65c6328ffd60f","https://jira.spring.io/browse/SPR-17143?redirect=false","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-579669626","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-582313417","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-744519525","https://security.netapp.com/advisory/ntap-20230420-0009/","https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4wrc-f8pq-fpqp","description":"Pivotal Spring Framework contains unsafe Java deserialization methods"},"relatedVulnerabilities":[{"id":"CVE-2016-1000027","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1000027","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-1000027","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-1000027","date":"2026-11-02","epss":0.33179,"percentile":0.98367}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-579669626","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-582313417","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-744519525","https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000027.json","https://security-tracker.debian.org/tracker/CVE-2016-1000027","https://security.netapp.com/advisory/ntap-20230420-0009/","https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now","https://www.tenable.com/security/research/tra-2016-20"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1000027","description":"Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data."}]},{"artifact":{"id":"bf9c5af4fa5ab441","cpes":["cpe:2.3:a:apache:commons-fileupload:1.5:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_fileupload:1.5:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.5:*:*:*:*:*:*:*"],"name":"commons-fileupload","purl":"pkg:maven/commons-fileupload/commons-fileupload@1.5","type":"java-archive","version":"1.5","language":"java","licenses":[],"metadata":{"pomGroupID":"commons-fileupload","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:commons-fileupload:commons-fileupload","manifestName":"","pomArtifactID":"commons-fileupload","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.6.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vv7r-c36w-3prj","versionConstraint":">=1.0,<1.6.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-fileupload:commons-fileupload","version":"1.5"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vv7r-c36w-3prj","fix":{"state":"fixed","versions":["1.6.0"],"available":[{"date":"2025-07-10","kind":"first-observed","version":"1.6.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48976","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-48976","date":"2026-11-02","epss":0.32877,"percentile":0.98355}],"risk":26.63037,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48976","https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12","https://github.com/apache/commons-fileupload/commit/bf68f63cfb312ef4710fb3dfb4d8e4e1665f4497","http://www.openwall.com/lists/oss-security/2025/06/16/4","https://github.com/apache/tomcat/commit/97790a35a27d236fa053e660676c3f8196284d93","https://github.com/apache/commons-fileupload/commit/b247774a72a044f5d5380ae947140ee80af4e78b","https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vv7r-c36w-3prj","description":"Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers"},"relatedVulnerabilities":[{"id":"CVE-2025-48976","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48976","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-48976","date":"2026-11-02","epss":0.32877,"percentile":0.98355}],"urls":["https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12","http://www.openwall.com/lists/oss-security/2025/06/16/4","https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48976","description":"Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue."}]},{"artifact":{"id":"c0966957d2b4f45f","cpes":["cpe:2.3:a:apache:commons-fileupload:1.5:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_fileupload:1.5:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.5:*:*:*:*:*:*:*"],"name":"commons-fileupload","purl":"pkg:maven/commons-fileupload/commons-fileupload@1.5","type":"java-archive","version":"1.5","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"commons-fileupload","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/commons-fileupload_commons-fileupload-1.5.jar","manifestName":"","pomArtifactID":"commons-fileupload","archiveDigests":[{"value":"ad4ad2ab2961b4e1891472bd1a33fabefb0385f3","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/commons-fileupload_commons-fileupload-1.5.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/commons-fileupload_commons-fileupload-1.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.6.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vv7r-c36w-3prj","versionConstraint":">=1.0,<1.6.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-fileupload:commons-fileupload","version":"1.5"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vv7r-c36w-3prj","fix":{"state":"fixed","versions":["1.6.0"],"available":[{"date":"2025-07-10","kind":"first-observed","version":"1.6.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48976","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-48976","date":"2026-11-02","epss":0.32877,"percentile":0.98355}],"risk":26.63037,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48976","https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12","https://github.com/apache/commons-fileupload/commit/bf68f63cfb312ef4710fb3dfb4d8e4e1665f4497","http://www.openwall.com/lists/oss-security/2025/06/16/4","https://github.com/apache/tomcat/commit/97790a35a27d236fa053e660676c3f8196284d93","https://github.com/apache/commons-fileupload/commit/b247774a72a044f5d5380ae947140ee80af4e78b","https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vv7r-c36w-3prj","description":"Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers"},"relatedVulnerabilities":[{"id":"CVE-2025-48976","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48976","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-48976","date":"2026-11-02","epss":0.32877,"percentile":0.98355}],"urls":["https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12","http://www.openwall.com/lists/oss-security/2025/06/16/4","https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48976","description":"Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue."}]},{"artifact":{"id":"98cea09491eee31c","cpes":["cpe:2.3:a:apache:velocity:1.6.4-atlassian-26:*:*:*:*:*:*:*"],"name":"velocity","purl":"pkg:maven/org.apache.velocity/velocity@1.6.4-atlassian-26","type":"java-archive","version":"1.6.4-atlassian-26","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.velocity","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.velocity_velocity-1.6.4-atlassian-26.jar","manifestName":"","pomArtifactID":"velocity","archiveDigests":[{"value":"75227c46da66c80bb88a374eafa21f03927014f0","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.velocity_velocity-1.6.4-atlassian-26.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.velocity_velocity-1.6.4-atlassian-26.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-59j4-wjwp-mw9m","versionConstraint":"<=1.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.velocity:velocity","version":"1.6.4-atlassian-26"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-59j4-wjwp-mw9m","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-13936","date":"2026-11-02","epss":0.22709,"percentile":0.97727}],"risk":18.507835,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-13936","https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E","https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a@%3Cuser.velocity.apache.org%3E","https://lists.apache.org/thread.html/r3ea4c4c908505b20a4c268330dfe7188b90c84dcf777728d02068ae6@%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6@%3Ccommits.velocity.apache.org%3E","http://www.openwall.com/lists/oss-security/2021/03/10/1","https://lists.apache.org/thread.html/r0bc98e9cd080b4a13b905c571b9bed87e1a0878d44dbf21487c6cca4@%3Cdev.santuario.apache.org%3E","https://lists.apache.org/thread.html/rbee7270556f4172322936b5ecc9fabf0c09f00d4fa56c9de1963c340@%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/rd2a89e17e8a9b451ce655f1a34117752ea1d18a22ce580d8baa824fd@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rd7e865c87f9043c21d9c1fd9d4df866061d9a08cfc322771160d8058@%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/re641197d204765130618086238c73dd2ce5a3f94b33785b587d72726@%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/re8e7482fe54d289fc0229e61cc64947b63b12c3c312e9f25bf6f3b8c@%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/reab5978b54a9f4c078402161e30a89c42807b198814acadbe6c862c7@%3Cdev.ws.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/03/msg00019.html","https://lists.apache.org/thread.html/r17cb932fab14801b14e5b97a7f05192f4f366ef260c10d4a8dba8ac9@%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/r39de20c7e9c808b1f96790875d33e58c9c0aabb44fd9227e7b3dc5da@%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/r4cd59453b65d4ac290fcb3b71fdf32b4f1f8989025e89558deb5a245@%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/r7f209b837217d2a0fe5977fb692e7f15d37fa5de8214bcdc4c21d9a7@%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/r293284c6806c73f51098001ea86a14271c39f72cd76af9e946d9d9ad@%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/rf7d369de88dc88a1347006a3323b3746d849234db40a8edfd5ebc436@%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328@%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882@%3Cusers.activemq.apache.org%3E","https://security.gentoo.org/glsa/202107-52","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-59j4-wjwp-mw9m","description":"Sandbox Bypass in Apache Velocity Engine"},"relatedVulnerabilities":[{"id":"CVE-2020-13936","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-13936","date":"2026-11-02","epss":0.22709,"percentile":0.97727}],"urls":["http://www.openwall.com/lists/oss-security/2021/03/10/1","https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E","https://lists.apache.org/thread.html/r0bc98e9cd080b4a13b905c571b9bed87e1a0878d44dbf21487c6cca4%40%3Cdev.santuario.apache.org%3E","https://lists.apache.org/thread.html/r17cb932fab14801b14e5b97a7f05192f4f366ef260c10d4a8dba8ac9%40%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/r293284c6806c73f51098001ea86a14271c39f72cd76af9e946d9d9ad%40%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/r39de20c7e9c808b1f96790875d33e58c9c0aabb44fd9227e7b3dc5da%40%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/r3ea4c4c908505b20a4c268330dfe7188b90c84dcf777728d02068ae6%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/r4cd59453b65d4ac290fcb3b71fdf32b4f1f8989025e89558deb5a245%40%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/r7f209b837217d2a0fe5977fb692e7f15d37fa5de8214bcdc4c21d9a7%40%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6%40%3Ccommits.velocity.apache.org%3E","https://lists.apache.org/thread.html/rbee7270556f4172322936b5ecc9fabf0c09f00d4fa56c9de1963c340%40%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/rd2a89e17e8a9b451ce655f1a34117752ea1d18a22ce580d8baa824fd%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rd7e865c87f9043c21d9c1fd9d4df866061d9a08cfc322771160d8058%40%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/re641197d204765130618086238c73dd2ce5a3f94b33785b587d72726%40%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/re8e7482fe54d289fc0229e61cc64947b63b12c3c312e9f25bf6f3b8c%40%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/reab5978b54a9f4c078402161e30a89c42807b198814acadbe6c862c7%40%3Cdev.ws.apache.org%3E","https://lists.apache.org/thread.html/rf7d369de88dc88a1347006a3323b3746d849234db40a8edfd5ebc436%40%3Cdev.ws.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/03/msg00019.html","https://security.gentoo.org/glsa/202107-52","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-13936","description":"An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2."}]},{"artifact":{"id":"7f5afd36e2a50847","cpes":["cpe:2.3:a:curl:curl:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.16"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-2398","versionConstraint":"< 7.81.0-1ubuntu1.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-2398","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.16"],"available":[{"date":"2024-03-27","kind":"advisory","version":"7.81.0-1ubuntu1.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-2398","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-2398","date":"2026-11-02","epss":0.36081,"percentile":0.98474}],"risk":18.0405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2398"},"relatedVulnerabilities":[{"id":"CVE-2024-2398","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2398","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-2398","date":"2026-11-02","epss":0.36081,"percentile":0.98474}],"urls":["http://seclists.org/fulldisclosure/2024/Jul/18","http://seclists.org/fulldisclosure/2024/Jul/19","http://seclists.org/fulldisclosure/2024/Jul/20","http://www.openwall.com/lists/oss-security/2024/03/27/3","https://curl.se/docs/CVE-2024-2398.html","https://curl.se/docs/CVE-2024-2398.json","https://hackerone.com/reports/2402845","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/","https://security.netapp.com/advisory/ntap-20240503-0009/","https://support.apple.com/kb/HT214118","https://support.apple.com/kb/HT214119","https://support.apple.com/kb/HT214120","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-417159.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2398","description":"When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory.  Further, this error condition fails silently and is therefore not easily detected by an application."}]},{"artifact":{"id":"eebde1772607afd6","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2398","versionConstraint":"< 7.81.0-1ubuntu1.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-2398","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.16"],"available":[{"date":"2024-03-27","kind":"advisory","version":"7.81.0-1ubuntu1.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-2398","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-2398","date":"2026-11-02","epss":0.36081,"percentile":0.98474}],"risk":18.0405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2398"},"relatedVulnerabilities":[{"id":"CVE-2024-2398","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2398","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-2398","date":"2026-11-02","epss":0.36081,"percentile":0.98474}],"urls":["http://seclists.org/fulldisclosure/2024/Jul/18","http://seclists.org/fulldisclosure/2024/Jul/19","http://seclists.org/fulldisclosure/2024/Jul/20","http://www.openwall.com/lists/oss-security/2024/03/27/3","https://curl.se/docs/CVE-2024-2398.html","https://curl.se/docs/CVE-2024-2398.json","https://hackerone.com/reports/2402845","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/","https://security.netapp.com/advisory/ntap-20240503-0009/","https://support.apple.com/kb/HT214118","https://support.apple.com/kb/HT214119","https://support.apple.com/kb/HT214120","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-417159.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2398","description":"When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory.  Further, this error condition fails silently and is therefore not easily detected by an application."}]},{"artifact":{"id":"a8f1f07e02daddd2","cpes":["cpe:2.3:a:org.springframework:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring_webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring_webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_webmvc:5.3.30:*:*:*:*:*:*:*"],"name":"spring-webmvc","purl":"pkg:maven/org.springframework/spring-webmvc@5.3.30","type":"java-archive","version":"5.3.30","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-webmvc-5.3.30.jar","manifestName":"","pomArtifactID":"spring-webmvc","archiveDigests":[{"value":"67ad9ebc6189c91942a52328f58d824cd3171fd9","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-webmvc-5.3.30.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-webmvc-5.3.30.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cx7f-g6mp-7hqm","versionConstraint":">=5.3.0,<=5.3.39 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-webmvc","version":"5.3.30"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cx7f-g6mp-7hqm","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38816","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-38816","date":"2026-11-02","epss":0.21263,"percentile":0.97597}],"risk":15.947250000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-38816","https://spring.io/security/cve-2024-38816","https://github.com/spring-projects/spring-framework/commit/d86bf8b2056429edf5494456cffcb2b243331c49","https://security.netapp.com/advisory/ntap-20241227-0001"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cx7f-g6mp-7hqm","description":"Path traversal vulnerability in functional web frameworks"},"relatedVulnerabilities":[{"id":"CVE-2024-38816","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38816","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-38816","date":"2026-11-02","epss":0.21263,"percentile":0.97597}],"urls":["https://spring.io/security/cve-2024-38816","https://security.netapp.com/advisory/ntap-20241227-0001/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-38816","description":"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.\n\nSpecifically, an application is vulnerable when both of the following are true:\n\n  *  the web application uses RouterFunctions to serve static resources\n  *  resource handling is explicitly configured with a FileSystemResource location\n\n\nHowever, malicious requests are blocked and rejected when any of the following is true:\n\n  *  the  Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html  is in use\n  *  the application runs on Tomcat or Jetty"}]},{"artifact":{"id":"4d5407177cb8d0dd","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2511","versionConstraint":"< 3.0.2-0ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-2511","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.17"],"available":[{"date":"2024-07-31","kind":"advisory","version":"3.0.2-0ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-11-02","epss":0.52421,"percentile":0.98964}],"risk":15.726299999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2511"},"relatedVulnerabilities":[{"id":"CVE-2024-2511","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-11-02","epss":0.52421,"percentile":0.98964}],"urls":["https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce","https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d","https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08","https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640","https://www.openssl.org/news/secadv/20240408.txt","http://www.openwall.com/lists/oss-security/2024/04/08/5","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240503-0013/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-354112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2511","description":"Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue."}]},{"artifact":{"id":"1014a67cbf322356","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.17"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-2511","versionConstraint":"< 3.0.2-0ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-2511","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.17"],"available":[{"date":"2024-07-31","kind":"advisory","version":"3.0.2-0ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-11-02","epss":0.52421,"percentile":0.98964}],"risk":15.726299999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2511"},"relatedVulnerabilities":[{"id":"CVE-2024-2511","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-11-02","epss":0.52421,"percentile":0.98964}],"urls":["https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce","https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d","https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08","https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640","https://www.openssl.org/news/secadv/20240408.txt","http://www.openwall.com/lists/oss-security/2024/04/08/5","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240503-0013/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-354112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2511","description":"Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue."}]},{"artifact":{"id":"b5908a848b6d6ee8","cpes":["cpe:2.3:a:org.jdom:jdom:1.1.3-atlassian-5:*:*:*:*:*:*:*","cpe:2.3:a:jdom:jdom:1.1.3-atlassian-5:*:*:*:*:*:*:*"],"name":"jdom","purl":"pkg:maven/org.jdom/jdom@1.1.3-atlassian-5","type":"java-archive","version":"1.1.3-atlassian-5","language":"java","licenses":["sha256:dca7f0551de2ea96da344623d8545237e9450887e4be178cb1c5ef179c7692f0"],"metadata":{"pomGroupID":"org.jdom","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.jdom_jdom-1.1.3-atlassian-5.jar","manifestName":"","pomArtifactID":"jdom","archiveDigests":[{"value":"70e8fbf96e76bea4a365b31827ff0820d21e3d16","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.jdom_jdom-1.1.3-atlassian-5.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.jdom_jdom-1.1.3-atlassian-5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2363-cqg2-863c","versionConstraint":"<=2.0.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jdom:jdom","version":"1.1.3-atlassian-5"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-2363-cqg2-863c","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33813","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33813","date":"2026-11-02","epss":0.19442,"percentile":0.97367}],"risk":14.5815,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-33813","https://github.com/hunterhacker/jdom/pull/188","https://alephsecurity.com/vulns/aleph-2021003","https://lists.apache.org/thread.html/r89b3800cfabb1e773e49425e5d4239c28a659839a2eca6af3431482e@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r9974f64723875052e02787b2a5eda689ac5247c71b827d455e5dc9a6@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rbc075a4ac85e7a8e47420b7383f16ffa0af3b792b8423584735f369f@%3Cissues.solr.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/06/msg00026.html","https://lists.debian.org/debian-lts-announce/2021/07/msg00012.html","https://lists.apache.org/thread.html/r21c406c7ed88fe340db7dbae75e58355159e6c324037c7d5547bf40b@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5674106135bb1a6ef57483f4c63a9c44bca85d0e2a8a05895a8f1d89@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r6db397ae7281ead825338200d1f62d2827585a70797cc9ac0c4bd23f@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r845e987b7cd8efe610284958e997b84583f5a98d3394adc09e3482fe@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rfb7a93e40ebeb1e0068cde0bf3834dcab46bb1ef06d6424db48ed9fd@%3Cdev.tika.apache.org%3E","https://github.com/hunterhacker/jdom/commit/dd4f3c2fc7893edd914954c73eb577f925a7d361","https://github.com/hunterhacker/jdom/releases","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/hunterhacker/jdom/issues/189","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EWFVYTHGILOQXUA7U3SPOERQXL7OPSZG","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AH46QHE5GIMT6BL6C3GDTOYF27JYILXM","https://github.com/hunterhacker/jdom/releases/tag/JDOM-2.0.6.1"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2363-cqg2-863c","description":"XML External Entity (XXE) Injection in JDOM"},"relatedVulnerabilities":[{"id":"CVE-2021-33813","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33813","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33813","date":"2026-11-02","epss":0.19442,"percentile":0.97367}],"urls":["https://alephsecurity.com/vulns/aleph-2021003","https://github.com/hunterhacker/jdom/pull/188","https://github.com/hunterhacker/jdom/releases","https://lists.apache.org/thread.html/r21c406c7ed88fe340db7dbae75e58355159e6c324037c7d5547bf40b%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5674106135bb1a6ef57483f4c63a9c44bca85d0e2a8a05895a8f1d89%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r6db397ae7281ead825338200d1f62d2827585a70797cc9ac0c4bd23f%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r845e987b7cd8efe610284958e997b84583f5a98d3394adc09e3482fe%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r89b3800cfabb1e773e49425e5d4239c28a659839a2eca6af3431482e%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r9974f64723875052e02787b2a5eda689ac5247c71b827d455e5dc9a6%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rbc075a4ac85e7a8e47420b7383f16ffa0af3b792b8423584735f369f%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rfb7a93e40ebeb1e0068cde0bf3834dcab46bb1ef06d6424db48ed9fd%40%3Cdev.tika.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/06/msg00026.html","https://lists.debian.org/debian-lts-announce/2021/07/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AH46QHE5GIMT6BL6C3GDTOYF27JYILXM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWFVYTHGILOQXUA7U3SPOERQXL7OPSZG/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33813","description":"An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request."}]},{"artifact":{"id":"c87a73d6229303b3","cpes":["cpe:2.3:a:apache:tomcat-coyote:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_coyote:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-coyote","purl":"pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat","virtualPath":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","manifestName":"","pomArtifactID":"tomcat-coyote","archiveDigests":[{"value":"20f6014eba726230cc33ce7f0248b3261b7bae58","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.86"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7w75-32cg-r6g2","versionConstraint":">=9.0.0-M1,<=9.0.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat:tomcat-coyote","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7w75-32cg-r6g2","fix":{"state":"fixed","versions":["9.0.86"],"available":[{"date":"2024-04-12","kind":"first-observed","version":"9.0.86"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-24549","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-24549","date":"2026-11-02","epss":0.23072,"percentile":0.97759}],"risk":13.90088,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-24549","https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg","https://github.com/apache/tomcat/commit/0cac540a882220231ba7a82330483cbd5f6b1f96","https://github.com/apache/tomcat/commit/810f49d5ff6d64b704af85d5b8d0aab9ec3c83f5","https://github.com/apache/tomcat/commit/8e03be9f2698f2da9027d40b9e9c0c9429b74dc0","https://github.com/apache/tomcat/commit/d07c82194edb69d99b438828fe2cbfadbb207843","https://security.netapp.com/advisory/ntap-20240402-0002","https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html","http://www.openwall.com/lists/oss-security/2024/03/13/3","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7w75-32cg-r6g2","description":"Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests"},"relatedVulnerabilities":[{"id":"CVE-2024-24549","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-24549","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-24549","date":"2026-11-02","epss":0.23072,"percentile":0.97759}],"urls":["https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg","http://www.openwall.com/lists/oss-security/2024/03/13/3","https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55/","https://security.netapp.com/advisory/ntap-20240402-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-24549","description":"Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue."}]},{"artifact":{"id":"7f5afd36e2a50847","cpes":["cpe:2.3:a:curl:curl:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.17"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-7264","versionConstraint":"< 7.81.0-1ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.17"],"available":[{"date":"2024-08-05","kind":"advisory","version":"7.81.0-1ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-02","epss":0.20217,"percentile":0.97465}],"risk":10.1085,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7264"},"relatedVulnerabilities":[{"id":"CVE-2024-7264","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-02","epss":0.20217,"percentile":0.97465}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."}]},{"artifact":{"id":"eebde1772607afd6","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7264","versionConstraint":"< 7.81.0-1ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.17"],"available":[{"date":"2024-08-05","kind":"advisory","version":"7.81.0-1ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-02","epss":0.20217,"percentile":0.97465}],"risk":10.1085,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7264"},"relatedVulnerabilities":[{"id":"CVE-2024-7264","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-02","epss":0.20217,"percentile":0.97465}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."}]},{"artifact":{"id":"fb7895faf09fd4e5","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.19.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.2-2ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-3596","versionConstraint":"< 1.19.2-2ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-3596","fix":{"state":"fixed","versions":["1.19.2-2ubuntu0.5"],"available":[{"date":"2025-02-05","kind":"advisory","version":"1.19.2-2ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"risk":7.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-3596"},"relatedVulnerabilities":[{"id":"CVE-2024-3596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/09/4","https://cert-portal.siemens.com/productcert/html/ssa-723487.html","https://cert-portal.siemens.com/productcert/html/ssa-794185.html","https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/","https://datatracker.ietf.org/doc/html/rfc2865","https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014","https://www.blastradius.fail/","https://security.netapp.com/advisory/ntap-20240822-0001/","https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol","https://www.kb.cert.org/vuls/id/456537","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-770770.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-3596","description":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature."}]},{"artifact":{"id":"33db6cef15da892e","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.19.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.2-2ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-3596","versionConstraint":"< 1.19.2-2ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-3596","fix":{"state":"fixed","versions":["1.19.2-2ubuntu0.5"],"available":[{"date":"2025-02-05","kind":"advisory","version":"1.19.2-2ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"risk":7.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-3596"},"relatedVulnerabilities":[{"id":"CVE-2024-3596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/09/4","https://cert-portal.siemens.com/productcert/html/ssa-723487.html","https://cert-portal.siemens.com/productcert/html/ssa-794185.html","https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/","https://datatracker.ietf.org/doc/html/rfc2865","https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014","https://www.blastradius.fail/","https://security.netapp.com/advisory/ntap-20240822-0001/","https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol","https://www.kb.cert.org/vuls/id/456537","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-770770.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-3596","description":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature."}]},{"artifact":{"id":"8baf93711e927f68","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.19.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.2-2ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-3596","versionConstraint":"< 1.19.2-2ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-3596","fix":{"state":"fixed","versions":["1.19.2-2ubuntu0.5"],"available":[{"date":"2025-02-05","kind":"advisory","version":"1.19.2-2ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"risk":7.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-3596"},"relatedVulnerabilities":[{"id":"CVE-2024-3596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/09/4","https://cert-portal.siemens.com/productcert/html/ssa-723487.html","https://cert-portal.siemens.com/productcert/html/ssa-794185.html","https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/","https://datatracker.ietf.org/doc/html/rfc2865","https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014","https://www.blastradius.fail/","https://security.netapp.com/advisory/ntap-20240822-0001/","https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol","https://www.kb.cert.org/vuls/id/456537","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-770770.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-3596","description":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature."}]},{"artifact":{"id":"6e90bedd237fee0a","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.19.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.2-2ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-3596","versionConstraint":"< 1.19.2-2ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-3596","fix":{"state":"fixed","versions":["1.19.2-2ubuntu0.5"],"available":[{"date":"2025-02-05","kind":"advisory","version":"1.19.2-2ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"risk":7.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-3596"},"relatedVulnerabilities":[{"id":"CVE-2024-3596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/09/4","https://cert-portal.siemens.com/productcert/html/ssa-723487.html","https://cert-portal.siemens.com/productcert/html/ssa-794185.html","https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/","https://datatracker.ietf.org/doc/html/rfc2865","https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014","https://www.blastradius.fail/","https://security.netapp.com/advisory/ntap-20240822-0001/","https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol","https://www.kb.cert.org/vuls/id/456537","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-770770.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-3596","description":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature."}]},{"artifact":{"id":"49e5c396bdcf8fe7","cpes":["cpe:2.3:a:commons-httpclient:commons-httpclient:3.1-atlassian-2:*:*:*:*:*:*:*","cpe:2.3:a:commons-httpclient:commons_httpclient:3.1-atlassian-2:*:*:*:*:*:*:*","cpe:2.3:a:commons_httpclient:commons-httpclient:3.1-atlassian-2:*:*:*:*:*:*:*","cpe:2.3:a:commons_httpclient:commons_httpclient:3.1-atlassian-2:*:*:*:*:*:*:*","cpe:2.3:a:commons:commons-httpclient:3.1-atlassian-2:*:*:*:*:*:*:*","cpe:2.3:a:commons:commons_httpclient:3.1-atlassian-2:*:*:*:*:*:*:*"],"name":"commons-httpclient","purl":"pkg:maven/commons-httpclient/commons-httpclient@3.1-atlassian-2","type":"java-archive","version":"3.1-atlassian-2","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"commons-httpclient","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/commons-httpclient_commons-httpclient-3.1-atlassian-2.jar","manifestName":"","pomArtifactID":"commons-httpclient","archiveDigests":[{"value":"1e4ff544b54f14355360aa5908e518f22567215e","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/commons-httpclient_commons-httpclient-3.1-atlassian-2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/commons-httpclient_commons-httpclient-3.1-atlassian-2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3832-9276-x7gf","versionConstraint":">=3.0,<4.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-httpclient:commons-httpclient","version":"3.1-atlassian-2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3832-9276-x7gf","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2012-5783","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-5783","date":"2026-11-02","epss":0.09254,"percentile":0.95357}],"risk":4.627,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2012-5783","https://access.redhat.com/errata/RHSA-2017:0868","https://exchange.xforce.ibmcloud.com/vulnerabilities/79984","https://issues.apache.org/jira/browse/HTTPCLIENT-1265","http://lists.opensuse.org/opensuse-updates/2013-02/msg00078.html","http://lists.opensuse.org/opensuse-updates/2013-04/msg00040.html","http://lists.opensuse.org/opensuse-updates/2013-04/msg00041.html","http://lists.opensuse.org/opensuse-updates/2013-04/msg00053.html","http://rhn.redhat.com/errata/RHSA-2013-0270.html","http://rhn.redhat.com/errata/RHSA-2013-0679.html","http://rhn.redhat.com/errata/RHSA-2013-0680.html","http://rhn.redhat.com/errata/RHSA-2013-0682.html","http://rhn.redhat.com/errata/RHSA-2013-1853.html","http://rhn.redhat.com/errata/RHSA-2014-0224.html","http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf","http://www.ubuntu.com/usn/USN-2769-1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3832-9276-x7gf","description":"Improper Certificate Validation in Apache Commons HttpClient"},"relatedVulnerabilities":[{"id":"CVE-2012-5783","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2012-5783","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-5783","date":"2026-11-02","epss":0.09254,"percentile":0.95357}],"urls":["http://lists.opensuse.org/opensuse-updates/2013-02/msg00078.html","http://lists.opensuse.org/opensuse-updates/2013-04/msg00040.html","http://lists.opensuse.org/opensuse-updates/2013-04/msg00041.html","http://lists.opensuse.org/opensuse-updates/2013-04/msg00053.html","http://rhn.redhat.com/errata/RHSA-2013-0270.html","http://rhn.redhat.com/errata/RHSA-2013-0679.html","http://rhn.redhat.com/errata/RHSA-2013-0680.html","http://rhn.redhat.com/errata/RHSA-2013-0681.html","http://rhn.redhat.com/errata/RHSA-2013-0682.html","http://rhn.redhat.com/errata/RHSA-2013-1147.html","http://rhn.redhat.com/errata/RHSA-2013-1853.html","http://rhn.redhat.com/errata/RHSA-2014-0224.html","http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf","http://www.securityfocus.com/bid/58073","http://www.ubuntu.com/usn/USN-2769-1","https://access.redhat.com/errata/RHSA-2017:0868","https://exchange.xforce.ibmcloud.com/vulnerabilities/79984","https://issues.apache.org/jira/browse/HTTPCLIENT-1265"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2012-5783","description":"Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate."}]},{"artifact":{"id":"c87a73d6229303b3","cpes":["cpe:2.3:a:apache:tomcat-coyote:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_coyote:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-coyote","purl":"pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat","virtualPath":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","manifestName":"","pomArtifactID":"tomcat-coyote","archiveDigests":[{"value":"20f6014eba726230cc33ce7f0248b3261b7bae58","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.90"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wm9w-rjj3-j356","versionConstraint":">=9.0.0-M1,<9.0.90 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat:tomcat-coyote","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wm9w-rjj3-j356","fix":{"state":"fixed","versions":["9.0.90"],"available":[{"date":"2024-07-06","kind":"first-observed","version":"9.0.90"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-34750","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2024-34750","cwe":"CWE-755","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-34750","date":"2026-11-02","epss":0.04602,"percentile":0.91667}],"risk":3.58956,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-34750","https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l","https://github.com/apache/tomcat/commit/2344a4c0d03e307ba6b8ab6dc8b894cc8bac63f2","https://github.com/apache/tomcat/commit/2afae300c9ac9c0e516e2e9de580847d925365c3","https://github.com/apache/tomcat/commit/9fec9a82887853402833a80b584e3762c7423f5f","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html","https://security.netapp.com/advisory/ntap-20240816-0004","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wm9w-rjj3-j356","description":"Apache Tomcat - Denial of Service"},"relatedVulnerabilities":[{"id":"CVE-2024-34750","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-34750","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2024-34750","cwe":"CWE-755","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-34750","date":"2026-11-02","epss":0.04602,"percentile":0.91667}],"urls":["https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html","https://security.netapp.com/advisory/ntap-20240816-0004/","https://github.com/apache/tomcat/commit/2344a4c0d03e307ba6b8ab6dc8b894cc8bac63f2","https://github.com/apache/tomcat/commit/2afae300c9ac9c0e516e2e9de580847d925365c3","https://github.com/apache/tomcat/commit/9fec9a82887853402833a80b584e3762c7423f5f"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-34750","description":"Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue."}]},{"artifact":{"id":"868c3562ab4f302a","cpes":["cpe:2.3:a:org.springframework:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring_web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring_web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_web:5.3.30:*:*:*:*:*:*:*"],"name":"spring-web","purl":"pkg:maven/org.springframework/spring-web@5.3.30","type":"java-archive","version":"5.3.30","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-web-5.3.30.jar","manifestName":"","pomArtifactID":"spring-web","archiveDigests":[{"value":"e1a1fd179650d4ccbf95d3f475bf1050a1a84484","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-web-5.3.30.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-web-5.3.30.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.3.32"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-ccgv-vj62-xf9h","versionConstraint":">=5.3.0,<5.3.32 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-web","version":"5.3.30"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-ccgv-vj62-xf9h","fix":{"state":"fixed","versions":["5.3.32"],"available":[{"date":"2024-02-25","kind":"first-observed","version":"5.3.32"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-22243","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-22243","date":"2026-11-02","epss":0.03967,"percentile":0.90459}],"risk":3.09426,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-22243","https://spring.io/security/cve-2024-22243","https://github.com/spring-projects/spring-framework/blob/main/spring-web/src/main/java/org/springframework/web/util/UriComponentsBuilder.java","https://security.netapp.com/advisory/ntap-20240524-0001","http://seclists.org/fulldisclosure/2024/Sep/24"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-ccgv-vj62-xf9h","description":"Spring Web vulnerable to Open Redirect or Server Side Request Forgery"},"relatedVulnerabilities":[{"id":"CVE-2024-22243","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-22243","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-22243","date":"2026-11-02","epss":0.03967,"percentile":0.90459}],"urls":["https://security.netapp.com/advisory/ntap-20240524-0001/","https://spring.io/security/cve-2024-22243","http://seclists.org/fulldisclosure/2024/Sep/24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-22243","description":"Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a  open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks."}]},{"artifact":{"id":"7d1b364f288bebeb","cpes":["cpe:2.3:a:apache:avro:1.11.3:*:*:*:*:*:*:*"],"name":"avro","purl":"pkg:maven/org.apache.avro/avro@1.11.3","type":"java-archive","version":"1.11.3","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.avro","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar:org.apache.avro:avro","manifestName":"","pomArtifactID":"avro","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7pg-v2c8-mfg3","versionConstraint":"<1.11.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.avro:avro","version":"1.11.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r7pg-v2c8-mfg3","fix":{"state":"fixed","versions":["1.11.4"],"available":[{"date":"2024-10-09","kind":"first-observed","version":"1.11.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47561","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-47561","date":"2026-11-02","epss":0.03256,"percentile":0.88355}],"risk":3.0199399999999996,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-47561","https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x","https://github.com/apache/avro/pull/2934","https://github.com/apache/avro/pull/2980","https://github.com/apache/avro/commit/8f89868d29272e3afea2ff8de8c85cb81a57d900","https://github.com/apache/avro/commit/f6b3bd7e50e6e09fedddb98c61558c022ba31285","https://issues.apache.org/jira/browse/AVRO-3985","https://thehackernews.com/2024/10/critical-apache-avro-sdk-flaw-allows.html","https://www.openwall.com/lists/oss-security/2024/10/03/1","https://security.netapp.com/advisory/ntap-20241011-0003","http://www.openwall.com/lists/oss-security/2024/10/03/1"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7pg-v2c8-mfg3","description":"Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)"},"relatedVulnerabilities":[{"id":"CVE-2024-47561","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47561","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-47561","date":"2026-11-02","epss":0.03256,"percentile":0.88355}],"urls":["https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x","http://www.openwall.com/lists/oss-security/2024/10/03/1","https://security.netapp.com/advisory/ntap-20241011-0003/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47561","description":"Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code.\nUsers are recommended to upgrade to version 1.11.4  or 1.12.0, which fix this issue."}]},{"artifact":{"id":"4d5407177cb8d0dd","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.25"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45447","versionConstraint":"< 3.0.2-0ubuntu1.25 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-45447","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.25"],"available":[{"date":"2026-06-09","kind":"advisory","version":"3.0.2-0ubuntu1.25"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-11-02","epss":0.04002,"percentile":0.90539}],"risk":3.0015,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45447"},"relatedVulnerabilities":[{"id":"CVE-2026-45447","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-11-02","epss":0.04002,"percentile":0.90539}],"urls":["https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c","https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8","https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54","https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c","https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e","https://openssl-library.org/news/secadv/20260609.txt","https://access.redhat.com/errata/RHSA-2026:25237","https://access.redhat.com/errata/RHSA-2026:25239","https://access.redhat.com/errata/RHSA-2026:26275","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:34102","https://access.redhat.com/errata/RHSA-2026:35869","https://access.redhat.com/errata/RHSA-2026:36215","https://access.redhat.com/errata/RHSA-2026:36217","https://access.redhat.com/errata/RHSA-2026:39009","https://access.redhat.com/errata/RHSA-2026:39012","https://access.redhat.com/errata/RHSA-2026:39981","https://access.redhat.com/errata/RHSA-2026:44438","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:58563","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:66524","https://access.redhat.com/security/cve/CVE-2026-45447","https://bugzilla.redhat.com/show_bug.cgi?id=2481898","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45447","description":"Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"1014a67cbf322356","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.25"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-45447","versionConstraint":"< 3.0.2-0ubuntu1.25 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-45447","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.25"],"available":[{"date":"2026-06-09","kind":"advisory","version":"3.0.2-0ubuntu1.25"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-11-02","epss":0.04002,"percentile":0.90539}],"risk":3.0015,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45447"},"relatedVulnerabilities":[{"id":"CVE-2026-45447","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-11-02","epss":0.04002,"percentile":0.90539}],"urls":["https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c","https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8","https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54","https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c","https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e","https://openssl-library.org/news/secadv/20260609.txt","https://access.redhat.com/errata/RHSA-2026:25237","https://access.redhat.com/errata/RHSA-2026:25239","https://access.redhat.com/errata/RHSA-2026:26275","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:34102","https://access.redhat.com/errata/RHSA-2026:35869","https://access.redhat.com/errata/RHSA-2026:36215","https://access.redhat.com/errata/RHSA-2026:36217","https://access.redhat.com/errata/RHSA-2026:39009","https://access.redhat.com/errata/RHSA-2026:39012","https://access.redhat.com/errata/RHSA-2026:39981","https://access.redhat.com/errata/RHSA-2026:44438","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:58563","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:66524","https://access.redhat.com/security/cve/CVE-2026-45447","https://bugzilla.redhat.com/show_bug.cgi?id=2481898","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45447","description":"Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.28"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-30761","versionConstraint":"< 1.8.0_462||>= 1.9, < 8.0.462||>= 9, < 11.0.28 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-30761","fix":{"state":"fixed","versions":["1.8.0_462","8.0.462","11.0.28"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_462"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.462"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.28"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-30761","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-30761","date":"2026-11-02","epss":0.0523,"percentile":0.9252}],"risk":2.85035,"urls":["https://www.oracle.com/security-alerts/cpujul2025.html","http://www.openwall.com/lists/oss-security/2025/07/16/1","http://www.openwall.com/lists/oss-security/2025/07/21/3","http://www.openwall.com/lists/oss-security/2025/07/24/1","https://lists.debian.org/debian-lts-announce/2025/07/msg00011.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-30761","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting).  Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and  11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"c87a73d6229303b3","cpes":["cpe:2.3:a:apache:tomcat-coyote:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_coyote:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-coyote","purl":"pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat","virtualPath":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","manifestName":"","pomArtifactID":"tomcat-coyote","archiveDigests":[{"value":"20f6014eba726230cc33ce7f0248b3261b7bae58","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.108"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gqp3-2cvr-x8m3","versionConstraint":">=9.0.0.M1,<9.0.108 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat:tomcat-coyote","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gqp3-2cvr-x8m3","fix":{"state":"fixed","versions":["9.0.108"],"available":[{"date":"2025-08-14","kind":"first-observed","version":"9.0.108"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48989","cwe":"CWE-404","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48989","date":"2026-11-02","epss":0.03686,"percentile":0.89695}],"risk":2.7644999999999995,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48989","https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf","https://github.com/apache/tomcat/commit/73c04a10395774bda71a0b37802cf983662ce255","https://github.com/apache/tomcat/commit/f362c8eb3b8ec5b7f312f7f5610731c0fb299a06","https://github.com/apache/tomcat/commit/f36b8a4eea4ce8a0bc035079e1d259d29f5eb7bf","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html","https://www.kb.cert.org/vuls/id/767506","http://www.openwall.com/lists/oss-security/2025/08/13/2","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gqp3-2cvr-x8m3","description":"Apache Tomcat Improper Resource Shutdown or Release vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-48989","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48989","cwe":"CWE-404","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48989","date":"2026-11-02","epss":0.03686,"percentile":0.89695}],"urls":["https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf","http://www.openwall.com/lists/oss-security/2025/08/13/2","https://www.kb.cert.org/vuls/id/767506","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48989","description":"Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue."}]},{"artifact":{"id":"868c3562ab4f302a","cpes":["cpe:2.3:a:org.springframework:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring_web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring_web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_web:5.3.30:*:*:*:*:*:*:*"],"name":"spring-web","purl":"pkg:maven/org.springframework/spring-web@5.3.30","type":"java-archive","version":"5.3.30","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-web-5.3.30.jar","manifestName":"","pomArtifactID":"spring-web","archiveDigests":[{"value":"e1a1fd179650d4ccbf95d3f475bf1050a1a84484","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-web-5.3.30.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-web-5.3.30.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.3.33"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hgjh-9rj2-g67j","versionConstraint":"<5.3.33 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-web","version":"5.3.30"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hgjh-9rj2-g67j","fix":{"state":"fixed","versions":["5.3.33"],"available":[{"date":"2024-03-19","kind":"first-observed","version":"5.3.33"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-22259","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-22259","date":"2026-11-02","epss":0.02573,"percentile":0.85177}],"risk":2.00694,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-22259","https://spring.io/security/cve-2024-22259","https://github.com/spring-projects/spring-framework/commit/297cbae2990e1413537c55845a7e0ea0ffd9f9bb","https://github.com/spring-projects/spring-framework/commit/381f790329a48b74c2a49fc1384dd68ca9153501","https://github.com/spring-projects/spring-framework/commit/f2fd2f12269c6a781c5b2c20b3c24141055a3d68","https://security.netapp.com/advisory/ntap-20240524-0002"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hgjh-9rj2-g67j","description":"Spring Framework URL Parsing with Host Validation Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-22259","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-22259","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-22259","date":"2026-11-02","epss":0.02573,"percentile":0.85177}],"urls":["https://security.netapp.com/advisory/ntap-20240524-0002/","https://spring.io/security/cve-2024-22259"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-22259","description":"Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a  open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.\n\nThis is the same as  CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input."}]},{"artifact":{"id":"4d5407177cb8d0dd","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.19"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-9143","versionConstraint":"< 3.0.2-0ubuntu1.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-9143","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.19"],"available":[{"date":"2025-02-20","kind":"advisory","version":"3.0.2-0ubuntu1.19"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-9143","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-9143","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-9143","date":"2026-11-02","epss":0.05842,"percentile":0.93174}],"risk":1.7526,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9143"},"relatedVulnerabilities":[{"id":"CVE-2024-9143","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9143","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-9143","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-9143","date":"2026-11-02","epss":0.05842,"percentile":0.93174}],"urls":["https://github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712","https://github.com/openssl/openssl/commit/bc7e04d7c8d509fb78fc0e285aa948fb0da04700","https://github.com/openssl/openssl/commit/c0d3e4d32d2805f49bec30547f225bc4d092e1f4","https://github.com/openssl/openssl/commit/fdf6723362ca51bd883295efe206cb5b1cfa5154","https://github.openssl.org/openssl/extended-releases/commit/8efc0cbaa8ebba8e116f7b81a876a4123594d86a","https://github.openssl.org/openssl/extended-releases/commit/9d576994cec2b7aa37a91740ea7e680810957e41","https://openssl-library.org/news/secadv/20241016.txt","http://www.openwall.com/lists/oss-security/2024/10/16/1","http://www.openwall.com/lists/oss-security/2024/10/23/1","http://www.openwall.com/lists/oss-security/2024/10/24/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20241101-0001/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9143","description":"Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted\nexplicit values for the field polynomial can lead to out-of-bounds memory reads\nor writes.\n\nImpact summary: Out of bound memory writes can lead to an application crash or\neven a possibility of a remote code execution, however, in all the protocols\ninvolving Elliptic Curve Cryptography that we're aware of, either only \"named\ncurves\" are supported, or, if explicit curve parameters are supported, they\nspecify an X9.62 encoding of binary (GF(2^m)) curves that can't represent\nproblematic input values. Thus the likelihood of existence of a vulnerable\napplication is low.\n\nIn particular, the X9.62 encoding is used for ECC keys in X.509 certificates,\nso problematic inputs cannot occur in the context of processing X.509\ncertificates.  Any problematic use-cases would have to be using an \"exotic\"\ncurve encoding.\n\nThe affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(),\nand various supporting BN_GF2m_*() functions.\n\nApplications working with \"exotic\" explicit binary (GF(2^m)) curve parameters,\nthat make it possible to represent invalid field polynomials with a zero\nconstant term, via the above or similar APIs, may terminate abruptly as a\nresult of reading or writing outside of array bounds.  Remote code execution\ncannot easily be ruled out.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"1014a67cbf322356","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.19"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-9143","versionConstraint":"< 3.0.2-0ubuntu1.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-9143","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.19"],"available":[{"date":"2025-02-20","kind":"advisory","version":"3.0.2-0ubuntu1.19"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-9143","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-9143","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-9143","date":"2026-11-02","epss":0.05842,"percentile":0.93174}],"risk":1.7526,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9143"},"relatedVulnerabilities":[{"id":"CVE-2024-9143","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9143","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-9143","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-9143","date":"2026-11-02","epss":0.05842,"percentile":0.93174}],"urls":["https://github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712","https://github.com/openssl/openssl/commit/bc7e04d7c8d509fb78fc0e285aa948fb0da04700","https://github.com/openssl/openssl/commit/c0d3e4d32d2805f49bec30547f225bc4d092e1f4","https://github.com/openssl/openssl/commit/fdf6723362ca51bd883295efe206cb5b1cfa5154","https://github.openssl.org/openssl/extended-releases/commit/8efc0cbaa8ebba8e116f7b81a876a4123594d86a","https://github.openssl.org/openssl/extended-releases/commit/9d576994cec2b7aa37a91740ea7e680810957e41","https://openssl-library.org/news/secadv/20241016.txt","http://www.openwall.com/lists/oss-security/2024/10/16/1","http://www.openwall.com/lists/oss-security/2024/10/23/1","http://www.openwall.com/lists/oss-security/2024/10/24/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20241101-0001/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9143","description":"Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted\nexplicit values for the field polynomial can lead to out-of-bounds memory reads\nor writes.\n\nImpact summary: Out of bound memory writes can lead to an application crash or\neven a possibility of a remote code execution, however, in all the protocols\ninvolving Elliptic Curve Cryptography that we're aware of, either only \"named\ncurves\" are supported, or, if explicit curve parameters are supported, they\nspecify an X9.62 encoding of binary (GF(2^m)) curves that can't represent\nproblematic input values. Thus the likelihood of existence of a vulnerable\napplication is low.\n\nIn particular, the X9.62 encoding is used for ECC keys in X.509 certificates,\nso problematic inputs cannot occur in the context of processing X.509\ncertificates.  Any problematic use-cases would have to be using an \"exotic\"\ncurve encoding.\n\nThe affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(),\nand various supporting BN_GF2m_*() functions.\n\nApplications working with \"exotic\" explicit binary (GF(2^m)) curve parameters,\nthat make it possible to represent invalid field polynomials with a zero\nconstant term, via the above or similar APIs, may terminate abruptly as a\nresult of reading or writing outside of array bounds.  Remote code execution\ncannot easily be ruled out.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"4d5407177cb8d0dd","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-5535","versionConstraint":"< 3.0.2-0ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-5535","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.17"],"available":[{"date":"2024-07-31","kind":"advisory","version":"3.0.2-0ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-5535","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-5535","date":"2026-11-02","epss":0.05582,"percentile":0.92889}],"risk":1.6746,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-5535"},"relatedVulnerabilities":[{"id":"CVE-2024-5535","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-5535","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-5535","date":"2026-11-02","epss":0.05582,"percentile":0.92889}],"urls":["https://github.com/openssl/openssl/commit/4ada436a1946cbb24db5ab4ca082b69c1bc10f37","https://github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e","https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c","https://github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c","https://github.openssl.org/openssl/extended-releases/commit/9947251413065a05189a63c9b7a6c1d4e224c21c","https://github.openssl.org/openssl/extended-releases/commit/b78ec0824da857223486660177d3b1f255c65d87","https://www.openssl.org/news/secadv/20240627.txt","http://www.openwall.com/lists/oss-security/2024/06/27/1","http://www.openwall.com/lists/oss-security/2024/06/28/4","http://www.openwall.com/lists/oss-security/2024/08/15/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240712-0005/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-5535","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available."}]},{"artifact":{"id":"1014a67cbf322356","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.17"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-5535","versionConstraint":"< 3.0.2-0ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-5535","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.17"],"available":[{"date":"2024-07-31","kind":"advisory","version":"3.0.2-0ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-5535","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-5535","date":"2026-11-02","epss":0.05582,"percentile":0.92889}],"risk":1.6746,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-5535"},"relatedVulnerabilities":[{"id":"CVE-2024-5535","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-5535","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-5535","date":"2026-11-02","epss":0.05582,"percentile":0.92889}],"urls":["https://github.com/openssl/openssl/commit/4ada436a1946cbb24db5ab4ca082b69c1bc10f37","https://github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e","https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c","https://github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c","https://github.openssl.org/openssl/extended-releases/commit/9947251413065a05189a63c9b7a6c1d4e224c21c","https://github.openssl.org/openssl/extended-releases/commit/b78ec0824da857223486660177d3b1f255c65d87","https://www.openssl.org/news/secadv/20240627.txt","http://www.openwall.com/lists/oss-security/2024/06/27/1","http://www.openwall.com/lists/oss-security/2024/06/28/4","http://www.openwall.com/lists/oss-security/2024/08/15/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240712-0005/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-5535","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available."}]},{"artifact":{"id":"b9ac29bf0f5693c3","cpes":["cpe:2.3:a:apache:commons-beanutils:1.9.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_beanutils:1.9.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.9.4:*:*:*:*:*:*:*"],"name":"commons-beanutils","purl":"pkg:maven/commons-beanutils/commons-beanutils@1.9.4","type":"java-archive","version":"1.9.4","language":"java","licenses":[],"metadata":{"pomGroupID":"commons-beanutils","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.crowd.embedded-crowd-admin-plugin-5.1.2.jar:commons-beanutils:commons-beanutils","manifestName":"","pomArtifactID":"commons-beanutils","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.crowd.embedded-crowd-admin-plugin-5.1.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.crowd.embedded-crowd-admin-plugin-5.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wxr5-93ph-8wr9","versionConstraint":">=1.0,<=1.10.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-beanutils:commons-beanutils","version":"1.9.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wxr5-93ph-8wr9","fix":{"state":"fixed","versions":["1.11.0"],"available":[{"date":"2025-05-29","kind":"first-observed","version":"1.11.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48734","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-48734","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-48734","date":"2026-11-02","epss":0.02018,"percentile":0.80932}],"risk":1.64467,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48734","https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9","https://github.com/apache/commons-beanutils/commit/bd20740da25b69552ddef8523beec0837297eaf9","http://www.openwall.com/lists/oss-security/2025/05/28/6","https://lists.debian.org/debian-lts-announce/2025/06/msg00027.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wxr5-93ph-8wr9","description":"Apache Commons Improper Access Control vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-48734","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48734","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-48734","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-48734","date":"2026-11-02","epss":0.02018,"percentile":0.80932}],"urls":["https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9","http://www.openwall.com/lists/oss-security/2025/05/28/6","https://lists.debian.org/debian-lts-announce/2025/06/msg00027.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48734","description":"Improper Access Control vulnerability in Apache Commons.\n\n\n\nA special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.\n\n\n\n\n\nReleases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().\nStarting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.\n\nThis issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils\n\n 1.x are recommended to upgrade to version 1.11.0, which fixes the issue.\n\n\nUsers of the artifact org.apache.commons:commons-beanutils2\n\n 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue."}]},{"artifact":{"id":"559b3275e0cfb19d","cpes":["cpe:2.3:a:apache:commons-beanutils:1.9.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_beanutils:1.9.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.9.4:*:*:*:*:*:*:*"],"name":"commons-beanutils","purl":"pkg:maven/commons-beanutils/commons-beanutils@1.9.4","type":"java-archive","version":"1.9.4","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"commons-beanutils","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/commons-beanutils_commons-beanutils-1.9.4.jar","manifestName":"","pomArtifactID":"commons-beanutils","archiveDigests":[{"value":"d52b9abcd97f38c81342bb7e7ae1eee9b73cba51","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/commons-beanutils_commons-beanutils-1.9.4.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/commons-beanutils_commons-beanutils-1.9.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wxr5-93ph-8wr9","versionConstraint":">=1.0,<=1.10.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-beanutils:commons-beanutils","version":"1.9.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wxr5-93ph-8wr9","fix":{"state":"fixed","versions":["1.11.0"],"available":[{"date":"2025-05-29","kind":"first-observed","version":"1.11.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48734","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-48734","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-48734","date":"2026-11-02","epss":0.02018,"percentile":0.80932}],"risk":1.64467,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48734","https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9","https://github.com/apache/commons-beanutils/commit/bd20740da25b69552ddef8523beec0837297eaf9","http://www.openwall.com/lists/oss-security/2025/05/28/6","https://lists.debian.org/debian-lts-announce/2025/06/msg00027.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wxr5-93ph-8wr9","description":"Apache Commons Improper Access Control vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-48734","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48734","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-48734","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-48734","date":"2026-11-02","epss":0.02018,"percentile":0.80932}],"urls":["https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9","http://www.openwall.com/lists/oss-security/2025/05/28/6","https://lists.debian.org/debian-lts-announce/2025/06/msg00027.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48734","description":"Improper Access Control vulnerability in Apache Commons.\n\n\n\nA special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.\n\n\n\n\n\nReleases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().\nStarting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.\n\nThis issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils\n\n 1.x are recommended to upgrade to version 1.11.0, which fixes the issue.\n\n\nUsers of the artifact org.apache.commons:commons-beanutils2\n\n 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue."}]},{"artifact":{"id":"5408a36d671d2ff1","cpes":["cpe:2.3:a:apache:commons-beanutils:1.9.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_beanutils:1.9.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.9.4:*:*:*:*:*:*:*"],"name":"commons-beanutils","purl":"pkg:maven/commons-beanutils/commons-beanutils@1.9.4","type":"java-archive","version":"1.9.4","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"commons-beanutils","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/commons-beanutils-1.9.4.jar","manifestName":"","pomArtifactID":"commons-beanutils","archiveDigests":[{"value":"d52b9abcd97f38c81342bb7e7ae1eee9b73cba51","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/commons-beanutils-1.9.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wxr5-93ph-8wr9","versionConstraint":">=1.0,<=1.10.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-beanutils:commons-beanutils","version":"1.9.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wxr5-93ph-8wr9","fix":{"state":"fixed","versions":["1.11.0"],"available":[{"date":"2025-05-29","kind":"first-observed","version":"1.11.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48734","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-48734","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-48734","date":"2026-11-02","epss":0.02018,"percentile":0.80932}],"risk":1.64467,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48734","https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9","https://github.com/apache/commons-beanutils/commit/bd20740da25b69552ddef8523beec0837297eaf9","http://www.openwall.com/lists/oss-security/2025/05/28/6","https://lists.debian.org/debian-lts-announce/2025/06/msg00027.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wxr5-93ph-8wr9","description":"Apache Commons Improper Access Control vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-48734","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48734","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-48734","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-48734","date":"2026-11-02","epss":0.02018,"percentile":0.80932}],"urls":["https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9","http://www.openwall.com/lists/oss-security/2025/05/28/6","https://lists.debian.org/debian-lts-announce/2025/06/msg00027.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48734","description":"Improper Access Control vulnerability in Apache Commons.\n\n\n\nA special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.\n\n\n\n\n\nReleases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().\nStarting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.\n\nThis issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils\n\n 1.x are recommended to upgrade to version 1.11.0, which fixes the issue.\n\n\nUsers of the artifact org.apache.commons:commons-beanutils2\n\n 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue."}]},{"artifact":{"id":"ebd7a017631da953","cpes":["cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:io.netty:netty-handler","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.118.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4g8c-wm8x-jfhw","versionConstraint":">=4.1.91.Final,<=4.1.117.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4g8c-wm8x-jfhw","fix":{"state":"fixed","versions":["4.1.118.Final"],"available":[{"date":"2025-02-11","kind":"first-observed","version":"4.1.118.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24970","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24970","date":"2026-11-02","epss":0.02192,"percentile":0.82448}],"risk":1.644,"urls":["https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","https://nvd.nist.gov/vuln/detail/CVE-2025-24970","https://security.netapp.com/advisory/ntap-20250221-0005","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4g8c-wm8x-jfhw","description":"SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine"},"relatedVulnerabilities":[{"id":"CVE-2025-24970","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24970","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24970","date":"2026-11-02","epss":0.02192,"percentile":0.82448}],"urls":["https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","https://security.netapp.com/advisory/ntap-20250221-0005/","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-24970","description":"Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually."}]},{"artifact":{"id":"72a1968e6efdfa5e","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-handler-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"4c0acdb8bb73647ebb3847ac2d503d53d72c02b4","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-handler-4.1.100.Final.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-handler-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.118.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4g8c-wm8x-jfhw","versionConstraint":">=4.1.91.Final,<=4.1.117.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4g8c-wm8x-jfhw","fix":{"state":"fixed","versions":["4.1.118.Final"],"available":[{"date":"2025-02-11","kind":"first-observed","version":"4.1.118.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24970","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24970","date":"2026-11-02","epss":0.02192,"percentile":0.82448}],"risk":1.644,"urls":["https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","https://nvd.nist.gov/vuln/detail/CVE-2025-24970","https://security.netapp.com/advisory/ntap-20250221-0005","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4g8c-wm8x-jfhw","description":"SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine"},"relatedVulnerabilities":[{"id":"CVE-2025-24970","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24970","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24970","date":"2026-11-02","epss":0.02192,"percentile":0.82448}],"urls":["https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","https://security.netapp.com/advisory/ntap-20250221-0005/","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-24970","description":"Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually."}]},{"artifact":{"id":"f9e961d53cf996e8","cpes":["cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:io.netty:netty-handler","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.118.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4g8c-wm8x-jfhw","versionConstraint":">=4.1.91.Final,<=4.1.117.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4g8c-wm8x-jfhw","fix":{"state":"fixed","versions":["4.1.118.Final"],"available":[{"date":"2025-02-11","kind":"first-observed","version":"4.1.118.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24970","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24970","date":"2026-11-02","epss":0.02192,"percentile":0.82448}],"risk":1.644,"urls":["https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","https://nvd.nist.gov/vuln/detail/CVE-2025-24970","https://security.netapp.com/advisory/ntap-20250221-0005","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4g8c-wm8x-jfhw","description":"SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine"},"relatedVulnerabilities":[{"id":"CVE-2025-24970","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24970","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-24970","date":"2026-11-02","epss":0.02192,"percentile":0.82448}],"urls":["https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","https://security.netapp.com/advisory/ntap-20250221-0005/","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection","https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-24970","description":"Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually."}]},{"artifact":{"id":"c87a73d6229303b3","cpes":["cpe:2.3:a:apache:tomcat-coyote:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_coyote:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-coyote","purl":"pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat","virtualPath":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","manifestName":"","pomArtifactID":"tomcat-coyote","archiveDigests":[{"value":"20f6014eba726230cc33ce7f0248b3261b7bae58","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.118"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r29c-68gh-xp6x","versionConstraint":">=8.5.0,<9.0.118 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat:tomcat-coyote","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r29c-68gh-xp6x","fix":{"state":"fixed","versions":["9.0.118"],"available":[{"date":"2026-09-01","kind":"first-observed","version":"9.0.118"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41293","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-41293","date":"2026-11-02","epss":0.01705,"percentile":0.77283}],"risk":1.6027,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41293","https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r","http://www.openwall.com/lists/oss-security/2026/05/12/13","https://github.com/apache/tomcat/commit/19f17a257797e8d139b33ff9c88d362a273be148","https://github.com/apache/tomcat/commit/1c70480466572c9192ed412ebefcd43fc63137fd","https://github.com/apache/tomcat/commit/2a2476460e823789f530a22207873ea8cd6eff3b","https://github.com/apache/tomcat/commit/3915fd27e6810b14ccd21e3d900bd8faef44d3df","https://github.com/apache/tomcat/commit/57c2b3bfd62792631e1df24cf4237b990a0b36fa","https://github.com/apache/tomcat/commit/c2925554c677da57390f940d856871e18daaacab","https://github.com/apache/tomcat/commit/cf9452443bcbf3b1a4b435ef7d624364f1b65ca3","https://github.com/apache/tomcat/commit/e5cef9618c3f4fd31bd6fb1e83f0f18022280dac","https://github.com/apache/tomcat/commit/f72a6174ab1f0f5a053435f80448b4f6837fe6d7","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r29c-68gh-xp6x","description":"Apache Tomcat - HTTP/2 request headers not validated"},"relatedVulnerabilities":[{"id":"CVE-2026-41293","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41293","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-41293","date":"2026-11-02","epss":0.01705,"percentile":0.77283}],"urls":["https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r","http://www.openwall.com/lists/oss-security/2026/05/12/13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41293","description":"Improper Input Validation vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27.\nOlder, end of support versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue."}]},{"artifact":{"id":"c87a73d6229303b3","cpes":["cpe:2.3:a:apache:tomcat-coyote:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_coyote:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-coyote","purl":"pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat","virtualPath":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","manifestName":"","pomArtifactID":"tomcat-coyote","archiveDigests":[{"value":"20f6014eba726230cc33ce7f0248b3261b7bae58","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.107"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-25xr-qj8w-c4vf","versionConstraint":">=9.0.0.M1,<9.0.107 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat:tomcat-coyote","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-25xr-qj8w-c4vf","fix":{"state":"fixed","versions":["9.0.107"],"available":[{"date":"2025-07-12","kind":"first-observed","version":"9.0.107"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53506","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-53506","date":"2026-11-02","epss":0.02129,"percentile":0.81946}],"risk":1.59675,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-53506","https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0","https://github.com/apache/tomcat/commit/2aa6261276ebe50b99276953591e3a2be7898bdb","https://github.com/apache/tomcat/commit/434772930f362145516dd60681134e7f0cf8115b","https://github.com/apache/tomcat/commit/be8f330f83ceddaf3baeed57522e571572b6b99b","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html","http://www.openwall.com/lists/oss-security/2025/07/10/13"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-25xr-qj8w-c4vf","description":"Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams"},"relatedVulnerabilities":[{"id":"CVE-2025-53506","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53506","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-53506","date":"2026-11-02","epss":0.02129,"percentile":0.81946}],"urls":["https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0","http://www.openwall.com/lists/oss-security/2025/07/10/13","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53506","description":"Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue."}]},{"artifact":{"id":"a39f109b7f65bcf8","cpes":["cpe:2.3:a:apache:commons-lang:2.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_lang:2.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:2.4:*:*:*:*:*:*:*"],"name":"commons-lang","purl":"pkg:maven/commons-lang/commons-lang@2.4","type":"java-archive","version":"2.4","language":"java","licenses":[],"metadata":{"pomGroupID":"commons-lang","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.streams.streams-core-plugin-9.1.36.jar:commons-lang:commons-lang","manifestName":"","pomArtifactID":"commons-lang","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.streams.streams-core-plugin-9.1.36.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.streams.streams-core-plugin-9.1.36.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j288-q9x7-2f5v","versionConstraint":">=2.0,<=2.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-lang:commons-lang","version":"2.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j288-q9x7-2f5v","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"risk":1.5133999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48924","https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html","http://www.openwall.com/lists/oss-security/2025/07/11/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j288-q9x7-2f5v","description":"Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs"},"relatedVulnerabilities":[{"id":"CVE-2025-48924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"urls":["https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","http://www.openwall.com/lists/oss-security/2025/07/11/1","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue."}]},{"artifact":{"id":"08fd670595ce546c","cpes":["cpe:2.3:a:apache:commons-lang:2.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_lang:2.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:2.4:*:*:*:*:*:*:*"],"name":"commons-lang","purl":"pkg:maven/commons-lang/commons-lang@2.4","type":"java-archive","version":"2.4","language":"java","licenses":[],"metadata":{"pomGroupID":"commons-lang","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.streams.streams-aggregator-plugin-9.1.36.jar:commons-lang:commons-lang","manifestName":"","pomArtifactID":"commons-lang","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.streams.streams-aggregator-plugin-9.1.36.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.streams.streams-aggregator-plugin-9.1.36.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j288-q9x7-2f5v","versionConstraint":">=2.0,<=2.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-lang:commons-lang","version":"2.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j288-q9x7-2f5v","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"risk":1.5133999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48924","https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html","http://www.openwall.com/lists/oss-security/2025/07/11/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j288-q9x7-2f5v","description":"Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs"},"relatedVulnerabilities":[{"id":"CVE-2025-48924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"urls":["https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","http://www.openwall.com/lists/oss-security/2025/07/11/1","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue."}]},{"artifact":{"id":"40ff6a5ffeca68bd","cpes":["cpe:2.3:a:apache:commons-lang:2.6:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_lang:2.6:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:2.6:*:*:*:*:*:*:*","cpe:2.3:a:apache:lang:2.6:*:*:*:*:*:*:*"],"name":"commons-lang","purl":"pkg:maven/commons-lang/commons-lang@2.6","type":"java-archive","version":"2.6","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"commons-lang","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/commons-lang_commons-lang-2.6.jar","manifestName":"","pomArtifactID":"commons-lang","archiveDigests":[{"value":"0ce1edb914c94ebc388f086c6827e8bdeec71ac2","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/commons-lang_commons-lang-2.6.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/commons-lang_commons-lang-2.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j288-q9x7-2f5v","versionConstraint":">=2.0,<=2.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-lang:commons-lang","version":"2.6"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j288-q9x7-2f5v","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"risk":1.5133999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48924","https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html","http://www.openwall.com/lists/oss-security/2025/07/11/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j288-q9x7-2f5v","description":"Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs"},"relatedVulnerabilities":[{"id":"CVE-2025-48924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"urls":["https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","http://www.openwall.com/lists/oss-security/2025/07/11/1","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue."}]},{"artifact":{"id":"3f0df5943a442829","cpes":["cpe:2.3:a:apache:commons-lang:2.6:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_lang:2.6:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:2.6:*:*:*:*:*:*:*"],"name":"commons-lang","purl":"pkg:maven/commons-lang/commons-lang@2.6","type":"java-archive","version":"2.6","language":"java","licenses":[],"metadata":{"pomGroupID":"commons-lang","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.team-calendars.team-calendars-18.7.6.jar:commons-lang:commons-lang","manifestName":"","pomArtifactID":"commons-lang","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.team-calendars.team-calendars-18.7.6.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.team-calendars.team-calendars-18.7.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j288-q9x7-2f5v","versionConstraint":">=2.0,<=2.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-lang:commons-lang","version":"2.6"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j288-q9x7-2f5v","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"risk":1.5133999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48924","https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html","http://www.openwall.com/lists/oss-security/2025/07/11/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j288-q9x7-2f5v","description":"Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs"},"relatedVulnerabilities":[{"id":"CVE-2025-48924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"urls":["https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","http://www.openwall.com/lists/oss-security/2025/07/11/1","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue."}]},{"artifact":{"id":"6e6aa40f3f0e221e","cpes":["cpe:2.3:a:apache:commons-lang:2.6:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_lang:2.6:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:2.6:*:*:*:*:*:*:*"],"name":"commons-lang","purl":"pkg:maven/commons-lang/commons-lang@2.6","type":"java-archive","version":"2.6","language":"java","licenses":[],"metadata":{"pomGroupID":"commons-lang","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.pats.pats-plugin-1.4.7.jar:commons-lang:commons-lang","manifestName":"","pomArtifactID":"commons-lang","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.pats.pats-plugin-1.4.7.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.pats.pats-plugin-1.4.7.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j288-q9x7-2f5v","versionConstraint":">=2.0,<=2.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-lang:commons-lang","version":"2.6"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j288-q9x7-2f5v","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"risk":1.5133999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48924","https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html","http://www.openwall.com/lists/oss-security/2025/07/11/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j288-q9x7-2f5v","description":"Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs"},"relatedVulnerabilities":[{"id":"CVE-2025-48924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"urls":["https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","http://www.openwall.com/lists/oss-security/2025/07/11/1","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue."}]},{"artifact":{"id":"f66c526ff75ac6d0","cpes":["cpe:2.3:a:apache:commons-lang3:3.12.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_lang3:3.12.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:3.12.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:lang3:3.12.0:*:*:*:*:*:*:*"],"name":"commons-lang3","purl":"pkg:maven/org.apache.commons/commons-lang3@3.12.0","type":"java-archive","version":"3.12.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/commons-lang3-3.12.0.jar","manifestName":"","pomArtifactID":"commons-lang3","archiveDigests":[{"value":"c6842c86792ff03b9f1d1fe2aab8dc23aa6c6f0e","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/commons-lang3-3.12.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.18.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j288-q9x7-2f5v","versionConstraint":">=3.0,<3.18.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-lang3","version":"3.12.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j288-q9x7-2f5v","fix":{"state":"fixed","versions":["3.18.0"],"available":[{"date":"2025-07-12","kind":"first-observed","version":"3.18.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"risk":1.5133999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48924","https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html","http://www.openwall.com/lists/oss-security/2025/07/11/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j288-q9x7-2f5v","description":"Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs"},"relatedVulnerabilities":[{"id":"CVE-2025-48924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"urls":["https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","http://www.openwall.com/lists/oss-security/2025/07/11/1","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue."}]},{"artifact":{"id":"c01deb66dcf61ab5","cpes":["cpe:2.3:a:apache:commons-lang3:3.12.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_lang3:3.12.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:3.12.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:lang3:3.12.0:*:*:*:*:*:*:*"],"name":"commons-lang3","purl":"pkg:maven/org.apache.commons/commons-lang3@3.12.0","type":"java-archive","version":"3.12.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/commons-lang3-3.12.0.jar","manifestName":"","pomArtifactID":"commons-lang3","archiveDigests":[{"value":"c6842c86792ff03b9f1d1fe2aab8dc23aa6c6f0e","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/commons-lang3-3.12.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/commons-lang3-3.12.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.18.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j288-q9x7-2f5v","versionConstraint":">=3.0,<3.18.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-lang3","version":"3.12.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j288-q9x7-2f5v","fix":{"state":"fixed","versions":["3.18.0"],"available":[{"date":"2025-07-12","kind":"first-observed","version":"3.18.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"risk":1.5133999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48924","https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html","http://www.openwall.com/lists/oss-security/2025/07/11/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j288-q9x7-2f5v","description":"Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs"},"relatedVulnerabilities":[{"id":"CVE-2025-48924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"urls":["https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","http://www.openwall.com/lists/oss-security/2025/07/11/1","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue."}]},{"artifact":{"id":"33fa28702d296dfb","cpes":["cpe:2.3:a:apache:commons-lang3:3.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_lang3:3.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:3.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:lang3:3.13.0:*:*:*:*:*:*:*"],"name":"commons-lang3","purl":"pkg:maven/org.apache.commons/commons-lang3@3.13.0","type":"java-archive","version":"3.13.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/confluence/bin/commons-lang3.jar","manifestName":"","pomArtifactID":"commons-lang3","archiveDigests":[{"value":"b7263237aa89c1f99b327197c41d0669707a462e","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/bin/commons-lang3.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/commons-lang3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.18.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j288-q9x7-2f5v","versionConstraint":">=3.0,<3.18.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-lang3","version":"3.13.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j288-q9x7-2f5v","fix":{"state":"fixed","versions":["3.18.0"],"available":[{"date":"2025-07-12","kind":"first-observed","version":"3.18.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"risk":1.5133999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48924","https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html","http://www.openwall.com/lists/oss-security/2025/07/11/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j288-q9x7-2f5v","description":"Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs"},"relatedVulnerabilities":[{"id":"CVE-2025-48924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"urls":["https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","http://www.openwall.com/lists/oss-security/2025/07/11/1","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue."}]},{"artifact":{"id":"a398c47b467e5456","cpes":["cpe:2.3:a:apache:commons-lang3:3.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_lang3:3.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:3.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:lang3:3.13.0:*:*:*:*:*:*:*"],"name":"commons-lang3","purl":"pkg:maven/org.apache.commons/commons-lang3@3.13.0","type":"java-archive","version":"3.13.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.commons_commons-lang3-3.13.0.jar","manifestName":"","pomArtifactID":"commons-lang3","archiveDigests":[{"value":"b7263237aa89c1f99b327197c41d0669707a462e","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.commons_commons-lang3-3.13.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.commons_commons-lang3-3.13.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.18.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j288-q9x7-2f5v","versionConstraint":">=3.0,<3.18.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-lang3","version":"3.13.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j288-q9x7-2f5v","fix":{"state":"fixed","versions":["3.18.0"],"available":[{"date":"2025-07-12","kind":"first-observed","version":"3.18.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"risk":1.5133999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48924","https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html","http://www.openwall.com/lists/oss-security/2025/07/11/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j288-q9x7-2f5v","description":"Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs"},"relatedVulnerabilities":[{"id":"CVE-2025-48924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48924","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48924","date":"2026-11-02","epss":0.02632,"percentile":0.85532}],"urls":["https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","http://www.openwall.com/lists/oss-security/2025/07/11/1","https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue."}]},{"artifact":{"id":"2729561a4613b7e1","cpes":["cpe:2.3:a:com.thoughtworks.xstream:xstream:1.4.20:*:*:*:*:*:*:*","cpe:2.3:a:thoughtworks:xstream:1.4.20:*:*:*:*:*:*:*","cpe:2.3:a:xstream:xstream:1.4.20:*:*:*:*:*:*:*"],"name":"xstream","purl":"pkg:maven/com.thoughtworks.xstream/xstream@1.4.20","type":"java-archive","version":"1.4.20","language":"java","licenses":[],"metadata":{"pomGroupID":"com.thoughtworks.xstream","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.troubleshooting.plugin-confluence-1.52.1.jar:com.thoughtworks.xstream:xstream","manifestName":"","pomArtifactID":"xstream","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.troubleshooting.plugin-confluence-1.52.1.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.troubleshooting.plugin-confluence-1.52.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.4.21"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hfq9-hggm-c56q","versionConstraint":"<1.4.21 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.thoughtworks.xstream:xstream","version":"1.4.20"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hfq9-hggm-c56q","fix":{"state":"fixed","versions":["1.4.21"],"available":[{"date":"2024-11-08","kind":"first-observed","version":"1.4.21"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47072","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-47072","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-47072","date":"2026-11-02","epss":0.02001,"percentile":0.80769}],"risk":1.510755,"urls":["https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q","https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266","https://github.com/x-stream/xstream/commit/fdd9f7d3de0d7ccf2f9979bcd09fbf3e6a0c881a","https://x-stream.github.io/CVE-2024-47072.html","https://nvd.nist.gov/vuln/detail/CVE-2024-47072","https://lists.debian.org/debian-lts-announce/2024/12/msg00023.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hfq9-hggm-c56q","description":"XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream"},"relatedVulnerabilities":[{"id":"CVE-2024-47072","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47072","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-47072","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-47072","date":"2026-11-02","epss":0.02001,"percentile":0.80769}],"urls":["https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266","https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q","https://x-stream.github.io/CVE-2024-47072.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00023.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47072","description":"XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver."}]},{"artifact":{"id":"2f4e58a00b7b6319","cpes":["cpe:2.3:a:com.thoughtworks.xstream:xstream:1.4.20:*:*:*:*:*:*:*","cpe:2.3:a:thoughtworks:xstream:1.4.20:*:*:*:*:*:*:*","cpe:2.3:a:xstream:xstream:1.4.20:*:*:*:*:*:*:*"],"name":"xstream","purl":"pkg:maven/com.thoughtworks.xstream/xstream@1.4.20","type":"java-archive","version":"1.4.20","language":"java","licenses":["BSD-3-Clause"],"metadata":{"pomGroupID":"com.thoughtworks.xstream","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.gadgets.atlassian-gadgets-opensocial-plugin-8.1.4.jar:META-INF/lib/xstream-1.4.20.jar","manifestName":"","pomArtifactID":"xstream","archiveDigests":[{"value":"0e2315b8b2e95e9f21697833c8e56cdd9c98a5ee","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.gadgets.atlassian-gadgets-opensocial-plugin-8.1.4.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.gadgets.atlassian-gadgets-opensocial-plugin-8.1.4.jar:META-INF/lib/xstream-1.4.20.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.4.21"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hfq9-hggm-c56q","versionConstraint":"<1.4.21 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.thoughtworks.xstream:xstream","version":"1.4.20"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hfq9-hggm-c56q","fix":{"state":"fixed","versions":["1.4.21"],"available":[{"date":"2024-11-08","kind":"first-observed","version":"1.4.21"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47072","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-47072","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-47072","date":"2026-11-02","epss":0.02001,"percentile":0.80769}],"risk":1.510755,"urls":["https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q","https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266","https://github.com/x-stream/xstream/commit/fdd9f7d3de0d7ccf2f9979bcd09fbf3e6a0c881a","https://x-stream.github.io/CVE-2024-47072.html","https://nvd.nist.gov/vuln/detail/CVE-2024-47072","https://lists.debian.org/debian-lts-announce/2024/12/msg00023.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hfq9-hggm-c56q","description":"XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream"},"relatedVulnerabilities":[{"id":"CVE-2024-47072","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47072","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-47072","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-47072","date":"2026-11-02","epss":0.02001,"percentile":0.80769}],"urls":["https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266","https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q","https://x-stream.github.io/CVE-2024-47072.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00023.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47072","description":"XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver."}]},{"artifact":{"id":"2ad2f467d1226773","cpes":["cpe:2.3:a:com.thoughtworks.xstream:xstream:1.4.20:*:*:*:*:*:*:*","cpe:2.3:a:thoughtworks:xstream:1.4.20:*:*:*:*:*:*:*","cpe:2.3:a:xstream:xstream:1.4.20:*:*:*:*:*:*:*"],"name":"xstream","purl":"pkg:maven/com.thoughtworks.xstream/xstream@1.4.20","type":"java-archive","version":"1.4.20","language":"java","licenses":["BSD-3-Clause"],"metadata":{"pomGroupID":"com.thoughtworks.xstream","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.thoughtworks.xstream_xstream-1.4.20.jar","manifestName":"","pomArtifactID":"xstream","archiveDigests":[{"value":"0e2315b8b2e95e9f21697833c8e56cdd9c98a5ee","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.thoughtworks.xstream_xstream-1.4.20.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.thoughtworks.xstream_xstream-1.4.20.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.4.21"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hfq9-hggm-c56q","versionConstraint":"<1.4.21 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.thoughtworks.xstream:xstream","version":"1.4.20"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hfq9-hggm-c56q","fix":{"state":"fixed","versions":["1.4.21"],"available":[{"date":"2024-11-08","kind":"first-observed","version":"1.4.21"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47072","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-47072","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-47072","date":"2026-11-02","epss":0.02001,"percentile":0.80769}],"risk":1.510755,"urls":["https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q","https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266","https://github.com/x-stream/xstream/commit/fdd9f7d3de0d7ccf2f9979bcd09fbf3e6a0c881a","https://x-stream.github.io/CVE-2024-47072.html","https://nvd.nist.gov/vuln/detail/CVE-2024-47072","https://lists.debian.org/debian-lts-announce/2024/12/msg00023.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hfq9-hggm-c56q","description":"XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream"},"relatedVulnerabilities":[{"id":"CVE-2024-47072","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47072","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-47072","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-47072","date":"2026-11-02","epss":0.02001,"percentile":0.80769}],"urls":["https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266","https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q","https://x-stream.github.io/CVE-2024-47072.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00023.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47072","description":"XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver."}]},{"artifact":{"id":"4d5407177cb8d0dd","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-5678","versionConstraint":"< 3.0.2-0ubuntu1.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-5678","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.14"],"available":[{"date":"2024-02-05","kind":"advisory","version":"3.0.2-0ubuntu1.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2023-5678","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-5678","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-5678","date":"2026-11-02","epss":0.04459,"percentile":0.91435}],"risk":1.3377,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-5678"},"relatedVulnerabilities":[{"id":"CVE-2023-5678","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-5678","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-5678","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-5678","date":"2026-11-02","epss":0.04459,"percentile":0.91435}],"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=34efaef6c103d636ab507a0cc34dca4d3aecc055","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=710fee740904b6290fef0dd5536fbcedbc38ff0c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db925ae2e65d0d925adef429afc37f75bd1c2017","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6","https://www.openssl.org/news/secadv/20231106.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20231130-0010/","https://cert-portal.siemens.com/productcert/html/ssa-093430.html","https://cert-portal.siemens.com/productcert/html/ssa-128433.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-556635.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-5678","description":"Issue summary: Generating excessively long X9.42 DH keys or checking\nexcessively long X9.42 DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_generate_key() to\ngenerate an X9.42 DH key may experience long delays.  Likewise, applications\nthat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()\nto check an X9.42 DH key or X9.42 DH parameters may experience long delays.\nWhere the key or parameters that are being checked have been obtained from\nan untrusted source this may lead to a Denial of Service.\n\nWhile DH_check() performs all the necessary checks (as of CVE-2023-3817),\nDH_check_pub_key() doesn't make any of these checks, and is therefore\nvulnerable for excessively large P and Q parameters.\n\nLikewise, while DH_generate_key() performs a check for an excessively large\nP, it doesn't check for an excessively large Q.\n\nAn application that calls DH_generate_key() or DH_check_pub_key() and\nsupplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nDH_generate_key() and DH_check_pub_key() are also called by a number of\nother OpenSSL functions.  An application calling any of those other\nfunctions may similarly be affected.  The other functions affected by this\nare DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().\n\nAlso vulnerable are the OpenSSL pkey command line application when using the\n\"-pubcheck\" option, as well as the OpenSSL genpkey command line application.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."}]},{"artifact":{"id":"1014a67cbf322356","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-5678","versionConstraint":"< 3.0.2-0ubuntu1.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-5678","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.14"],"available":[{"date":"2024-02-05","kind":"advisory","version":"3.0.2-0ubuntu1.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2023-5678","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-5678","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-5678","date":"2026-11-02","epss":0.04459,"percentile":0.91435}],"risk":1.3377,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-5678"},"relatedVulnerabilities":[{"id":"CVE-2023-5678","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-5678","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-5678","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-5678","date":"2026-11-02","epss":0.04459,"percentile":0.91435}],"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=34efaef6c103d636ab507a0cc34dca4d3aecc055","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=710fee740904b6290fef0dd5536fbcedbc38ff0c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db925ae2e65d0d925adef429afc37f75bd1c2017","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6","https://www.openssl.org/news/secadv/20231106.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20231130-0010/","https://cert-portal.siemens.com/productcert/html/ssa-093430.html","https://cert-portal.siemens.com/productcert/html/ssa-128433.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-556635.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-5678","description":"Issue summary: Generating excessively long X9.42 DH keys or checking\nexcessively long X9.42 DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_generate_key() to\ngenerate an X9.42 DH key may experience long delays.  Likewise, applications\nthat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()\nto check an X9.42 DH key or X9.42 DH parameters may experience long delays.\nWhere the key or parameters that are being checked have been obtained from\nan untrusted source this may lead to a Denial of Service.\n\nWhile DH_check() performs all the necessary checks (as of CVE-2023-3817),\nDH_check_pub_key() doesn't make any of these checks, and is therefore\nvulnerable for excessively large P and Q parameters.\n\nLikewise, while DH_generate_key() performs a check for an excessively large\nP, it doesn't check for an excessively large Q.\n\nAn application that calls DH_generate_key() or DH_check_pub_key() and\nsupplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nDH_generate_key() and DH_check_pub_key() are also called by a number of\nother OpenSSL functions.  An application calling any of those other\nfunctions may similarly be affected.  The other functions affected by this\nare DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().\n\nAlso vulnerable are the OpenSSL pkey command line application when using the\n\"-pubcheck\" option, as well as the OpenSSL genpkey command line application.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."}]},{"artifact":{"id":"c87a73d6229303b3","cpes":["cpe:2.3:a:apache:tomcat-coyote:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_coyote:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-coyote","purl":"pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat","virtualPath":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","manifestName":"","pomArtifactID":"tomcat-coyote","archiveDigests":[{"value":"20f6014eba726230cc33ce7f0248b3261b7bae58","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.90"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7jqf-v358-p8g7","versionConstraint":">=9.0.13,<9.0.90 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat:tomcat-coyote","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7jqf-v358-p8g7","fix":{"state":"fixed","versions":["9.0.90"],"available":[{"date":"2026-07-01","kind":"first-observed","version":"9.0.90"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38286","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-38286","date":"2026-11-02","epss":0.0169,"percentile":0.77072}],"risk":1.3224249999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-38286","https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s","https://github.com/apache/tomcat/commit/3197862639732e16ec1164557bcd289ebc116c93","https://github.com/apache/tomcat/commit/3344c17cef094da4bb616f4186ed32039627b543","https://github.com/apache/tomcat/commit/76c5cce6f0bcef14b0c21c38910371ca7d322d13","https://security.netapp.com/advisory/ntap-20241101-0010","http://www.openwall.com/lists/oss-security/2024/09/23/2","https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7jqf-v358-p8g7","description":"Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-38286","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38286","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-38286","date":"2026-11-02","epss":0.0169,"percentile":0.77072}],"urls":["https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s","http://www.openwall.com/lists/oss-security/2024/09/23/2","https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html","https://security.netapp.com/advisory/ntap-20241101-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-38286","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89.\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue.\n\n\n\nApache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process."}]},{"artifact":{"id":"4d5407177cb8d0dd","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-40735","versionConstraint":"< 3.0.2-0ubuntu1.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-40735","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.16"],"available":[{"date":"2024-06-27","kind":"advisory","version":"3.0.2-0ubuntu1.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2022-40735","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-40735","date":"2026-11-02","epss":0.02635,"percentile":0.85551}],"risk":1.3175,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-40735"},"relatedVulnerabilities":[{"id":"CVE-2022-40735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-40735","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-40735","date":"2026-11-02","epss":0.02635,"percentile":0.85551}],"urls":["https://dheatattack.gitlab.io/","https://gist.github.com/c0r0n3r/9455ddcab985c50fd1912eabf26e058b","https://github.com/mozilla/ssl-config-generator/issues/162","https://ieeexplore.ieee.org/document/10374117","https://link.springer.com/content/pdf/10.1007/3-540-68339-9_29.pdf","https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf","https://raw.githubusercontent.com/CVEProject/cvelist/9d7fbbcabd3f44cfedc9e8807757d31ece85a2c6/2022/40xxx/CVE-2022-40735.json","https://www.researchgate.net/profile/Anton-Stiglic-2/publication/2401745_Security_Issues_in_the_Diffie-Hellman_Key_Agreement_Protocol/links/546c144f0cf20dedafd53e7e/Security-Issues-in-the-Diffie-Hellman-Key-Agreement-Protocol.pdf","https://www.rfc-editor.org/rfc/rfc3526","https://www.rfc-editor.org/rfc/rfc4419","https://www.rfc-editor.org/rfc/rfc5114#section-4","https://www.rfc-editor.org/rfc/rfc7919#section-5.2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-40735","description":"The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van Oorschot and Wiener paper found that \"(appropriately) short exponents\" can be used when there are adequate subgroup constraints, and these short exponents can lead to less expensive calculations than for long exponents. This issue is different from CVE-2002-20001 because it is based on an observation about exponent size, rather than an observation about numbers that are not public keys. The specific situations in which calculation expense would constitute a server-side vulnerability depend on the protocol (e.g., TLS, SSH, or IKE) and the DHE implementation details. In general, there might be an availability concern because of server-side resource consumption from DHE modular-exponentiation calculations. Finally, it is possible for an attacker to exploit this vulnerability and CVE-2002-20001 together."}]},{"artifact":{"id":"1014a67cbf322356","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.16"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-40735","versionConstraint":"< 3.0.2-0ubuntu1.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-40735","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.16"],"available":[{"date":"2024-06-27","kind":"advisory","version":"3.0.2-0ubuntu1.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2022-40735","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-40735","date":"2026-11-02","epss":0.02635,"percentile":0.85551}],"risk":1.3175,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-40735"},"relatedVulnerabilities":[{"id":"CVE-2022-40735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-40735","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-40735","date":"2026-11-02","epss":0.02635,"percentile":0.85551}],"urls":["https://dheatattack.gitlab.io/","https://gist.github.com/c0r0n3r/9455ddcab985c50fd1912eabf26e058b","https://github.com/mozilla/ssl-config-generator/issues/162","https://ieeexplore.ieee.org/document/10374117","https://link.springer.com/content/pdf/10.1007/3-540-68339-9_29.pdf","https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf","https://raw.githubusercontent.com/CVEProject/cvelist/9d7fbbcabd3f44cfedc9e8807757d31ece85a2c6/2022/40xxx/CVE-2022-40735.json","https://www.researchgate.net/profile/Anton-Stiglic-2/publication/2401745_Security_Issues_in_the_Diffie-Hellman_Key_Agreement_Protocol/links/546c144f0cf20dedafd53e7e/Security-Issues-in-the-Diffie-Hellman-Key-Agreement-Protocol.pdf","https://www.rfc-editor.org/rfc/rfc3526","https://www.rfc-editor.org/rfc/rfc4419","https://www.rfc-editor.org/rfc/rfc5114#section-4","https://www.rfc-editor.org/rfc/rfc7919#section-5.2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-40735","description":"The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van Oorschot and Wiener paper found that \"(appropriately) short exponents\" can be used when there are adequate subgroup constraints, and these short exponents can lead to less expensive calculations than for long exponents. This issue is different from CVE-2002-20001 because it is based on an observation about exponent size, rather than an observation about numbers that are not public keys. The specific situations in which calculation expense would constitute a server-side vulnerability depend on the protocol (e.g., TLS, SSH, or IKE) and the DHE implementation details. In general, there might be an availability concern because of server-side resource consumption from DHE modular-exponentiation calculations. Finally, it is possible for an attacker to exploit this vulnerability and CVE-2002-20001 together."}]},{"artifact":{"id":"9eb6ea0cdca81c2f","cpes":["cpe:2.3:a:apache:tomcat-websocket:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_websocket:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-websocket","purl":"pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat","virtualPath":"/opt/atlassian/confluence/lib/tomcat-websocket.jar","manifestName":"","pomArtifactID":"tomcat-websocket","archiveDigests":[{"value":"876a71c4355704554778f674bf104054bd84b367","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/lib/tomcat-websocket.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/lib/tomcat-websocket.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.86"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v682-8vv8-vpwr","versionConstraint":">=9.0.0-M1,<=9.0.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat:tomcat-websocket","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-v682-8vv8-vpwr","fix":{"state":"fixed","versions":["9.0.86"],"available":[{"date":"2024-04-12","kind":"first-observed","version":"9.0.86"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-23672","cwe":"CWE-459","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-23672","date":"2026-11-02","epss":0.02313,"percentile":0.83405}],"risk":1.3068449999999998,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-23672","https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f","https://github.com/apache/tomcat/commit/0052b374684b613b0c849899b325ebe334ac6501","https://github.com/apache/tomcat/commit/3631adb1342d8bbd8598802a12b63ad02c37d591","https://github.com/apache/tomcat/commit/52d6650e062d880704898d7d8c1b2b7a3efe8068","https://github.com/apache/tomcat/commit/b0e3b1bd78de270d53e319d7cb79eb282aa53cb9","https://security.netapp.com/advisory/ntap-20240402-0002","https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html","http://www.openwall.com/lists/oss-security/2024/03/13/4","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v682-8vv8-vpwr","description":"Denial of Service via incomplete cleanup vulnerability in Apache Tomcat"},"relatedVulnerabilities":[{"id":"CVE-2024-23672","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-23672","cwe":"CWE-459","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-23672","date":"2026-11-02","epss":0.02313,"percentile":0.83405}],"urls":["https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f","http://www.openwall.com/lists/oss-security/2024/03/13/4","https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55/","https://security.netapp.com/advisory/ntap-20240402-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-23672","description":"Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\n\nOlder, EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-27043","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-27043","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-11-02","epss":0.02527,"percentile":0.84897}],"risk":1.2635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-27043"},"relatedVulnerabilities":[{"id":"CVE-2023-27043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-11-02","epss":0.02527,"percentile":0.84897}],"urls":["http://python.org","https://github.com/python/cpython/issues/102988","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOX7BCN6YL7B3RFPEEXPIU5CMTEHJOKR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://python-security.readthedocs.io/vuln/email-parseaddr-realname.html","https://security.netapp.com/advisory/ntap-20230601-0003/","http://seclists.org/fulldisclosure/2025/Apr/8","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27043","description":"The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-27043","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-27043","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-11-02","epss":0.02527,"percentile":0.84897}],"risk":1.2635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-27043"},"relatedVulnerabilities":[{"id":"CVE-2023-27043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-11-02","epss":0.02527,"percentile":0.84897}],"urls":["http://python.org","https://github.com/python/cpython/issues/102988","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOX7BCN6YL7B3RFPEEXPIU5CMTEHJOKR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://python-security.readthedocs.io/vuln/email-parseaddr-realname.html","https://security.netapp.com/advisory/ntap-20230601-0003/","http://seclists.org/fulldisclosure/2025/Apr/8","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27043","description":"The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-27043","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-27043","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-11-02","epss":0.02527,"percentile":0.84897}],"risk":1.2635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-27043"},"relatedVulnerabilities":[{"id":"CVE-2023-27043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-11-02","epss":0.02527,"percentile":0.84897}],"urls":["http://python.org","https://github.com/python/cpython/issues/102988","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOX7BCN6YL7B3RFPEEXPIU5CMTEHJOKR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://python-security.readthedocs.io/vuln/email-parseaddr-realname.html","https://security.netapp.com/advisory/ntap-20230601-0003/","http://seclists.org/fulldisclosure/2025/Apr/8","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27043","description":"The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-27043","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-27043","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-11-02","epss":0.02527,"percentile":0.84897}],"risk":1.2635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-27043"},"relatedVulnerabilities":[{"id":"CVE-2023-27043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-11-02","epss":0.02527,"percentile":0.84897}],"urls":["http://python.org","https://github.com/python/cpython/issues/102988","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOX7BCN6YL7B3RFPEEXPIU5CMTEHJOKR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://python-security.readthedocs.io/vuln/email-parseaddr-realname.html","https://security.netapp.com/advisory/ntap-20230601-0003/","http://seclists.org/fulldisclosure/2025/Apr/8","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27043","description":"The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python."}]},{"artifact":{"id":"c87a73d6229303b3","cpes":["cpe:2.3:a:apache:tomcat-coyote:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_coyote:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-coyote","purl":"pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat","virtualPath":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","manifestName":"","pomArtifactID":"tomcat-coyote","archiveDigests":[{"value":"20f6014eba726230cc33ce7f0248b3261b7bae58","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.107"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4j3c-42xv-3f84","versionConstraint":">=9.0.0.M1,<9.0.107 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat:tomcat-coyote","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4j3c-42xv-3f84","fix":{"state":"fixed","versions":["9.0.107"],"available":[{"date":"2026-07-01","kind":"first-observed","version":"9.0.107"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52434","cwe":"CWE-362","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-52434","date":"2026-11-02","epss":0.02074,"percentile":0.81465}],"risk":1.23403,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-52434","https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030","https://github.com/apache/tomcat/commit/8a83c3c42d20762782678932c14005cd3397a018","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html","http://www.openwall.com/lists/oss-security/2025/07/10/11"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4j3c-42xv-3f84","description":"Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector"},"relatedVulnerabilities":[{"id":"CVE-2025-52434","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52434","cwe":"CWE-362","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-52434","date":"2026-11-02","epss":0.02074,"percentile":0.81465}],"urls":["https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030","http://www.openwall.com/lists/oss-security/2025/07/10/11","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52434","description":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.\n\nThis issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 9.0.107, which fixes the issue."}]},{"artifact":{"id":"3058891d9c69e832","cpes":["cpe:2.3:a:com.atlassian.confluence:confluence:8.7.2:*:*:*:*:*:*:*","cpe:2.3:a:confluence:confluence:8.7.2:*:*:*:*:*:*:*","cpe:2.3:a:atlassian:confluence:8.7.2:*:*:*:*:*:*:*"],"name":"confluence","purl":"pkg:maven/com.atlassian.confluence/confluence@8.7.2","type":"java-archive","version":"8.7.2","language":"java","licenses":[],"metadata":{"pomGroupID":"com.atlassian.confluence","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","manifestName":"","pomArtifactID":"confluence","archiveDigests":[{"value":"afaf3eba1f92068ba7584de95e3aafadc7dc66c5","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"7.19.17"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-22526","versionConstraint":">= 7.19, < 7.19.17||>= 8.5.0, < 8.5.5||>= 8.7.0, <= 8.7.2 (maven)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.atlassian.confluence:confluence","version":"8.7.2"},"language":"java","namespace":"nvd:language:java"}}],"vulnerability":{"id":"CVE-2023-22526","fix":{"state":"fixed","versions":["7.19.17","8.5.5"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"7.19.17"},{"date":"2025-09-04","kind":"first-observed","version":"8.5.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@atlassian.com","vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-22526","cwe":"CWE-94","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-22526","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-22526","date":"2026-11-02","epss":0.01565,"percentile":0.75303}],"risk":1.2128750000000001,"urls":["https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615","https://jira.atlassian.com/browse/CONFSERVER-93516"],"severity":"High","namespace":"nvd:language:java","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-22526","description":"This High severity RCE (Remote Code Execution) vulnerability was introduced in version 7.19.0 of Confluence Data Center.\r\n\r\nThis RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction.\r\n\r\nAtlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\r\n Confluence Data Center and Server 7.19: Upgrade to a release 7.19.17, or any higher 7.19.x release\r\n Confluence Data Center and Server 8.5: Upgrade to a release 8.5.5 or any higher 8.5.x release\r\n Confluence Data Center and Server 8.7: Upgrade to a release 8.7.2 or any higher release\r\n\r\nSee the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).\r\n\r\nThis vulnerability was discovered by m1sn0w and reported via our Bug Bounty program"},"relatedVulnerabilities":[]},{"artifact":{"id":"3caa98f9ceee7bf5","cpes":["cpe:2.3:a:apache:commons-configuration2:2.9.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_configuration2:2.9.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:2.9.0:*:*:*:*:*:*:*"],"name":"commons-configuration2","purl":"pkg:maven/org.apache.commons/commons-configuration2@2.9.0","type":"java-archive","version":"2.9.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/commons-configuration2-2.9.0.jar","manifestName":"","pomArtifactID":"commons-configuration2","archiveDigests":[{"value":"adc3ee6b84fc62a6e75e901d080adacb72aac61e","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/commons-configuration2-2.9.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/commons-configuration2-2.9.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.10.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xjp4-hw94-mvp5","versionConstraint":">=2.0,<2.10.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-configuration2","version":"2.9.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xjp4-hw94-mvp5","fix":{"state":"fixed","versions":["2.10.1"],"available":[{"date":"2024-03-22","kind":"first-observed","version":"2.10.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29131","cwe":"CWE-787","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-29131","date":"2026-11-02","epss":0.02054,"percentile":0.81273}],"risk":1.1810499999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-29131","https://lists.apache.org/thread/03nzzzjn4oknyw5y0871tw7ltj0t3r37","https://github.com/apache/commons-configuration/commit/56b5c4dcdffbde27870df5a3105d6a5f9b22f554","https://issues.apache.org/jira/browse/CONFIGURATION-840","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YD4AFTIIQW662LUAQRMWS6BBKYSZG3YS","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SNKDKEEKZNL5FGCTZKJ6CFXFVWFL5FJ7","http://www.openwall.com/lists/oss-security/2024/03/20/4","https://security.netapp.com/advisory/ntap-20241213-0001"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xjp4-hw94-mvp5","description":"Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()"},"relatedVulnerabilities":[{"id":"CVE-2024-29131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29131","cwe":"CWE-787","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-29131","date":"2026-11-02","epss":0.02054,"percentile":0.81273}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/20/4","https://lists.apache.org/thread/03nzzzjn4oknyw5y0871tw7ltj0t3r37","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SNKDKEEKZNL5FGCTZKJ6CFXFVWFL5FJ7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YD4AFTIIQW662LUAQRMWS6BBKYSZG3YS/","https://security.netapp.com/advisory/ntap-20241213-0001/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-29131","description":"Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1.\n\nUsers are recommended to upgrade to version 2.10.1, which fixes the issue."}]},{"artifact":{"id":"a8f1f07e02daddd2","cpes":["cpe:2.3:a:org.springframework:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring_webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring_webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_webmvc:5.3.30:*:*:*:*:*:*:*"],"name":"spring-webmvc","purl":"pkg:maven/org.springframework/spring-webmvc@5.3.30","type":"java-archive","version":"5.3.30","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-webmvc-5.3.30.jar","manifestName":"","pomArtifactID":"spring-webmvc","archiveDigests":[{"value":"67ad9ebc6189c91942a52328f58d824cd3171fd9","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-webmvc-5.3.30.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-webmvc-5.3.30.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r936-gwx5-v52f","versionConstraint":">=5.3.0,<=5.3.43 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-webmvc","version":"5.3.30"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r936-gwx5-v52f","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-41242","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-41242","date":"2026-11-02","epss":0.02127,"percentile":0.81935}],"risk":1.159215,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-41242","http://spring.io/security/cve-2025-41242"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r936-gwx5-v52f","description":"Spring Framework MVC Applications Path Traversal Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-41242","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-41242","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-41242","date":"2026-11-02","epss":0.02127,"percentile":0.81935}],"urls":["http://spring.io/security/cve-2025-41242"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-41242","description":"Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.\n\nAn application can be vulnerable when all the following are true:\n\n  *  the application is deployed as a WAR or with an embedded Servlet container\n  *  the Servlet container  does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization \n  *  the application  serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with Spring resource handling\n\n\nWe have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application."}]},{"artifact":{"id":"e19667f54255995b","cpes":["cpe:2.3:a:org.clojure:clojure:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:clojure:clojure:1.11.1:*:*:*:*:*:*:*"],"name":"clojure","purl":"pkg:maven/org.clojure/clojure@1.11.1","type":"java-archive","version":"1.11.1","language":"java","licenses":["Eclipse Public License 1.0"],"metadata":{"pomGroupID":"org.clojure","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:org.clojure:clojure","manifestName":"","pomArtifactID":"clojure","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vr64-r9qj-h27f","versionConstraint":">=1.7.0,<1.11.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.clojure:clojure","version":"1.11.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vr64-r9qj-h27f","fix":{"state":"fixed","versions":["1.11.2"],"available":[{"date":"2024-03-09","kind":"first-observed","version":"1.11.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-22871","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-22871","date":"2026-11-02","epss":0.01533,"percentile":0.748}],"risk":1.14975,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-22871","https://hackmd.io/%40fe1w0/rymmJGida","https://clojure.atlassian.net/browse/CLJ-2839","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWWK2SO2MH4SXPO6L444MM6LHVLVFULV","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25FKUOYXQZGGJMFUM5HJABWMIX2TILRV","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFPGUDXMW6OXKIDGCOZFEAXO74VQIB2T","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/25FKUOYXQZGGJMFUM5HJABWMIX2TILRV","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SWWK2SO2MH4SXPO6L444MM6LHVLVFULV","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFPGUDXMW6OXKIDGCOZFEAXO74VQIB2T"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vr64-r9qj-h27f","description":"Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service"},"relatedVulnerabilities":[{"id":"CVE-2024-22871","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-22871","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-22871","date":"2026-11-02","epss":0.01533,"percentile":0.748}],"urls":["https://hackmd.io/%40fe1w0/rymmJGida","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25FKUOYXQZGGJMFUM5HJABWMIX2TILRV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWWK2SO2MH4SXPO6L444MM6LHVLVFULV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFPGUDXMW6OXKIDGCOZFEAXO74VQIB2T/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/25FKUOYXQZGGJMFUM5HJABWMIX2TILRV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SWWK2SO2MH4SXPO6L444MM6LHVLVFULV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFPGUDXMW6OXKIDGCOZFEAXO74VQIB2T/","https://github.com/advisories/GHSA-vr64-r9qj-h27f","https://github.com/clojure/clojure/blob/c07c39cac49a91f6031fe05c2eb7a257aa089176/changes.md?plain=1#L7C33-L9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-22871","description":"An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function."}]},{"artifact":{"id":"cecd721853682098","cpes":["cpe:2.3:a:apache:struts2-core:6.3.0.2-atlassian-3:*:*:*:*:*:*:*","cpe:2.3:a:apache:struts2_core:6.3.0.2-atlassian-3:*:*:*:*:*:*:*","cpe:2.3:a:apache:2-core:6.3.0.2-atlassian-3:*:*:*:*:*:*:*","cpe:2.3:a:apache:2_core:6.3.0.2-atlassian-3:*:*:*:*:*:*:*","cpe:2.3:a:apache:struts:6.3.0.2-atlassian-3:*:*:*:*:*:*:*"],"name":"struts2-core","purl":"pkg:maven/org.apache.struts/struts2-core@6.3.0.2-atlassian-3","type":"java-archive","version":"6.3.0.2-atlassian-3","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.struts","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.struts_struts2-core-6.3.0.2-atlassian-3.jar","manifestName":"","pomArtifactID":"struts2-core","archiveDigests":[{"value":"1924a6457f174e518d1232a7b82996a2c9101441","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.struts_struts2-core-6.3.0.2-atlassian-3.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.struts_struts2-core-6.3.0.2-atlassian-3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.8.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xx7v-hqxh-cjr9","versionConstraint":">=6.0.0,<6.8.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.struts:struts2-core","version":"6.3.0.2-atlassian-3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xx7v-hqxh-cjr9","fix":{"state":"fixed","versions":["6.8.0"],"available":[{"date":"2025-12-04","kind":"first-observed","version":"6.8.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64775","cwe":"CWE-459","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-64775","date":"2026-11-02","epss":0.01526,"percentile":0.7468}],"risk":1.1445,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-64775","https://cwiki.apache.org/confluence/display/WW/S2-068","http://www.openwall.com/lists/oss-security/2025/12/01/2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xx7v-hqxh-cjr9","description":"Apache Struts is Vulnerable to DoS via File Leak"},"relatedVulnerabilities":[{"id":"CVE-2025-64775","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64775","cwe":"CWE-459","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-64775","date":"2026-11-02","epss":0.01526,"percentile":0.7468}],"urls":["https://cwiki.apache.org/confluence/display/WW/S2-068","http://www.openwall.com/lists/oss-security/2025/12/01/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64775","description":"Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.\n\nThis issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3.\n\nUsers are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue."}]},{"artifact":{"id":"5d2b2dbb02428e35","cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.37.2-4ubuntu3:*:*:*:*:*:*:*"],"name":"bsdutils","purl":"pkg:deb/ubuntu/bsdutils@1%3A2.37.2-4ubuntu3?arch=amd64&distro=ubuntu-22.04&upstream=util-linux%402.37.2-4ubuntu3","type":"deb","version":"1:2.37.2-4ubuntu3","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"upstreams":[{"name":"util-linux","version":"2.37.2-4ubuntu3"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.2-4ubuntu3.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-28085","versionConstraint":"< 2.37.2-4ubuntu3.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-28085","fix":{"state":"fixed","versions":["2.37.2-4ubuntu3.4"],"available":[{"date":"2024-04-10","kind":"advisory","version":"2.37.2-4ubuntu3.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"risk":1.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28085"},"relatedVulnerabilities":[{"id":"CVE-2024-28085","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/27/5","http://www.openwall.com/lists/oss-security/2024/03/27/6","http://www.openwall.com/lists/oss-security/2024/03/27/7","http://www.openwall.com/lists/oss-security/2024/03/27/8","http://www.openwall.com/lists/oss-security/2024/03/27/9","http://www.openwall.com/lists/oss-security/2024/03/28/1","http://www.openwall.com/lists/oss-security/2024/03/28/2","http://www.openwall.com/lists/oss-security/2024/03/28/3","https://github.com/skyler-ferrante/CVE-2024-28085","https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq","https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html","https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/","https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt","https://security.netapp.com/advisory/ntap-20240531-0003/","https://www.openwall.com/lists/oss-security/2024/03/27/5","http://seclists.org/fulldisclosure/2024/Mar/35","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://github.com/util-linux/util-linux/discussions/2868"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28085","description":"wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover."}]},{"artifact":{"id":"d4145cf2c4ff445c","cpes":["cpe:2.3:a:libblkid1:libblkid1:2.37.2-4ubuntu3:*:*:*:*:*:*:*"],"name":"libblkid1","purl":"pkg:deb/ubuntu/libblkid1@2.37.2-4ubuntu3?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","type":"deb","version":"2.37.2-4ubuntu3","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.2-4ubuntu3.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-28085","versionConstraint":"< 2.37.2-4ubuntu3.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-28085","fix":{"state":"fixed","versions":["2.37.2-4ubuntu3.4"],"available":[{"date":"2024-04-10","kind":"advisory","version":"2.37.2-4ubuntu3.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"risk":1.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28085"},"relatedVulnerabilities":[{"id":"CVE-2024-28085","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/27/5","http://www.openwall.com/lists/oss-security/2024/03/27/6","http://www.openwall.com/lists/oss-security/2024/03/27/7","http://www.openwall.com/lists/oss-security/2024/03/27/8","http://www.openwall.com/lists/oss-security/2024/03/27/9","http://www.openwall.com/lists/oss-security/2024/03/28/1","http://www.openwall.com/lists/oss-security/2024/03/28/2","http://www.openwall.com/lists/oss-security/2024/03/28/3","https://github.com/skyler-ferrante/CVE-2024-28085","https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq","https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html","https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/","https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt","https://security.netapp.com/advisory/ntap-20240531-0003/","https://www.openwall.com/lists/oss-security/2024/03/27/5","http://seclists.org/fulldisclosure/2024/Mar/35","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://github.com/util-linux/util-linux/discussions/2868"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28085","description":"wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover."}]},{"artifact":{"id":"5a046a4c49dd48e5","cpes":["cpe:2.3:a:libmount1:libmount1:2.37.2-4ubuntu3:*:*:*:*:*:*:*"],"name":"libmount1","purl":"pkg:deb/ubuntu/libmount1@2.37.2-4ubuntu3?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","type":"deb","version":"2.37.2-4ubuntu3","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.2-4ubuntu3.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-28085","versionConstraint":"< 2.37.2-4ubuntu3.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-28085","fix":{"state":"fixed","versions":["2.37.2-4ubuntu3.4"],"available":[{"date":"2024-04-10","kind":"advisory","version":"2.37.2-4ubuntu3.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"risk":1.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28085"},"relatedVulnerabilities":[{"id":"CVE-2024-28085","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/27/5","http://www.openwall.com/lists/oss-security/2024/03/27/6","http://www.openwall.com/lists/oss-security/2024/03/27/7","http://www.openwall.com/lists/oss-security/2024/03/27/8","http://www.openwall.com/lists/oss-security/2024/03/27/9","http://www.openwall.com/lists/oss-security/2024/03/28/1","http://www.openwall.com/lists/oss-security/2024/03/28/2","http://www.openwall.com/lists/oss-security/2024/03/28/3","https://github.com/skyler-ferrante/CVE-2024-28085","https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq","https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html","https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/","https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt","https://security.netapp.com/advisory/ntap-20240531-0003/","https://www.openwall.com/lists/oss-security/2024/03/27/5","http://seclists.org/fulldisclosure/2024/Mar/35","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://github.com/util-linux/util-linux/discussions/2868"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28085","description":"wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover."}]},{"artifact":{"id":"7a54b06f57bd70b8","cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.37.2-4ubuntu3:*:*:*:*:*:*:*"],"name":"libsmartcols1","purl":"pkg:deb/ubuntu/libsmartcols1@2.37.2-4ubuntu3?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","type":"deb","version":"2.37.2-4ubuntu3","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.2-4ubuntu3.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-28085","versionConstraint":"< 2.37.2-4ubuntu3.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-28085","fix":{"state":"fixed","versions":["2.37.2-4ubuntu3.4"],"available":[{"date":"2024-04-10","kind":"advisory","version":"2.37.2-4ubuntu3.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"risk":1.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28085"},"relatedVulnerabilities":[{"id":"CVE-2024-28085","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/27/5","http://www.openwall.com/lists/oss-security/2024/03/27/6","http://www.openwall.com/lists/oss-security/2024/03/27/7","http://www.openwall.com/lists/oss-security/2024/03/27/8","http://www.openwall.com/lists/oss-security/2024/03/27/9","http://www.openwall.com/lists/oss-security/2024/03/28/1","http://www.openwall.com/lists/oss-security/2024/03/28/2","http://www.openwall.com/lists/oss-security/2024/03/28/3","https://github.com/skyler-ferrante/CVE-2024-28085","https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq","https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html","https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/","https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt","https://security.netapp.com/advisory/ntap-20240531-0003/","https://www.openwall.com/lists/oss-security/2024/03/27/5","http://seclists.org/fulldisclosure/2024/Mar/35","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://github.com/util-linux/util-linux/discussions/2868"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28085","description":"wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover."}]},{"artifact":{"id":"20bf0434cc67ede0","cpes":["cpe:2.3:a:libuuid1:libuuid1:2.37.2-4ubuntu3:*:*:*:*:*:*:*"],"name":"libuuid1","purl":"pkg:deb/ubuntu/libuuid1@2.37.2-4ubuntu3?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","type":"deb","version":"2.37.2-4ubuntu3","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.2-4ubuntu3.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-28085","versionConstraint":"< 2.37.2-4ubuntu3.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-28085","fix":{"state":"fixed","versions":["2.37.2-4ubuntu3.4"],"available":[{"date":"2024-04-10","kind":"advisory","version":"2.37.2-4ubuntu3.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"risk":1.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28085"},"relatedVulnerabilities":[{"id":"CVE-2024-28085","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/27/5","http://www.openwall.com/lists/oss-security/2024/03/27/6","http://www.openwall.com/lists/oss-security/2024/03/27/7","http://www.openwall.com/lists/oss-security/2024/03/27/8","http://www.openwall.com/lists/oss-security/2024/03/27/9","http://www.openwall.com/lists/oss-security/2024/03/28/1","http://www.openwall.com/lists/oss-security/2024/03/28/2","http://www.openwall.com/lists/oss-security/2024/03/28/3","https://github.com/skyler-ferrante/CVE-2024-28085","https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq","https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html","https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/","https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt","https://security.netapp.com/advisory/ntap-20240531-0003/","https://www.openwall.com/lists/oss-security/2024/03/27/5","http://seclists.org/fulldisclosure/2024/Mar/35","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://github.com/util-linux/util-linux/discussions/2868"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28085","description":"wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover."}]},{"artifact":{"id":"ba61e29b519f7c0e","cpes":["cpe:2.3:a:mount:mount:2.37.2-4ubuntu3:*:*:*:*:*:*:*"],"name":"mount","purl":"pkg:deb/ubuntu/mount@2.37.2-4ubuntu3?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","type":"deb","version":"2.37.2-4ubuntu3","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/mount.list"}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.2-4ubuntu3.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-28085","versionConstraint":"< 2.37.2-4ubuntu3.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-28085","fix":{"state":"fixed","versions":["2.37.2-4ubuntu3.4"],"available":[{"date":"2024-04-10","kind":"advisory","version":"2.37.2-4ubuntu3.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"risk":1.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28085"},"relatedVulnerabilities":[{"id":"CVE-2024-28085","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/27/5","http://www.openwall.com/lists/oss-security/2024/03/27/6","http://www.openwall.com/lists/oss-security/2024/03/27/7","http://www.openwall.com/lists/oss-security/2024/03/27/8","http://www.openwall.com/lists/oss-security/2024/03/27/9","http://www.openwall.com/lists/oss-security/2024/03/28/1","http://www.openwall.com/lists/oss-security/2024/03/28/2","http://www.openwall.com/lists/oss-security/2024/03/28/3","https://github.com/skyler-ferrante/CVE-2024-28085","https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq","https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html","https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/","https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt","https://security.netapp.com/advisory/ntap-20240531-0003/","https://www.openwall.com/lists/oss-security/2024/03/27/5","http://seclists.org/fulldisclosure/2024/Mar/35","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://github.com/util-linux/util-linux/discussions/2868"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28085","description":"wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover."}]},{"artifact":{"id":"8c791e651ad0ce02","cpes":["cpe:2.3:a:util-linux:util-linux:2.37.2-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.37.2-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.37.2-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.37.2-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.37.2-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.37.2-4ubuntu3:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/ubuntu/util-linux@2.37.2-4ubuntu3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"2.37.2-4ubuntu3","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.preinst","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/util-linux.preinst"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.2-4ubuntu3.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-28085","versionConstraint":"< 2.37.2-4ubuntu3.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-28085","fix":{"state":"fixed","versions":["2.37.2-4ubuntu3.4"],"available":[{"date":"2024-04-10","kind":"advisory","version":"2.37.2-4ubuntu3.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"risk":1.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28085"},"relatedVulnerabilities":[{"id":"CVE-2024-28085","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28085","cwe":"CWE-150","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28085","date":"2026-11-02","epss":0.02242,"percentile":0.82852}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/27/5","http://www.openwall.com/lists/oss-security/2024/03/27/6","http://www.openwall.com/lists/oss-security/2024/03/27/7","http://www.openwall.com/lists/oss-security/2024/03/27/8","http://www.openwall.com/lists/oss-security/2024/03/27/9","http://www.openwall.com/lists/oss-security/2024/03/28/1","http://www.openwall.com/lists/oss-security/2024/03/28/2","http://www.openwall.com/lists/oss-security/2024/03/28/3","https://github.com/skyler-ferrante/CVE-2024-28085","https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq","https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html","https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/","https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt","https://security.netapp.com/advisory/ntap-20240531-0003/","https://www.openwall.com/lists/oss-security/2024/03/27/5","http://seclists.org/fulldisclosure/2024/Mar/35","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://github.com/util-linux/util-linux/discussions/2868"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28085","description":"wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-6232","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6232","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6232","date":"2026-11-02","epss":0.02203,"percentile":0.82547}],"risk":1.1015000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6232"},"relatedVulnerabilities":[{"id":"CVE-2024-6232","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6232","date":"2026-11-02","epss":0.02203,"percentile":0.82547}],"urls":["https://github.com/python/cpython/commit/34ddb64d088dd7ccc321f6103d23153256caa5d4","https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06","https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4","https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d","https://github.com/python/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877","https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf","https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373","https://github.com/python/cpython/issues/121285","https://github.com/python/cpython/pull/121286","https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/","http://www.openwall.com/lists/oss-security/2024/09/03/5","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0007/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6232","description":"There is a MEDIUM severity vulnerability affecting CPython.\n\n\n\n\n\nRegular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-6232","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6232","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6232","date":"2026-11-02","epss":0.02203,"percentile":0.82547}],"risk":1.1015000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6232"},"relatedVulnerabilities":[{"id":"CVE-2024-6232","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6232","date":"2026-11-02","epss":0.02203,"percentile":0.82547}],"urls":["https://github.com/python/cpython/commit/34ddb64d088dd7ccc321f6103d23153256caa5d4","https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06","https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4","https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d","https://github.com/python/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877","https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf","https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373","https://github.com/python/cpython/issues/121285","https://github.com/python/cpython/pull/121286","https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/","http://www.openwall.com/lists/oss-security/2024/09/03/5","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0007/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6232","description":"There is a MEDIUM severity vulnerability affecting CPython.\n\n\n\n\n\nRegular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-6232","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6232","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6232","date":"2026-11-02","epss":0.02203,"percentile":0.82547}],"risk":1.1015000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6232"},"relatedVulnerabilities":[{"id":"CVE-2024-6232","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6232","date":"2026-11-02","epss":0.02203,"percentile":0.82547}],"urls":["https://github.com/python/cpython/commit/34ddb64d088dd7ccc321f6103d23153256caa5d4","https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06","https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4","https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d","https://github.com/python/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877","https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf","https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373","https://github.com/python/cpython/issues/121285","https://github.com/python/cpython/pull/121286","https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/","http://www.openwall.com/lists/oss-security/2024/09/03/5","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0007/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6232","description":"There is a MEDIUM severity vulnerability affecting CPython.\n\n\n\n\n\nRegular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-6232","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6232","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6232","date":"2026-11-02","epss":0.02203,"percentile":0.82547}],"risk":1.1015000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6232"},"relatedVulnerabilities":[{"id":"CVE-2024-6232","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6232","date":"2026-11-02","epss":0.02203,"percentile":0.82547}],"urls":["https://github.com/python/cpython/commit/34ddb64d088dd7ccc321f6103d23153256caa5d4","https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06","https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4","https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d","https://github.com/python/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877","https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf","https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373","https://github.com/python/cpython/issues/121285","https://github.com/python/cpython/pull/121286","https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/","http://www.openwall.com/lists/oss-security/2024/09/03/5","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0007/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6232","description":"There is a MEDIUM severity vulnerability affecting CPython.\n\n\n\n\n\nRegular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives."}]},{"artifact":{"id":"af534de498eed696","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52425","versionConstraint":"< 2.4.7-1ubuntu0.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-52425","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.3"],"available":[{"date":"2024-03-14","kind":"advisory","version":"2.4.7-1ubuntu0.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2023-52425","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-52425","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52425","date":"2026-11-02","epss":0.02149,"percentile":0.82121}],"risk":1.0745,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52425"},"relatedVulnerabilities":[{"id":"CVE-2023-52425","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52425","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-52425","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52425","date":"2026-11-02","epss":0.02149,"percentile":0.82121}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/20/5","https://github.com/libexpat/libexpat/pull/789","https://lists.debian.org/debian-lts-announce/2024/04/msg00006.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/","https://security.netapp.com/advisory/ntap-20240614-0003/","https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-784301.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52425","description":"libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed."}]},{"artifact":{"id":"cfda19effa7c6d29","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.3?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.3","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33845","versionConstraint":"< 3.7.3-4ubuntu1.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-33845","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.9"],"available":[{"date":"2026-05-20","kind":"advisory","version":"3.7.3-4ubuntu1.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-33845","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-33845","cwe":"CWE-191","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33845","date":"2026-11-02","epss":0.02073,"percentile":0.81458}],"risk":1.0365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33845"},"relatedVulnerabilities":[{"id":"CVE-2026-33845","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33845","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-33845","cwe":"CWE-191","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33845","date":"2026-11-02","epss":0.02073,"percentile":0.81458}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:34372","https://access.redhat.com/errata/RHSA-2026:36004","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:56786","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:56911","https://access.redhat.com/errata/RHSA-2026:57402","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-33845","https://bugzilla.redhat.com/show_bug.cgi?id=2450624","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33845.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33845","description":"A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service."}]},{"artifact":{"id":"3caa98f9ceee7bf5","cpes":["cpe:2.3:a:apache:commons-configuration2:2.9.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_configuration2:2.9.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:2.9.0:*:*:*:*:*:*:*"],"name":"commons-configuration2","purl":"pkg:maven/org.apache.commons/commons-configuration2@2.9.0","type":"java-archive","version":"2.9.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/commons-configuration2-2.9.0.jar","manifestName":"","pomArtifactID":"commons-configuration2","archiveDigests":[{"value":"adc3ee6b84fc62a6e75e901d080adacb72aac61e","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/commons-configuration2-2.9.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/commons-configuration2-2.9.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.10.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9w38-p64v-xpmv","versionConstraint":">=2.0,<2.10.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-configuration2","version":"2.9.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9w38-p64v-xpmv","fix":{"state":"fixed","versions":["2.10.1"],"available":[{"date":"2024-03-22","kind":"first-observed","version":"2.10.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29133","cwe":"CWE-787","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2024-29133","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-29133","date":"2026-11-02","epss":0.01727,"percentile":0.7756}],"risk":1.010295,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-29133","https://lists.apache.org/thread/ccb9w15bscznh6tnp3wsvrrj9crbszh2","https://github.com/apache/commons-configuration/commit/43f4dab021e9acb8db390db2ae80aa0cee4f9ee4","https://issues.apache.org/jira/browse/CONFIGURATION-841","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SNKDKEEKZNL5FGCTZKJ6CFXFVWFL5FJ7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YD4AFTIIQW662LUAQRMWS6BBKYSZG3YS","http://www.openwall.com/lists/oss-security/2024/03/20/3"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9w38-p64v-xpmv","description":"Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree"},"relatedVulnerabilities":[{"id":"CVE-2024-29133","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29133","cwe":"CWE-787","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2024-29133","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-29133","date":"2026-11-02","epss":0.01727,"percentile":0.7756}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/20/3","https://lists.apache.org/thread/ccb9w15bscznh6tnp3wsvrrj9crbszh2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SNKDKEEKZNL5FGCTZKJ6CFXFVWFL5FJ7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YD4AFTIIQW662LUAQRMWS6BBKYSZG3YS/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-29133","description":"Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1.\n\nUsers are recommended to upgrade to version 2.10.1, which fixes the issue."}]},{"artifact":{"id":"af534de498eed696","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-28757","versionConstraint":"< 2.4.7-1ubuntu0.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-28757","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.3"],"available":[{"date":"2024-03-14","kind":"advisory","version":"2.4.7-1ubuntu0.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-28757","cwe":"CWE-776","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-28757","cwe":"CWE-776","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28757","date":"2026-11-02","epss":0.02006,"percentile":0.80821}],"risk":1.0030000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28757"},"relatedVulnerabilities":[{"id":"CVE-2024-28757","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28757","cwe":"CWE-776","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-28757","cwe":"CWE-776","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28757","date":"2026-11-02","epss":0.02006,"percentile":0.80821}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/15/1","https://github.com/libexpat/libexpat/issues/839","https://github.com/libexpat/libexpat/pull/842","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE/","https://security.netapp.com/advisory/ntap-20240322-0001/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-784301.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28757","description":"libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate)."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.28"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-30749","versionConstraint":"< 1.8.0_462||>= 1.9, < 8.0.462||>= 12, < 17.0.16||>= 18, < 21.0.8||>= 22, < 24.0.2||>= 9, < 11.0.28 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-30749","fix":{"state":"fixed","versions":["1.8.0_462","8.0.462","11.0.28","17.0.16","21.0.8","24.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_462"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.462"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.16"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.8"},{"date":"2025-09-04","kind":"first-observed","version":"24.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.28"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-30749","date":"2026-11-02","epss":0.0127,"percentile":0.69823}],"risk":0.9906,"urls":["https://www.oracle.com/security-alerts/cpujul2025.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00014.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-30749","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and  24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."},"relatedVulnerabilities":[]},{"artifact":{"id":"b9d62df08eb83108","cpes":["cpe:2.3:a:org.eclipse.jetty:jetty-http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty-http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty_http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty-http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty_http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:10.0.15:*:*:*:*:*:*:*"],"name":"jetty-http","purl":"pkg:maven/org.eclipse.jetty/jetty-http@10.0.15","type":"java-archive","version":"10.0.15","language":"java","licenses":[],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar:org.eclipse.jetty:jetty-http","manifestName":"","pomArtifactID":"jetty-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"10.0.28"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-355h-qmc2-wpwf","versionConstraint":">=10.0.0,<=10.0.27 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-http","version":"10.0.15"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-355h-qmc2-wpwf","fix":{"state":"fixed","versions":["10.0.28"],"available":[{"date":"2026-04-15","kind":"first-observed","version":"10.0.28"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2332","cwe":"CWE-444","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2026-2332","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-2332","date":"2026-11-02","epss":0.01305,"percentile":0.70534}],"risk":0.972225,"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf","https://nvd.nist.gov/vuln/detail/CVE-2026-2332","https://gitlab.eclipse.org/security/cve-assignment/-/issues/89","https://w4ke.info/2025/06/18/funky-chunks.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json","https://bugzilla.redhat.com/show_bug.cgi?id=2458187","https://access.redhat.com/security/cve/CVE-2026-2332","https://access.redhat.com/errata/RHSA-2026:50263","https://access.redhat.com/errata/RHSA-2026:50223","https://access.redhat.com/errata/RHSA-2026:50222","https://access.redhat.com/errata/RHSA-2026:50221","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:22453","https://access.redhat.com/errata/RHSA-2026:21773","https://access.redhat.com/errata/RHSA-2026:20568","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:10175"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-355h-qmc2-wpwf","description":"Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-2332","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"emo@eclipse.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2332","cwe":"CWE-444","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2026-2332","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-2332","date":"2026-11-02","epss":0.01305,"percentile":0.70534}],"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf","https://gitlab.eclipse.org/security/cve-assignment/-/issues/89","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:20568","https://access.redhat.com/errata/RHSA-2026:21773","https://access.redhat.com/errata/RHSA-2026:22453","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:50221","https://access.redhat.com/errata/RHSA-2026:50222","https://access.redhat.com/errata/RHSA-2026:50223","https://access.redhat.com/errata/RHSA-2026:50263","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/security/cve/CVE-2026-2332","https://bugzilla.redhat.com/show_bug.cgi?id=2458187","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2332","description":"In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\n  *  https://w4ke.info/2025/06/18/funky-chunks.html\n\n  *  https://w4ke.info/2025/10/29/funky-chunks-2.html\n\n\nJetty terminates chunk extension parsing at \\r\\n inside quoted strings instead of treating this as an error.\n\n\n\n\nPOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext=\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\n\n\n\n\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request."}]},{"artifact":{"id":"f0642bd85aa62ed2","cpes":["cpe:2.3:a:org.eclipse.jetty.http:jetty-http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.http:jetty_http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty-http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty_http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty-http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty_http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.http:jetty:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty-http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.http:http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty-http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty_http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty-http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty_http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:http:jetty-http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:http:jetty_http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:http:jetty:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty:http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:http:http:10.0.18:*:*:*:*:*:*:*"],"name":"jetty-http","purl":"pkg:maven/org.eclipse.jetty/jetty-http@10.0.18","type":"java-archive","version":"10.0.18","language":"java","licenses":["https://www.eclipse.org/legal/epl-2.0/, https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jetty-http-10.0.18.jar","manifestName":"","pomArtifactID":"jetty-http","archiveDigests":[{"value":"9b7f2b580bdcf2a9c27168eac58276c7e6e99ccf","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jetty-http-10.0.18.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jetty-http-10.0.18.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"10.0.28"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-355h-qmc2-wpwf","versionConstraint":">=10.0.0,<=10.0.27 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-http","version":"10.0.18"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-355h-qmc2-wpwf","fix":{"state":"fixed","versions":["10.0.28"],"available":[{"date":"2026-04-15","kind":"first-observed","version":"10.0.28"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2332","cwe":"CWE-444","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2026-2332","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-2332","date":"2026-11-02","epss":0.01305,"percentile":0.70534}],"risk":0.972225,"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf","https://nvd.nist.gov/vuln/detail/CVE-2026-2332","https://gitlab.eclipse.org/security/cve-assignment/-/issues/89","https://w4ke.info/2025/06/18/funky-chunks.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json","https://bugzilla.redhat.com/show_bug.cgi?id=2458187","https://access.redhat.com/security/cve/CVE-2026-2332","https://access.redhat.com/errata/RHSA-2026:50263","https://access.redhat.com/errata/RHSA-2026:50223","https://access.redhat.com/errata/RHSA-2026:50222","https://access.redhat.com/errata/RHSA-2026:50221","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:22453","https://access.redhat.com/errata/RHSA-2026:21773","https://access.redhat.com/errata/RHSA-2026:20568","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:10175"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-355h-qmc2-wpwf","description":"Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-2332","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"emo@eclipse.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2332","cwe":"CWE-444","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2026-2332","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-2332","date":"2026-11-02","epss":0.01305,"percentile":0.70534}],"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf","https://gitlab.eclipse.org/security/cve-assignment/-/issues/89","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:20568","https://access.redhat.com/errata/RHSA-2026:21773","https://access.redhat.com/errata/RHSA-2026:22453","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:50221","https://access.redhat.com/errata/RHSA-2026:50222","https://access.redhat.com/errata/RHSA-2026:50223","https://access.redhat.com/errata/RHSA-2026:50263","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/security/cve/CVE-2026-2332","https://bugzilla.redhat.com/show_bug.cgi?id=2458187","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2332","description":"In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\n  *  https://w4ke.info/2025/06/18/funky-chunks.html\n\n  *  https://w4ke.info/2025/10/29/funky-chunks-2.html\n\n\nJetty terminates chunk extension parsing at \\r\\n inside quoted strings instead of treating this as an error.\n\n\n\n\nPOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext=\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\n\n\n\n\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request."}]},{"artifact":{"id":"56f757709c1467d1","cpes":["cpe:2.3:a:python3-pkg-resources:python3-pkg-resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg-resources:python3_pkg_resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg_resources:python3-pkg-resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg_resources:python3_pkg_resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg:python3-pkg-resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg:python3_pkg_resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg:python3-pkg-resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg:python3_pkg_resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-pkg-resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_pkg_resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*"],"name":"python3-pkg-resources","purl":"pkg:deb/ubuntu/python3-pkg-resources@59.6.0-1.2ubuntu0.22.04.1?arch=all&distro=ubuntu-22.04&upstream=setuptools","type":"deb","version":"59.6.0-1.2ubuntu0.22.04.1","language":"","licenses":["Apache-2.0","BSD-3-Clause","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3-pkg-resources/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3-pkg-resources/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3-pkg-resources.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3-pkg-resources.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.list"},{"path":"/var/lib/dpkg/info/python3-pkg-resources.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.postinst"},{"path":"/var/lib/dpkg/info/python3-pkg-resources.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.prerm"}],"upstreams":[{"name":"setuptools"}]},"matchDetails":[{"fix":{"suggestedVersion":"59.6.0-1.2ubuntu0.22.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-6345","versionConstraint":"< 59.6.0-1.2ubuntu0.22.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"setuptools","version":"59.6.0-1.2ubuntu0.22.04.1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6345","fix":{"state":"fixed","versions":["59.6.0-1.2ubuntu0.22.04.2"],"available":[{"date":"2024-09-12","kind":"advisory","version":"59.6.0-1.2ubuntu0.22.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6345","cwe":"CWE-94","type":"Secondary","source":"security@huntr.dev"}],"epss":[{"cve":"CVE-2024-6345","date":"2026-11-02","epss":0.01939,"percentile":0.80114}],"risk":0.9695,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6345"},"relatedVulnerabilities":[{"id":"CVE-2024-6345","cvss":[{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6345","cwe":"CWE-94","type":"Secondary","source":"security@huntr.dev"}],"epss":[{"cve":"CVE-2024-6345","date":"2026-11-02","epss":0.01939,"percentile":0.80114}],"urls":["https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0","https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5","https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html","https://github.com/advisories/GHSA-cx63-2mw6-8hw5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6345","description":"A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0."}]},{"artifact":{"id":"bab0f28d5b9840f7","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.12.7.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1","type":"java-archive","version":"2.12.7.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.12.7.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"a6af29070f42c49f","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2","type":"java-archive","version":"2.13.4.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.13.4.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"7e51f2d66453ad51","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar:META-INF/lib/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar:META-INF/lib/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"8b225a368370af7c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"7bbe612d6a8369b0","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"3ad576839e998952","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/jackson-databind-2.15.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"9353b021f10c307c00328f52090de2bdb4b6ff9c","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/jackson-databind-2.15.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"051e7df316b5a531","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"93ac7e2aa6804f54","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar:META-INF/lib/jackson-databind-2.15.3.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"a734bc2c47a9453c4efa772461a3aeb273c010d9","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar:META-INF/lib/jackson-databind-2.15.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"ed97116d7d90df11","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"e7a8f6a39fc0ef2d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-databind-2.16.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"55d5220f811f88ce","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-databind-2.16.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"a89c3f9fac63d225","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-11-02","epss":0.01226,"percentile":0.68829}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"4d5407177cb8d0dd","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-0727","versionConstraint":"< 3.0.2-0ubuntu1.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-0727","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.14"],"available":[{"date":"2024-02-05","kind":"advisory","version":"3.0.2-0ubuntu1.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0727","date":"2026-11-02","epss":0.03187,"percentile":0.88086}],"risk":0.9561,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-0727"},"relatedVulnerabilities":[{"id":"CVE-2024-0727","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0727","date":"2026-11-02","epss":0.03187,"percentile":0.88086}],"urls":["https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2","https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a","https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c","https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8","https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539","https://www.openssl.org/news/secadv/20240125.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240208-0006/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0727","description":"Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"1014a67cbf322356","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-0727","versionConstraint":"< 3.0.2-0ubuntu1.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-0727","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.14"],"available":[{"date":"2024-02-05","kind":"advisory","version":"3.0.2-0ubuntu1.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0727","date":"2026-11-02","epss":0.03187,"percentile":0.88086}],"risk":0.9561,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-0727"},"relatedVulnerabilities":[{"id":"CVE-2024-0727","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0727","date":"2026-11-02","epss":0.03187,"percentile":0.88086}],"urls":["https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2","https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a","https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c","https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8","https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539","https://www.openssl.org/news/secadv/20240125.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240208-0006/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0727","description":"Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"1e5e94c1bdb3aa3d","cpes":["cpe:2.3:a:libssh-4:libssh-4:0.9.6-2ubuntu0.22.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libssh-4:libssh_4:0.9.6-2ubuntu0.22.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libssh_4:libssh-4:0.9.6-2ubuntu0.22.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libssh_4:libssh_4:0.9.6-2ubuntu0.22.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh-4:0.9.6-2ubuntu0.22.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh_4:0.9.6-2ubuntu0.22.04.2:*:*:*:*:*:*:*"],"name":"libssh-4","purl":"pkg:deb/ubuntu/libssh-4@0.9.6-2ubuntu0.22.04.2?arch=amd64&distro=ubuntu-22.04&upstream=libssh","type":"deb","version":"0.9.6-2ubuntu0.22.04.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","LGPL-2.1","LGPL-2.1+~OpenSSL","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh-4/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libssh-4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh-4:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libssh-4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"0.9.6-2ubuntu0.22.04.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-5318","versionConstraint":"< 0.9.6-2ubuntu0.22.04.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libssh","version":"0.9.6-2ubuntu0.22.04.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-5318","fix":{"state":"fixed","versions":["0.9.6-2ubuntu0.22.04.4"],"available":[{"date":"2025-07-07","kind":"advisory","version":"0.9.6-2ubuntu0.22.04.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-5318","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5318","date":"2026-11-02","epss":0.01886,"percentile":0.79508}],"risk":0.943,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-5318"},"relatedVulnerabilities":[{"id":"CVE-2025-5318","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5318","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5318","date":"2026-11-02","epss":0.01886,"percentile":0.79508}],"urls":["https://access.redhat.com/errata/RHSA-2025:18231","https://access.redhat.com/errata/RHSA-2025:18275","https://access.redhat.com/errata/RHSA-2025:18286","https://access.redhat.com/errata/RHSA-2025:19012","https://access.redhat.com/errata/RHSA-2025:19098","https://access.redhat.com/errata/RHSA-2025:19101","https://access.redhat.com/errata/RHSA-2025:19295","https://access.redhat.com/errata/RHSA-2025:19300","https://access.redhat.com/errata/RHSA-2025:19313","https://access.redhat.com/errata/RHSA-2025:19400","https://access.redhat.com/errata/RHSA-2025:19401","https://access.redhat.com/errata/RHSA-2025:19470","https://access.redhat.com/errata/RHSA-2025:19472","https://access.redhat.com/errata/RHSA-2025:19807","https://access.redhat.com/errata/RHSA-2025:19864","https://access.redhat.com/errata/RHSA-2025:20943","https://access.redhat.com/errata/RHSA-2025:21013","https://access.redhat.com/errata/RHSA-2025:21329","https://access.redhat.com/errata/RHSA-2025:21829","https://access.redhat.com/errata/RHSA-2025:22275","https://access.redhat.com/errata/RHSA-2025:23078","https://access.redhat.com/errata/RHSA-2025:23079","https://access.redhat.com/errata/RHSA-2025:23080","https://access.redhat.com/errata/RHSA-2026:0326","https://access.redhat.com/errata/RHSA-2026:1541","https://access.redhat.com/errata/RHSA-2026:3461","https://access.redhat.com/errata/RHSA-2026:3462","https://access.redhat.com/security/cve/CVE-2025-5318","https://bugzilla.redhat.com/show_bug.cgi?id=2369131","https://www.libssh.org/security/advisories/CVE-2025-5318.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5318","description":"A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior."}]},{"artifact":{"id":"fb7895faf09fd4e5","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.19.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.2-2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-37371","versionConstraint":"< 1.19.2-2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-37371","fix":{"state":"fixed","versions":["1.19.2-2ubuntu0.4"],"available":[{"date":"2024-08-08","kind":"advisory","version":"1.19.2-2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-37371","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-37371","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37371","date":"2026-11-02","epss":0.01863,"percentile":0.79269}],"risk":0.9315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-37371"},"relatedVulnerabilities":[{"id":"CVE-2024-37371","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-37371","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-37371","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37371","date":"2026-11-02","epss":0.01863,"percentile":0.79269}],"urls":["https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef","https://web.mit.edu/kerberos/www/advisories/","https://security.netapp.com/advisory/ntap-20241108-0009/","https://security.netapp.com/advisory/ntap-20250124-0010/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-37371","description":"In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields."}]},{"artifact":{"id":"33db6cef15da892e","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.19.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.2-2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-37371","versionConstraint":"< 1.19.2-2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-37371","fix":{"state":"fixed","versions":["1.19.2-2ubuntu0.4"],"available":[{"date":"2024-08-08","kind":"advisory","version":"1.19.2-2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-37371","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-37371","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37371","date":"2026-11-02","epss":0.01863,"percentile":0.79269}],"risk":0.9315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-37371"},"relatedVulnerabilities":[{"id":"CVE-2024-37371","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-37371","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-37371","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37371","date":"2026-11-02","epss":0.01863,"percentile":0.79269}],"urls":["https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef","https://web.mit.edu/kerberos/www/advisories/","https://security.netapp.com/advisory/ntap-20241108-0009/","https://security.netapp.com/advisory/ntap-20250124-0010/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-37371","description":"In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields."}]},{"artifact":{"id":"8baf93711e927f68","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.19.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.2-2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-37371","versionConstraint":"< 1.19.2-2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-37371","fix":{"state":"fixed","versions":["1.19.2-2ubuntu0.4"],"available":[{"date":"2024-08-08","kind":"advisory","version":"1.19.2-2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-37371","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-37371","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37371","date":"2026-11-02","epss":0.01863,"percentile":0.79269}],"risk":0.9315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-37371"},"relatedVulnerabilities":[{"id":"CVE-2024-37371","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-37371","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-37371","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37371","date":"2026-11-02","epss":0.01863,"percentile":0.79269}],"urls":["https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef","https://web.mit.edu/kerberos/www/advisories/","https://security.netapp.com/advisory/ntap-20241108-0009/","https://security.netapp.com/advisory/ntap-20250124-0010/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-37371","description":"In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields."}]},{"artifact":{"id":"6e90bedd237fee0a","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.19.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.2-2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-37371","versionConstraint":"< 1.19.2-2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-37371","fix":{"state":"fixed","versions":["1.19.2-2ubuntu0.4"],"available":[{"date":"2024-08-08","kind":"advisory","version":"1.19.2-2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-37371","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-37371","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37371","date":"2026-11-02","epss":0.01863,"percentile":0.79269}],"risk":0.9315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-37371"},"relatedVulnerabilities":[{"id":"CVE-2024-37371","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-37371","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-37371","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37371","date":"2026-11-02","epss":0.01863,"percentile":0.79269}],"urls":["https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef","https://web.mit.edu/kerberos/www/advisories/","https://security.netapp.com/advisory/ntap-20241108-0009/","https://security.netapp.com/advisory/ntap-20250124-0010/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-37371","description":"In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields."}]},{"artifact":{"id":"868c3562ab4f302a","cpes":["cpe:2.3:a:org.springframework:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring_web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring_web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_web:5.3.30:*:*:*:*:*:*:*"],"name":"spring-web","purl":"pkg:maven/org.springframework/spring-web@5.3.30","type":"java-archive","version":"5.3.30","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-web-5.3.30.jar","manifestName":"","pomArtifactID":"spring-web","archiveDigests":[{"value":"e1a1fd179650d4ccbf95d3f475bf1050a1a84484","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-web-5.3.30.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-web-5.3.30.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.3.34"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2wrp-6fg6-hmc5","versionConstraint":"<5.3.34 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-web","version":"5.3.30"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-2wrp-6fg6-hmc5","fix":{"state":"fixed","versions":["5.3.34"],"available":[{"date":"2024-04-26","kind":"first-observed","version":"5.3.34"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-22262","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-22262","cwe":"CWE-918","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-22262","date":"2026-11-02","epss":0.01191,"percentile":0.67967}],"risk":0.9289800000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-22262","https://spring.io/security/cve-2024-22262","https://github.com/spring-projects/spring-framework/blob/main/spring-web/src/main/java/org/springframework/web/util/UriComponentsBuilder.java","https://security.netapp.com/advisory/ntap-20240524-0003"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2wrp-6fg6-hmc5","description":"Spring Framework URL Parsing with Host Validation"},"relatedVulnerabilities":[{"id":"CVE-2024-22262","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-22262","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-22262","cwe":"CWE-918","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-22262","date":"2026-11-02","epss":0.01191,"percentile":0.67967}],"urls":["https://security.netapp.com/advisory/ntap-20240524-0003/","https://spring.io/security/cve-2024-22262"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-22262","description":"Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a  open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.\n\nThis is the same as  CVE-2024-22259 https://spring.io/security/cve-2024-22259  and  CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input."}]},{"artifact":{"id":"27608fdc7273561f","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.132.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w9fj-cfpg-grvv","versionConstraint":"<4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-w9fj-cfpg-grvv","fix":{"state":"fixed","versions":["4.1.132.Final"],"available":[{"date":"2026-03-27","kind":"first-observed","version":"4.1.132.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33871","date":"2026-11-02","epss":0.01145,"percentile":0.66746}],"risk":0.92745,"urls":["https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv","https://nvd.nist.gov/vuln/detail/CVE-2026-33871"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w9fj-cfpg-grvv","description":"Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-33871","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33871","date":"2026-11-02","epss":0.01145,"percentile":0.66746}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:7109","https://access.redhat.com/errata/RHSA-2026:7380","https://access.redhat.com/errata/RHSA-2026:8159","https://access.redhat.com/errata/RHSA-2026:8509","https://access.redhat.com/security/cve/CVE-2026-33871","https://bugzilla.redhat.com/show_bug.cgi?id=2452456","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33871.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33871","description":"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue."}]},{"artifact":{"id":"fd269c6f3753e140","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.132.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w9fj-cfpg-grvv","versionConstraint":"<4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-w9fj-cfpg-grvv","fix":{"state":"fixed","versions":["4.1.132.Final"],"available":[{"date":"2026-03-27","kind":"first-observed","version":"4.1.132.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33871","date":"2026-11-02","epss":0.01145,"percentile":0.66746}],"risk":0.92745,"urls":["https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv","https://nvd.nist.gov/vuln/detail/CVE-2026-33871"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w9fj-cfpg-grvv","description":"Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-33871","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33871","date":"2026-11-02","epss":0.01145,"percentile":0.66746}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:7109","https://access.redhat.com/errata/RHSA-2026:7380","https://access.redhat.com/errata/RHSA-2026:8159","https://access.redhat.com/errata/RHSA-2026:8509","https://access.redhat.com/security/cve/CVE-2026-33871","https://bugzilla.redhat.com/show_bug.cgi?id=2452456","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33871.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33871","description":"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue."}]},{"artifact":{"id":"c469f4c848b8146f","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http2-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"cbf1a430ea44dbdedbcde16b185cbb95f28d72c7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http2-4.1.100.Final.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http2-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.132.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w9fj-cfpg-grvv","versionConstraint":"<4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-w9fj-cfpg-grvv","fix":{"state":"fixed","versions":["4.1.132.Final"],"available":[{"date":"2026-03-27","kind":"first-observed","version":"4.1.132.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33871","date":"2026-11-02","epss":0.01145,"percentile":0.66746}],"risk":0.92745,"urls":["https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv","https://nvd.nist.gov/vuln/detail/CVE-2026-33871"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w9fj-cfpg-grvv","description":"Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-33871","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33871","date":"2026-11-02","epss":0.01145,"percentile":0.66746}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:7109","https://access.redhat.com/errata/RHSA-2026:7380","https://access.redhat.com/errata/RHSA-2026:8159","https://access.redhat.com/errata/RHSA-2026:8509","https://access.redhat.com/security/cve/CVE-2026-33871","https://bugzilla.redhat.com/show_bug.cgi?id=2452456","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33871.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33871","description":"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue."}]},{"artifact":{"id":"3084fb2849d1e0d4","cpes":["cpe:2.3:a:apache:xmlsec:2.3.3:*:*:*:*:*:*:*"],"name":"xmlsec","purl":"pkg:maven/org.apache.santuario/xmlsec@2.3.3","type":"java-archive","version":"2.3.3","language":"java","licenses":["Apache License, Version 2.0"],"metadata":{"pomGroupID":"org.apache.santuario","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.plugins.authentication.atlassian-authentication-plugin-4.2.26.jar:org.apache.santuario:xmlsec","manifestName":"","pomArtifactID":"xmlsec","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.plugins.authentication.atlassian-authentication-plugin-4.2.26.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.plugins.authentication.atlassian-authentication-plugin-4.2.26.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.3.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xfrj-6vvc-3xm2","versionConstraint":">=2.3.0,<2.3.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.santuario:xmlsec","version":"2.3.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xfrj-6vvc-3xm2","fix":{"state":"fixed","versions":["2.3.4"],"available":[{"date":"2023-10-21","kind":"first-observed","version":"2.3.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-44483","cwe":"CWE-532","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2023-44483","date":"2026-11-02","epss":0.01547,"percentile":0.75011}],"risk":0.8895249999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-44483","https://lists.apache.org/thread/vmqbp9mfxtrf0kmbnnmbn3h9j6dr9q55","https://santuario.apache.org/secadv.data/CVE-2023-44483.txt.asc?version=1&modificationDate=1697782758000&api=v2","http://www.openwall.com/lists/oss-security/2023/10/20/5","https://security.netapp.com/advisory/ntap-20241108-0002"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xfrj-6vvc-3xm2","description":"Apache Santuario - XML Security for Java are vulnerable to private key disclosure"},"relatedVulnerabilities":[{"id":"CVE-2023-44483","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-44483","cwe":"CWE-532","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2023-44483","date":"2026-11-02","epss":0.01547,"percentile":0.75011}],"urls":["http://www.openwall.com/lists/oss-security/2023/10/20/5","https://lists.apache.org/thread/vmqbp9mfxtrf0kmbnnmbn3h9j6dr9q55","https://security.netapp.com/advisory/ntap-20241108-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-44483","description":"All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue."}]},{"artifact":{"id":"4d5407177cb8d0dd","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-4741","versionConstraint":"< 3.0.2-0ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-4741","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.17"],"available":[{"date":"2024-07-31","kind":"advisory","version":"3.0.2-0ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-4741","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-4741","date":"2026-11-02","epss":0.02925,"percentile":0.8706}],"risk":0.8775,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-4741"},"relatedVulnerabilities":[{"id":"CVE-2024-4741","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4741","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-4741","date":"2026-11-02","epss":0.02925,"percentile":0.8706}],"urls":["https://github.com/openssl/openssl/commit/704f725b96aa373ee45ecfb23f6abfe8be8d9177","https://github.com/openssl/openssl/commit/b3f0eb0a295f58f16ba43ba99dad70d4ee5c437d","https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac","https://github.com/openssl/openssl/commit/e5093133c35ca82874ad83697af76f4b0f7e3bd8","https://github.openssl.org/openssl/extended-releases/commit/f7a045f3143fc6da2ee66bf52d8df04829590dd4","https://www.openssl.org/news/secadv/20240528.txt","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240621-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4741","description":"Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use.\n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived.\nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use.\n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use.\n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs.\nWe are not aware of this issue being actively exploited.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"1014a67cbf322356","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.17"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-4741","versionConstraint":"< 3.0.2-0ubuntu1.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-4741","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.17"],"available":[{"date":"2024-07-31","kind":"advisory","version":"3.0.2-0ubuntu1.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-4741","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-4741","date":"2026-11-02","epss":0.02925,"percentile":0.8706}],"risk":0.8775,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-4741"},"relatedVulnerabilities":[{"id":"CVE-2024-4741","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4741","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-4741","date":"2026-11-02","epss":0.02925,"percentile":0.8706}],"urls":["https://github.com/openssl/openssl/commit/704f725b96aa373ee45ecfb23f6abfe8be8d9177","https://github.com/openssl/openssl/commit/b3f0eb0a295f58f16ba43ba99dad70d4ee5c437d","https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac","https://github.com/openssl/openssl/commit/e5093133c35ca82874ad83697af76f4b0f7e3bd8","https://github.openssl.org/openssl/extended-releases/commit/f7a045f3143fc6da2ee66bf52d8df04829590dd4","https://www.openssl.org/news/secadv/20240528.txt","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240621-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4741","description":"Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use.\n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived.\nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use.\n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use.\n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs.\nWe are not aware of this issue being actively exploited.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13836","versionConstraint":"< 3.10.12-1~22.04.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-13836","fix":{"state":"fixed","versions":["3.10.12-1~22.04.13"],"available":[{"date":"2026-01-12","kind":"advisory","version":"3.10.12-1~22.04.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-11-02","epss":0.01748,"percentile":0.77829}],"risk":0.874,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13836"},"relatedVulnerabilities":[{"id":"CVE-2025-13836","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-11-02","epss":0.01748,"percentile":0.77829}],"urls":["https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628","https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15","https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155","https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5","https://github.com/python/cpython/commit/5dc101675fd22918facbbe0fecdc821502beaaf0","https://github.com/python/cpython/commit/afc40bdd3dd71f343fd9016f6d8eebbacbd6587c","https://github.com/python/cpython/issues/119451","https://github.com/python/cpython/pull/119454","https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13836","description":"When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13836","versionConstraint":"< 3.10.12-1~22.04.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-13836","fix":{"state":"fixed","versions":["3.10.12-1~22.04.13"],"available":[{"date":"2026-01-12","kind":"advisory","version":"3.10.12-1~22.04.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-11-02","epss":0.01748,"percentile":0.77829}],"risk":0.874,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13836"},"relatedVulnerabilities":[{"id":"CVE-2025-13836","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-11-02","epss":0.01748,"percentile":0.77829}],"urls":["https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628","https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15","https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155","https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5","https://github.com/python/cpython/commit/5dc101675fd22918facbbe0fecdc821502beaaf0","https://github.com/python/cpython/commit/afc40bdd3dd71f343fd9016f6d8eebbacbd6587c","https://github.com/python/cpython/issues/119451","https://github.com/python/cpython/pull/119454","https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13836","description":"When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-13836","versionConstraint":"< 3.10.12-1~22.04.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-13836","fix":{"state":"fixed","versions":["3.10.12-1~22.04.13"],"available":[{"date":"2026-01-12","kind":"advisory","version":"3.10.12-1~22.04.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-11-02","epss":0.01748,"percentile":0.77829}],"risk":0.874,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13836"},"relatedVulnerabilities":[{"id":"CVE-2025-13836","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-11-02","epss":0.01748,"percentile":0.77829}],"urls":["https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628","https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15","https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155","https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5","https://github.com/python/cpython/commit/5dc101675fd22918facbbe0fecdc821502beaaf0","https://github.com/python/cpython/commit/afc40bdd3dd71f343fd9016f6d8eebbacbd6587c","https://github.com/python/cpython/issues/119451","https://github.com/python/cpython/pull/119454","https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13836","description":"When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13836","versionConstraint":"< 3.10.12-1~22.04.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-13836","fix":{"state":"fixed","versions":["3.10.12-1~22.04.13"],"available":[{"date":"2026-01-12","kind":"advisory","version":"3.10.12-1~22.04.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-11-02","epss":0.01748,"percentile":0.77829}],"risk":0.874,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13836"},"relatedVulnerabilities":[{"id":"CVE-2025-13836","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-11-02","epss":0.01748,"percentile":0.77829}],"urls":["https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628","https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15","https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155","https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5","https://github.com/python/cpython/commit/5dc101675fd22918facbbe0fecdc821502beaaf0","https://github.com/python/cpython/commit/afc40bdd3dd71f343fd9016f6d8eebbacbd6587c","https://github.com/python/cpython/issues/119451","https://github.com/python/cpython/pull/119454","https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13836","description":"When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS."}]},{"artifact":{"id":"70df9ec20d499220","cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.3?arch=amd64&distro=ubuntu-22.04&upstream=perl","type":"deb","version":"5.34.0-3ubuntu1.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-31486","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-31486","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-11-02","epss":0.01742,"percentile":0.77754}],"risk":0.8710000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-31486"},"relatedVulnerabilities":[{"id":"CVE-2023-31486","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-11-02","epss":0.01742,"percentile":0.77754}],"urls":["http://www.openwall.com/lists/oss-security/2023/04/29/1","http://www.openwall.com/lists/oss-security/2023/05/03/3","http://www.openwall.com/lists/oss-security/2023/05/03/5","http://www.openwall.com/lists/oss-security/2023/05/07/2","https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/","https://github.com/chansen/p5-http-tiny/pull/153","https://hackeriet.github.io/cpan-http-tiny-overview/","https://www.openwall.com/lists/oss-security/2023/04/18/14","https://www.openwall.com/lists/oss-security/2023/05/03/4","https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/","https://security.netapp.com/advisory/ntap-20241129-0011/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31486","description":"HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates."}]},{"artifact":{"id":"1f8e56f352643db0","cpes":["cpe:2.3:a:libtasn1-6:libtasn1-6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1-6:libtasn1_6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1-6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1_6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1-6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1_6:4.18.0-4build1:*:*:*:*:*:*:*"],"name":"libtasn1-6","purl":"pkg:deb/ubuntu/libtasn1-6@4.18.0-4build1?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"4.18.0-4build1","language":"","licenses":["sha256:88a94e40a34bb28145805747cad4018e7eb976b5fd0bf2329dedf90088ebc6e4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtasn1-6/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libtasn1-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.18.0-4ubuntu0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-46848","versionConstraint":"< 4.18.0-4ubuntu0.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libtasn1-6","version":"4.18.0-4build1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2021-46848","fix":{"state":"fixed","versions":["4.18.0-4ubuntu0.2"],"available":[{"date":"2026-01-12","kind":"advisory","version":"4.18.0-4ubuntu0.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2021-46848","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-46848","cwe":"CWE-193","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-46848","date":"2026-11-02","epss":0.02823,"percentile":0.86585}],"risk":0.8469000000000001,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-46848"},"relatedVulnerabilities":[{"id":"CVE-2021-46848","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46848","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-46848","cwe":"CWE-193","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-46848","date":"2026-11-02","epss":0.02823,"percentile":0.86585}],"urls":["https://bugs.gentoo.org/866237","https://gitlab.com/gnutls/libtasn1/-/commit/44a700d2051a666235748970c2df047ff207aeb5","https://gitlab.com/gnutls/libtasn1/-/issues/32","https://lists.debian.org/debian-lts-announce/2023/01/msg00003.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV4SHDJF2XLB4CUPTBPQQ6CLGZ5LKXPZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECM2ELTVRYV4BZ5L5GMIRQE27RFHPAQ6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGO7XST4EIJGX4B2ITZCYSWM24534BSU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V5LWOGF7QRMNFRUCZY6TDYQJVFI6MOQ2/","https://security.netapp.com/advisory/ntap-20221118-0006/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-46848","description":"GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.24"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-21147","versionConstraint":"< 1.8.0_422||>= 1.9, < 8.0.422||>= 12, < 17.0.12||>= 18, < 21.0.4||>= 22, < 22.0.2||>= 9, < 11.0.24 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-21147","fix":{"state":"fixed","versions":["1.8.0_422","8.0.422","11.0.24","17.0.12","21.0.4","22.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_422"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.422"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.12"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.4"},{"date":"2025-09-04","kind":"first-observed","version":"22.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.24"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21147","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-21147","date":"2026-11-02","epss":0.01136,"percentile":0.66532}],"risk":0.8463200000000001,"urls":["https://security.netapp.com/advisory/ntap-20240719-0008/","https://www.oracle.com/security-alerts/cpujul2024.html","https://openjdk.org/groups/vulnerability/advisories/2024-07-16"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21147","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"c469f4c848b8146f","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http2-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"cbf1a430ea44dbdedbcde16b185cbb95f28d72c7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http2-4.1.100.Final.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http2-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.124.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-prj3-ccx8-p6x4","versionConstraint":"<=4.1.123.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-prj3-ccx8-p6x4","fix":{"state":"fixed","versions":["4.1.124.Final"],"available":[{"date":"2025-08-14","kind":"first-observed","version":"4.1.124.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55163","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55163","date":"2026-11-02","epss":0.01101,"percentile":0.65696}],"risk":0.8450175000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4","https://nvd.nist.gov/vuln/detail/CVE-2025-55163","https://github.com/grpc/grpc-java/commit/6462ef9a11980e168c21d90bbc7245c728fd1a7a","https://github.com/netty/netty/commit/be53dc3c9acd9af2e20d0c3c07cd77115a594cf1","https://www.kb.cert.org/vuls/id/767506","http://www.openwall.com/lists/oss-security/2025/08/16/1"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-prj3-ccx8-p6x4","description":"Netty affected by MadeYouReset HTTP/2 DDoS vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-55163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55163","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55163","date":"2026-11-02","epss":0.01101,"percentile":0.65696}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4","http://www.openwall.com/lists/oss-security/2025/08/16/1","https://www.kb.cert.org/vuls/id/767506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55163","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final."}]},{"artifact":{"id":"fd269c6f3753e140","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.124.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-prj3-ccx8-p6x4","versionConstraint":"<=4.1.123.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-prj3-ccx8-p6x4","fix":{"state":"fixed","versions":["4.1.124.Final"],"available":[{"date":"2025-08-14","kind":"first-observed","version":"4.1.124.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55163","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55163","date":"2026-11-02","epss":0.01101,"percentile":0.65696}],"risk":0.8450175000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4","https://nvd.nist.gov/vuln/detail/CVE-2025-55163","https://github.com/grpc/grpc-java/commit/6462ef9a11980e168c21d90bbc7245c728fd1a7a","https://github.com/netty/netty/commit/be53dc3c9acd9af2e20d0c3c07cd77115a594cf1","https://www.kb.cert.org/vuls/id/767506","http://www.openwall.com/lists/oss-security/2025/08/16/1"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-prj3-ccx8-p6x4","description":"Netty affected by MadeYouReset HTTP/2 DDoS vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-55163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55163","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55163","date":"2026-11-02","epss":0.01101,"percentile":0.65696}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4","http://www.openwall.com/lists/oss-security/2025/08/16/1","https://www.kb.cert.org/vuls/id/767506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55163","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final."}]},{"artifact":{"id":"27608fdc7273561f","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.124.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-prj3-ccx8-p6x4","versionConstraint":"<=4.1.123.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-prj3-ccx8-p6x4","fix":{"state":"fixed","versions":["4.1.124.Final"],"available":[{"date":"2025-08-14","kind":"first-observed","version":"4.1.124.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55163","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55163","date":"2026-11-02","epss":0.01101,"percentile":0.65696}],"risk":0.8450175000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4","https://nvd.nist.gov/vuln/detail/CVE-2025-55163","https://github.com/grpc/grpc-java/commit/6462ef9a11980e168c21d90bbc7245c728fd1a7a","https://github.com/netty/netty/commit/be53dc3c9acd9af2e20d0c3c07cd77115a594cf1","https://www.kb.cert.org/vuls/id/767506","http://www.openwall.com/lists/oss-security/2025/08/16/1"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-prj3-ccx8-p6x4","description":"Netty affected by MadeYouReset HTTP/2 DDoS vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-55163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55163","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55163","date":"2026-11-02","epss":0.01101,"percentile":0.65696}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4","http://www.openwall.com/lists/oss-security/2025/08/16/1","https://www.kb.cert.org/vuls/id/767506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55163","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final."}]},{"artifact":{"id":"af534de498eed696","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-45490","versionConstraint":"< 2.4.7-1ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-45490","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.4"],"available":[{"date":"2024-09-17","kind":"advisory","version":"2.4.7-1ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-45490","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45490","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45490","date":"2026-11-02","epss":0.01686,"percentile":0.77023}],"risk":0.843,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-45490"},"relatedVulnerabilities":[{"id":"CVE-2024-45490","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-45490","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45490","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45490","date":"2026-11-02","epss":0.01686,"percentile":0.77023}],"urls":["https://github.com/libexpat/libexpat/issues/887","https://github.com/libexpat/libexpat/pull/890","http://seclists.org/fulldisclosure/2024/Dec/10","http://seclists.org/fulldisclosure/2024/Dec/12","http://seclists.org/fulldisclosure/2024/Dec/6","http://seclists.org/fulldisclosure/2024/Dec/7","http://seclists.org/fulldisclosure/2024/Dec/8","https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html","https://security.netapp.com/advisory/ntap-20241018-0004/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45490","description":"An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.22"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-22081","versionConstraint":"< 1.8.0_392||>= 1.9, < 8.0.392||>= 12, < 17.0.9||>= 18, < 21.0.1||>= 9, < 11.0.22 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-22081","fix":{"state":"fixed","versions":["1.8.0_392","8.0.392","11.0.22","17.0.9","21.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_392"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.392"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.9"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.1"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.22"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-22081","date":"2026-11-02","epss":0.01576,"percentile":0.75458}],"risk":0.8116399999999999,"urls":["https://lists.debian.org/debian-lts-announce/2023/10/msg00041.html","https://security.netapp.com/advisory/ntap-20231027-0006/","https://www.debian.org/security/2023/dsa-5537","https://www.debian.org/security/2023/dsa-5548","https://www.oracle.com/security-alerts/cpuoct2023.html","https://security.netapp.com/advisory/ntap-20241108-0002/","https://openjdk.org/groups/vulnerability/advisories/2023-10-17"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-22081","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf, 11.0.20, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 20.3.11, 21.3.7 and  22.3.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"cfda19effa7c6d29","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.3?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.3","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-0553","versionConstraint":"< 3.7.3-4ubuntu1.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-0553","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.4"],"available":[{"date":"2024-01-22","kind":"advisory","version":"3.7.3-4ubuntu1.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-0553","cwe":"CWE-203","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-0553","cwe":"CWE-203","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-0553","date":"2026-11-02","epss":0.01614,"percentile":0.75988}],"risk":0.807,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-0553"},"relatedVulnerabilities":[{"id":"CVE-2024-0553","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0553","cwe":"CWE-203","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-0553","cwe":"CWE-203","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-0553","date":"2026-11-02","epss":0.01614,"percentile":0.75988}],"urls":["https://access.redhat.com/errata/RHSA-2024:0533","https://access.redhat.com/errata/RHSA-2024:0627","https://access.redhat.com/errata/RHSA-2024:0796","https://access.redhat.com/errata/RHSA-2024:1082","https://access.redhat.com/errata/RHSA-2024:1108","https://access.redhat.com/errata/RHSA-2024:1383","https://access.redhat.com/errata/RHSA-2024:2094","https://access.redhat.com/security/cve/CVE-2024-0553","https://bugzilla.redhat.com/show_bug.cgi?id=2258412","https://gitlab.com/gnutls/gnutls/-/issues/1522","https://lists.gnupg.org/pipermail/gnutls-help/2024-January/004841.html","http://www.openwall.com/lists/oss-security/2024/01/19/3","https://lists.debian.org/debian-lts-announce/2024/02/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZEIOLORQ7N6WRPFXZSYDL2MC4LP7VFV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNXKVR5YNUEBNHAHM5GSYKBZX4W2HMN2/","https://security.netapp.com/advisory/ntap-20240202-0011/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0553","description":"A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981."}]},{"artifact":{"id":"4d5407177cb8d0dd","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.29"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63076","versionConstraint":"< 3.0.2-0ubuntu1.29 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-63076","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.29"],"available":[{"date":"2026-08-25","kind":"advisory","version":"3.0.2-0ubuntu1.29"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-11-02","epss":0.01602,"percentile":0.75819}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63076"},"relatedVulnerabilities":[{"id":"CVE-2026-63076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-11-02","epss":0.01602,"percentile":0.75819}],"urls":["https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b","https://github.com/openssl/openssl/commit/a17cc8d612ecff6d94a9b7ca8b5283ddf5ff570e","https://github.com/openssl/openssl/commit/a1f348ccb328c3afbd4ba6883f9b7c813c043259","https://github.com/openssl/openssl/commit/a7af46a92d0ce19a90e669ef56d2576a07924226","https://github.com/openssl/openssl/commit/cdacfff557389abfa9e4615abded2ec984517d6c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63076","description":"Issue summary: OpenSSL CMP password based protection verification only\nchecks whether the protectionAlg parameter was not NULL and not its\nASN.1 type, before treating it as a PBMParameter. A crafted message can\ncontain a parameter of a different type, which is then dereferenced as an\ninvalid pointer.\n\nImpact summary: A remote, unauthenticated attacker can crash an application\nacting as a CMP server that accepts PBM-protected messages, or a CMP client\ntalking to a malicious or intercepted CMP server, resulting in a Denial of\nService.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: When verifying the password-based MAC protection of a CMP\nmessage, OpenSSL library reads the protectionAlg algorithm parameter with\nX509_ALGOR_get0(), which returns both the parameter type and its value\npointer. The value is then cast to an ASN1_STRING and treated as the\nexpected PBMParameter after only checking that pointer is not NULL. The\nparameter type returned by X509_ALGOR_get0() was never consulted.\n\nThis happens during protection verification, before any MAC is computed, so\nno knowledge of the PBM shared secret is required; the only precondition is\nthat PBM verification is reachable. On the server side this is reached from\nOSSL_CMP_SRV_process_request() for any application that stands up a CMP\nserver accepting PBM-protected messages, and on the client side from CMP\nresponse validation against a malicious or on-path (MITM) server. The\nreliable consequence is a denial of service; there is no memory disclosure,\nno controlled memory write, and no path to code execution. CMP is a\nspecialized feature that an application must explicitly enable.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE."}]},{"artifact":{"id":"1014a67cbf322356","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.29"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63076","versionConstraint":"< 3.0.2-0ubuntu1.29 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-63076","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.29"],"available":[{"date":"2026-08-25","kind":"advisory","version":"3.0.2-0ubuntu1.29"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-11-02","epss":0.01602,"percentile":0.75819}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63076"},"relatedVulnerabilities":[{"id":"CVE-2026-63076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-11-02","epss":0.01602,"percentile":0.75819}],"urls":["https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b","https://github.com/openssl/openssl/commit/a17cc8d612ecff6d94a9b7ca8b5283ddf5ff570e","https://github.com/openssl/openssl/commit/a1f348ccb328c3afbd4ba6883f9b7c813c043259","https://github.com/openssl/openssl/commit/a7af46a92d0ce19a90e669ef56d2576a07924226","https://github.com/openssl/openssl/commit/cdacfff557389abfa9e4615abded2ec984517d6c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63076","description":"Issue summary: OpenSSL CMP password based protection verification only\nchecks whether the protectionAlg parameter was not NULL and not its\nASN.1 type, before treating it as a PBMParameter. A crafted message can\ncontain a parameter of a different type, which is then dereferenced as an\ninvalid pointer.\n\nImpact summary: A remote, unauthenticated attacker can crash an application\nacting as a CMP server that accepts PBM-protected messages, or a CMP client\ntalking to a malicious or intercepted CMP server, resulting in a Denial of\nService.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: When verifying the password-based MAC protection of a CMP\nmessage, OpenSSL library reads the protectionAlg algorithm parameter with\nX509_ALGOR_get0(), which returns both the parameter type and its value\npointer. The value is then cast to an ASN1_STRING and treated as the\nexpected PBMParameter after only checking that pointer is not NULL. The\nparameter type returned by X509_ALGOR_get0() was never consulted.\n\nThis happens during protection verification, before any MAC is computed, so\nno knowledge of the PBM shared secret is required; the only precondition is\nthat PBM verification is reachable. On the server side this is reached from\nOSSL_CMP_SRV_process_request() for any application that stands up a CMP\nserver accepting PBM-protected messages, and on the client side from CMP\nresponse validation against a malicious or on-path (MITM) server. The\nreliable consequence is a denial of service; there is no memory disclosure,\nno controlled memory write, and no path to code execution. CMP is a\nspecialized feature that an application must explicitly enable.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE."}]},{"artifact":{"id":"56f757709c1467d1","cpes":["cpe:2.3:a:python3-pkg-resources:python3-pkg-resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg-resources:python3_pkg_resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg_resources:python3-pkg-resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg_resources:python3_pkg_resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg:python3-pkg-resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg:python3_pkg_resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg:python3-pkg-resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg:python3_pkg_resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-pkg-resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_pkg_resources:59.6.0-1.2ubuntu0.22.04.1:*:*:*:*:*:*:*"],"name":"python3-pkg-resources","purl":"pkg:deb/ubuntu/python3-pkg-resources@59.6.0-1.2ubuntu0.22.04.1?arch=all&distro=ubuntu-22.04&upstream=setuptools","type":"deb","version":"59.6.0-1.2ubuntu0.22.04.1","language":"","licenses":["Apache-2.0","BSD-3-Clause","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3-pkg-resources/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3-pkg-resources/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3-pkg-resources.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3-pkg-resources.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.list"},{"path":"/var/lib/dpkg/info/python3-pkg-resources.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.postinst"},{"path":"/var/lib/dpkg/info/python3-pkg-resources.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.prerm"}],"upstreams":[{"name":"setuptools"}]},"matchDetails":[{"fix":{"suggestedVersion":"59.6.0-1.2ubuntu0.22.04.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-47273","versionConstraint":"< 59.6.0-1.2ubuntu0.22.04.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"setuptools","version":"59.6.0-1.2ubuntu0.22.04.1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-47273","fix":{"state":"fixed","versions":["59.6.0-1.2ubuntu0.22.04.3"],"available":[{"date":"2025-05-28","kind":"advisory","version":"59.6.0-1.2ubuntu0.22.04.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-47273","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-47273","date":"2026-11-02","epss":0.01592,"percentile":0.75692}],"risk":0.796,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-47273"},"relatedVulnerabilities":[{"id":"CVE-2025-47273","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-47273","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-47273","date":"2026-11-02","epss":0.01592,"percentile":0.75692}],"urls":["https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88","https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b","https://github.com/pypa/setuptools/issues/4946","https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf","https://lists.debian.org/debian-lts-announce/2025/05/msg00035.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47273","description":"setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue."}]},{"artifact":{"id":"ea2e86cd449a440a","cpes":["cpe:2.3:a:apache:jackrabbit-jcr-commons:2.21.16:*:*:*:*:*:*:*","cpe:2.3:a:apache:jackrabbit_jcr_commons:2.21.16:*:*:*:*:*:*:*","cpe:2.3:a:apache:jackrabbit:2.21.16:*:*:*:*:*:*:*"],"name":"jackrabbit-jcr-commons","purl":"pkg:maven/org.apache.jackrabbit/jackrabbit-jcr-commons@2.21.16","type":"java-archive","version":"2.21.16","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.jackrabbit","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.webdav.webdav-plugin-18.7.17.jar:org.apache.jackrabbit:jackrabbit-jcr-commons","manifestName":"","pomArtifactID":"jackrabbit-jcr-commons","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.webdav.webdav-plugin-18.7.17.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.webdav.webdav-plugin-18.7.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.22.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxvc-g8f2-4gmm","versionConstraint":">=1.0.0,<2.22.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.jackrabbit:jackrabbit-jcr-commons","version":"2.21.16"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxvc-g8f2-4gmm","fix":{"state":"fixed","versions":["2.22.2"],"available":[{"date":"2025-09-10","kind":"first-observed","version":"2.22.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58782","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-58782","date":"2026-11-02","epss":0.01354,"percentile":0.71609}],"risk":0.7785499999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-58782","https://lists.apache.org/thread/t4wdrost6dh17dh406g792j9wq6xmy6v","https://github.com/apache/jackrabbit/pull/229","https://issues.apache.org/jira/browse/JCR-5135","http://www.openwall.com/lists/oss-security/2025/09/06/3"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxvc-g8f2-4gmm","description":"Apache Jackrabbit: Core and JCR Commons are vulnerable to Deserialization of Untrusted Data"},"relatedVulnerabilities":[{"id":"CVE-2025-58782","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58782","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-58782","date":"2026-11-02","epss":0.01354,"percentile":0.71609}],"urls":["https://lists.apache.org/thread/t4wdrost6dh17dh406g792j9wq6xmy6v","http://www.openwall.com/lists/oss-security/2025/09/06/3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58782","description":"Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons.\n\nThis issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1.\n\nDeployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data.\nUsers are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0938","versionConstraint":"< 3.10.12-1~22.04.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-0938","fix":{"state":"fixed","versions":["3.10.12-1~22.04.9"],"available":[{"date":"2025-02-20","kind":"advisory","version":"3.10.12-1~22.04.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-0938","cwe":"CWE-20","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-0938","date":"2026-11-02","epss":0.01556,"percentile":0.7517}],"risk":0.7779999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0938"},"relatedVulnerabilities":[{"id":"CVE-2025-0938","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0938","cwe":"CWE-20","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-0938","date":"2026-11-02","epss":0.01556,"percentile":0.7517}],"urls":["https://github.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba","https://github.com/python/cpython/commit/90e526ae67b172ed7c6c56e7edad36263b0f9403","https://github.com/python/cpython/commit/a7084f6075c9595ba60119ce8c62f1496f50c568","https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab","https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a","https://github.com/python/cpython/commit/ff4e5c25666f63544071a6b075ae8b25c98b7a32","https://github.com/python/cpython/issues/105704","https://github.com/python/cpython/pull/129418","https://mail.python.org/archives/list/security-announce@python.org/thread/K4EUG6EKV6JYFIC24BASYOZS4M5XOQIB/","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html","https://security.netapp.com/advisory/ntap-20250314-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0938","description":"The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0938","versionConstraint":"< 3.10.12-1~22.04.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-0938","fix":{"state":"fixed","versions":["3.10.12-1~22.04.9"],"available":[{"date":"2025-02-20","kind":"advisory","version":"3.10.12-1~22.04.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-0938","cwe":"CWE-20","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-0938","date":"2026-11-02","epss":0.01556,"percentile":0.7517}],"risk":0.7779999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0938"},"relatedVulnerabilities":[{"id":"CVE-2025-0938","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0938","cwe":"CWE-20","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-0938","date":"2026-11-02","epss":0.01556,"percentile":0.7517}],"urls":["https://github.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba","https://github.com/python/cpython/commit/90e526ae67b172ed7c6c56e7edad36263b0f9403","https://github.com/python/cpython/commit/a7084f6075c9595ba60119ce8c62f1496f50c568","https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab","https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a","https://github.com/python/cpython/commit/ff4e5c25666f63544071a6b075ae8b25c98b7a32","https://github.com/python/cpython/issues/105704","https://github.com/python/cpython/pull/129418","https://mail.python.org/archives/list/security-announce@python.org/thread/K4EUG6EKV6JYFIC24BASYOZS4M5XOQIB/","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html","https://security.netapp.com/advisory/ntap-20250314-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0938","description":"The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-0938","versionConstraint":"< 3.10.12-1~22.04.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-0938","fix":{"state":"fixed","versions":["3.10.12-1~22.04.9"],"available":[{"date":"2025-02-20","kind":"advisory","version":"3.10.12-1~22.04.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-0938","cwe":"CWE-20","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-0938","date":"2026-11-02","epss":0.01556,"percentile":0.7517}],"risk":0.7779999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0938"},"relatedVulnerabilities":[{"id":"CVE-2025-0938","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0938","cwe":"CWE-20","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-0938","date":"2026-11-02","epss":0.01556,"percentile":0.7517}],"urls":["https://github.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba","https://github.com/python/cpython/commit/90e526ae67b172ed7c6c56e7edad36263b0f9403","https://github.com/python/cpython/commit/a7084f6075c9595ba60119ce8c62f1496f50c568","https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab","https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a","https://github.com/python/cpython/commit/ff4e5c25666f63544071a6b075ae8b25c98b7a32","https://github.com/python/cpython/issues/105704","https://github.com/python/cpython/pull/129418","https://mail.python.org/archives/list/security-announce@python.org/thread/K4EUG6EKV6JYFIC24BASYOZS4M5XOQIB/","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html","https://security.netapp.com/advisory/ntap-20250314-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0938","description":"The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0938","versionConstraint":"< 3.10.12-1~22.04.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-0938","fix":{"state":"fixed","versions":["3.10.12-1~22.04.9"],"available":[{"date":"2025-02-20","kind":"advisory","version":"3.10.12-1~22.04.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-0938","cwe":"CWE-20","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-0938","date":"2026-11-02","epss":0.01556,"percentile":0.7517}],"risk":0.7779999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0938"},"relatedVulnerabilities":[{"id":"CVE-2025-0938","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0938","cwe":"CWE-20","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-0938","date":"2026-11-02","epss":0.01556,"percentile":0.7517}],"urls":["https://github.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba","https://github.com/python/cpython/commit/90e526ae67b172ed7c6c56e7edad36263b0f9403","https://github.com/python/cpython/commit/a7084f6075c9595ba60119ce8c62f1496f50c568","https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab","https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a","https://github.com/python/cpython/commit/ff4e5c25666f63544071a6b075ae8b25c98b7a32","https://github.com/python/cpython/issues/105704","https://github.com/python/cpython/pull/129418","https://mail.python.org/archives/list/security-announce@python.org/thread/K4EUG6EKV6JYFIC24BASYOZS4M5XOQIB/","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html","https://security.netapp.com/advisory/ntap-20250314-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0938","description":"The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers."}]},{"artifact":{"id":"4d5407177cb8d0dd","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.20"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9230","versionConstraint":"< 3.0.2-0ubuntu1.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-9230","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.20"],"available":[{"date":"2025-09-30","kind":"advisory","version":"3.0.2-0ubuntu1.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-11-02","epss":0.01554,"percentile":0.75152}],"risk":0.777,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9230"},"relatedVulnerabilities":[{"id":"CVE-2025-9230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-11-02","epss":0.01554,"percentile":0.75152}],"urls":["https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45","https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280","https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def","https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd","https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482","https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3","https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5","https://lists.debian.org/debian-lts-announce/2025/10/msg00001.html","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","description":"Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary."}]},{"artifact":{"id":"1014a67cbf322356","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.20"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-9230","versionConstraint":"< 3.0.2-0ubuntu1.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-9230","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.20"],"available":[{"date":"2025-09-30","kind":"advisory","version":"3.0.2-0ubuntu1.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-11-02","epss":0.01554,"percentile":0.75152}],"risk":0.777,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9230"},"relatedVulnerabilities":[{"id":"CVE-2025-9230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-11-02","epss":0.01554,"percentile":0.75152}],"urls":["https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45","https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280","https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def","https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd","https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482","https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3","https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5","https://lists.debian.org/debian-lts-announce/2025/10/msg00001.html","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","description":"Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary."}]},{"artifact":{"id":"ebd7a017631da953","cpes":["cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:io.netty:netty-handler","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3qp7-7mw8-wx86","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3qp7-7mw8-wx86","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-11-02","epss":0.00987,"percentile":0.62422}],"risk":0.7698600000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-44249"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3qp7-7mw8-wx86","description":"Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking"},"relatedVulnerabilities":[{"id":"CVE-2026-44249","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-11-02","epss":0.00987,"percentile":0.62422}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44249","https://bugzilla.redhat.com/show_bug.cgi?id=2488081","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44249","description":"Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"f9e961d53cf996e8","cpes":["cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:io.netty:netty-handler","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3qp7-7mw8-wx86","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3qp7-7mw8-wx86","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-11-02","epss":0.00987,"percentile":0.62422}],"risk":0.7698600000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-44249"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3qp7-7mw8-wx86","description":"Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking"},"relatedVulnerabilities":[{"id":"CVE-2026-44249","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-11-02","epss":0.00987,"percentile":0.62422}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44249","https://bugzilla.redhat.com/show_bug.cgi?id=2488081","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44249","description":"Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"72a1968e6efdfa5e","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-handler-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"4c0acdb8bb73647ebb3847ac2d503d53d72c02b4","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-handler-4.1.100.Final.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-handler-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3qp7-7mw8-wx86","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3qp7-7mw8-wx86","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-11-02","epss":0.00987,"percentile":0.62422}],"risk":0.7698600000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-44249"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3qp7-7mw8-wx86","description":"Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking"},"relatedVulnerabilities":[{"id":"CVE-2026-44249","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-11-02","epss":0.00987,"percentile":0.62422}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44249","https://bugzilla.redhat.com/show_bug.cgi?id=2488081","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44249","description":"Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"2917dbeba0c6e95f","cpes":["cpe:2.3:a:apache:poi-ooxml:4.1.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:poi_ooxml:4.1.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:poi:4.1.2:*:*:*:*:*:*:*"],"name":"poi-ooxml","purl":"pkg:maven/org.apache.poi/poi-ooxml@4.1.2","type":"java-archive","version":"4.1.2","language":"java","licenses":["Apache-2.0","BSD-3-Clause","EPL-1.0","MIT"],"metadata":{"pomGroupID":"org.apache.poi","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.analytics-18.7.56.jar:META-INF/lib/poi-ooxml-4.1.2.jar","manifestName":"","pomArtifactID":"poi-ooxml","archiveDigests":[{"value":"87d9a22aa9a7dd26e80c360e709f7ee02e32ab3b","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.analytics-18.7.56.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.analytics-18.7.56.jar:META-INF/lib/poi-ooxml-4.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.4.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gmg8-593g-7mv3","versionConstraint":"<5.4.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.poi:poi-ooxml","version":"4.1.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gmg8-593g-7mv3","fix":{"state":"fixed","versions":["5.4.0"],"available":[{"date":"2025-04-11","kind":"first-observed","version":"5.4.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-31672","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-31672","date":"2026-11-02","epss":0.01382,"percentile":0.72159}],"risk":0.76701,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-31672","https://bz.apache.org/bugzilla/show_bug.cgi?id=69620","https://lists.apache.org/thread/k14w8vcjqy4h34hh5kzldko78kpylkq5","http://www.openwall.com/lists/oss-security/2025/04/08/2","https://security.netapp.com/advisory/ntap-20250523-0004"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gmg8-593g-7mv3","description":"Apache POI OOXML Vulnerable to Improper Input Validation in OOXML File Parsing"},"relatedVulnerabilities":[{"id":"CVE-2025-31672","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-31672","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-31672","date":"2026-11-02","epss":0.01382,"percentile":0.72159}],"urls":["https://bz.apache.org/bugzilla/show_bug.cgi?id=69620","https://lists.apache.org/thread/k14w8vcjqy4h34hh5kzldko78kpylkq5","http://www.openwall.com/lists/oss-security/2025/04/08/2","https://security.netapp.com/advisory/ntap-20250523-0004/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-31672","description":"Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names (including the path) in the zip. In this case, products reading the affected file could read different data because 1 of the zip entries with the duplicate name is selected over another but different products may choose a different zip entry.\nThis issue affects Apache POI poi-ooxml before 5.4.0. poi-ooxml 5.4.0 has a check that throws an exception if zip entries with duplicate file names are found in the input file.\nUsers are recommended to upgrade to version poi-ooxml 5.4.0, which fixes the issue. Please read  https://poi.apache.org/security.html  for recommendations about how to use the POI libraries securely."}]},{"artifact":{"id":"3890a60b280dc0bc","cpes":["cpe:2.3:a:netty-codec-dns:netty-codec-dns:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-dns:netty_codec_dns:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_dns:netty-codec-dns:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_dns:netty_codec_dns:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-dns:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_dns:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-dns:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_dns:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-dns:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_dns:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-dns:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_dns:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-dns","purl":"pkg:maven/io.netty/netty-codec-dns@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:io.netty:netty-codec-dns","manifestName":"","pomArtifactID":"netty-codec-dns","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cm33-6792-r9fm","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-dns","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cm33-6792-r9fm","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42579","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-626","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-1286","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42579","date":"2026-11-02","epss":0.01006,"percentile":0.63021}],"risk":0.7545,"urls":["https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm","https://tools.ietf.org/html/rfc1035#section-2.3.4","https://tools.ietf.org/html/rfc1035#section-4.1.4","https://nvd.nist.gov/vuln/detail/CVE-2026-42579"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cm33-6792-r9fm","description":"Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)"},"relatedVulnerabilities":[{"id":"CVE-2026-42579","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42579","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-626","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-1286","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42579","date":"2026-11-02","epss":0.01006,"percentile":0.63021}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/security/cve/CVE-2026-42579","https://bugzilla.redhat.com/show_bug.cgi?id=2477217","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42579.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42579","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.30"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-21945","versionConstraint":"< 1.8.0_482||>= 1.9, < 8.0.482||>= 12, < 17.0.18||>= 18, < 21.0.10||>= 22, < 25.0.2||>= 9, < 11.0.30 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-21945","fix":{"state":"fixed","versions":["1.8.0_482","8.0.482","11.0.30","17.0.18","21.0.10","25.0.2"],"available":[{"date":"2026-01-27","kind":"first-observed","version":"1.8.0_482"},{"date":"2026-01-27","kind":"first-observed","version":"8.0.482"},{"date":"2026-01-27","kind":"first-observed","version":"17.0.18"},{"date":"2026-01-27","kind":"first-observed","version":"21.0.10"},{"date":"2026-01-27","kind":"first-observed","version":"25.0.2"},{"date":"2026-01-27","kind":"first-observed","version":"11.0.30"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21945","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-21945","cwe":"CWE-295","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-21945","date":"2026-11-02","epss":0.00992,"percentile":0.6258}],"risk":0.744,"urls":["https://www.oracle.com/security-alerts/cpujan2026.html","https://access.redhat.com/errata/RHSA-2026:0847","https://access.redhat.com/errata/RHSA-2026:0848","https://access.redhat.com/errata/RHSA-2026:0895","https://access.redhat.com/errata/RHSA-2026:0897","https://access.redhat.com/errata/RHSA-2026:0899","https://access.redhat.com/errata/RHSA-2026:0901","https://access.redhat.com/errata/RHSA-2026:0927","https://access.redhat.com/errata/RHSA-2026:0928","https://access.redhat.com/errata/RHSA-2026:0931","https://access.redhat.com/errata/RHSA-2026:0932","https://access.redhat.com/errata/RHSA-2026:0933","https://access.redhat.com/errata/RHSA-2026:1606","https://access.redhat.com/errata/RHSA-2026:4832","https://access.redhat.com/security/cve/CVE-2026-21945","https://bugzilla.redhat.com/show_bug.cgi?id=2429927","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21945.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21945","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and  21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."},"relatedVulnerabilities":[]},{"artifact":{"id":"3058891d9c69e832","cpes":["cpe:2.3:a:com.atlassian.confluence:confluence:8.7.2:*:*:*:*:*:*:*","cpe:2.3:a:confluence:confluence:8.7.2:*:*:*:*:*:*:*","cpe:2.3:a:atlassian:confluence:8.7.2:*:*:*:*:*:*:*"],"name":"confluence","purl":"pkg:maven/com.atlassian.confluence/confluence@8.7.2","type":"java-archive","version":"8.7.2","language":"java","licenses":[],"metadata":{"pomGroupID":"com.atlassian.confluence","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","manifestName":"","pomArtifactID":"confluence","archiveDigests":[{"value":"afaf3eba1f92068ba7584de95e3aafadc7dc66c5","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.8.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-21677","versionConstraint":">= 6.13.0, < 7.19.20||>= 7.20, < 8.5.7||>= 8.6, < 8.8.1 (maven)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.atlassian.confluence:confluence","version":"8.7.2"},"language":"java","namespace":"nvd:language:java"}}],"vulnerability":{"id":"CVE-2024-21677","fix":{"state":"fixed","versions":["7.19.20","8.5.7","8.8.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"7.19.20"},{"date":"2025-09-04","kind":"first-observed","version":"8.5.7"},{"date":"2025-09-04","kind":"first-observed","version":"8.8.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@atlassian.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21677","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-21677","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-21677","date":"2026-11-02","epss":0.00926,"percentile":0.60487}],"risk":0.743115,"urls":["https://confluence.atlassian.com/pages/viewpage.action?pageId=1369444862","https://jira.atlassian.com/browse/CONFSERVER-94604"],"severity":"High","namespace":"nvd:language:java","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21677","description":"This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. This Path Traversal vulnerability, with a CVSS Score of 8.3, allows an unauthenticated attacker to exploit an undefinable vulnerability which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction.\n\nAtlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Data Center Atlassian recommends that Confluence Data Center customers upgrade to the latest version and that Confluence Server customers upgrade to the latest 8.5.x LTS version.\n\nIf you are unable to do so, upgrade your instance to one of the specified supported fixed versions See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html\n\nYou can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. \n\nThis vulnerability was reported via our Bug Bounty program."},"relatedVulnerabilities":[]},{"artifact":{"id":"0ae96c8bb001b7ff","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f6hv-jmp6-3vwv","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f6hv-jmp6-3vwv","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"risk":0.7425000000000002,"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://nvd.nist.gov/vuln/detail/CVE-2026-42587"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","description":"Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42587","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42587","https://bugzilla.redhat.com/show_bug.cgi?id=2477220","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"41fd2c72127de89f","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f6hv-jmp6-3vwv","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f6hv-jmp6-3vwv","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"risk":0.7425000000000002,"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://nvd.nist.gov/vuln/detail/CVE-2026-42587"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","description":"Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42587","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42587","https://bugzilla.redhat.com/show_bug.cgi?id=2477220","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"b400511196d0cd9e","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f6hv-jmp6-3vwv","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f6hv-jmp6-3vwv","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"risk":0.7425000000000002,"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://nvd.nist.gov/vuln/detail/CVE-2026-42587"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","description":"Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42587","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42587","https://bugzilla.redhat.com/show_bug.cgi?id=2477220","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"fd269c6f3753e140","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f6hv-jmp6-3vwv","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f6hv-jmp6-3vwv","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"risk":0.7425000000000002,"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://nvd.nist.gov/vuln/detail/CVE-2026-42587"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","description":"Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42587","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42587","https://bugzilla.redhat.com/show_bug.cgi?id=2477220","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"27608fdc7273561f","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f6hv-jmp6-3vwv","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f6hv-jmp6-3vwv","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"risk":0.7425000000000002,"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://nvd.nist.gov/vuln/detail/CVE-2026-42587"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","description":"Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42587","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42587","https://bugzilla.redhat.com/show_bug.cgi?id=2477220","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"c469f4c848b8146f","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http2-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"cbf1a430ea44dbdedbcde16b185cbb95f28d72c7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http2-4.1.100.Final.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http2-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f6hv-jmp6-3vwv","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f6hv-jmp6-3vwv","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"risk":0.7425000000000002,"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://nvd.nist.gov/vuln/detail/CVE-2026-42587"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","description":"Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42587","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-11-02","epss":0.0099,"percentile":0.6253}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42587","https://bugzilla.redhat.com/show_bug.cgi?id=2477220","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"cfda19effa7c6d29","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.3?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.3","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-32988","versionConstraint":"< 3.7.3-4ubuntu1.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-32988","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.7"],"available":[{"date":"2025-07-14","kind":"advisory","version":"3.7.3-4ubuntu1.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-32988","cwe":"CWE-415","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32988","date":"2026-11-02","epss":0.01475,"percentile":0.73832}],"risk":0.7374999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-32988"},"relatedVulnerabilities":[{"id":"CVE-2025-32988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-32988","cwe":"CWE-415","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32988","date":"2026-11-02","epss":0.01475,"percentile":0.73832}],"urls":["https://access.redhat.com/errata/RHSA-2025:16115","https://access.redhat.com/errata/RHSA-2025:16116","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:17348","https://access.redhat.com/errata/RHSA-2025:17361","https://access.redhat.com/errata/RHSA-2025:17415","https://access.redhat.com/errata/RHSA-2025:19088","https://access.redhat.com/errata/RHSA-2025:22529","https://access.redhat.com/errata/RHSA-2026:7477","https://access.redhat.com/security/cve/CVE-2025-32988","https://bugzilla.redhat.com/show_bug.cgi?id=2359622","https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html","http://www.openwall.com/lists/oss-security/2025/07/11/3","https://lists.debian.org/debian-lts-announce/2025/08/msg00005.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-32988","description":"A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure.\n\nThis vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior."}]},{"artifact":{"id":"bab0f28d5b9840f7","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.12.7.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1","type":"java-archive","version":"2.12.7.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.12.7.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"a6af29070f42c49f","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2","type":"java-archive","version":"2.13.4.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.13.4.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"7e51f2d66453ad51","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar:META-INF/lib/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar:META-INF/lib/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"8b225a368370af7c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"3ad576839e998952","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/jackson-databind-2.15.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"9353b021f10c307c00328f52090de2bdb4b6ff9c","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/jackson-databind-2.15.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"051e7df316b5a531","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"7bbe612d6a8369b0","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"93ac7e2aa6804f54","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar:META-INF/lib/jackson-databind-2.15.3.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"a734bc2c47a9453c4efa772461a3aeb273c010d9","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar:META-INF/lib/jackson-databind-2.15.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"55d5220f811f88ce","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-databind-2.16.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"a89c3f9fac63d225","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"ed97116d7d90df11","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"e7a8f6a39fc0ef2d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-databind-2.16.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-11-02","epss":0.00944,"percentile":0.61069}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"feec0d6de02ba613","cpes":["cpe:2.3:a:com.graphql-java:graphql-java:20.6:*:*:*:*:*:*:*","cpe:2.3:a:com.graphql-java:graphql_java:20.6:*:*:*:*:*:*:*","cpe:2.3:a:graphql-java:graphql-java:20.6:*:*:*:*:*:*:*","cpe:2.3:a:graphql-java:graphql_java:20.6:*:*:*:*:*:*:*","cpe:2.3:a:graphql_java:graphql-java:20.6:*:*:*:*:*:*:*","cpe:2.3:a:graphql_java:graphql_java:20.6:*:*:*:*:*:*:*","cpe:2.3:a:graphql:graphql-java:20.6:*:*:*:*:*:*:*","cpe:2.3:a:graphql:graphql_java:20.6:*:*:*:*:*:*:*"],"name":"graphql-java","purl":"pkg:maven/com.graphql-java/graphql-java@20.6","type":"java-archive","version":"20.6","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"com.graphql-java","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar:META-INF/lib/graphql-java-20.6.jar","manifestName":"","pomArtifactID":"graphql-java","archiveDigests":[{"value":"f517c705d47b62109c0c657d508167bbe27b2a56","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar:META-INF/lib/graphql-java-20.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"20.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h9mq-f6q5-6c8m","versionConstraint":">=20.0,<20.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.graphql-java:graphql-java","version":"20.6"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h9mq-f6q5-6c8m","fix":{"state":"fixed","versions":["20.9"],"available":[{"date":"2024-07-31","kind":"first-observed","version":"20.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-40094","date":"2026-11-02","epss":0.00943,"percentile":0.61044}],"risk":0.73554,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-40094","https://github.com/graphql-java/graphql-java/pull/3539","https://github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a","https://github.com/graphql-java/graphql-java/discussions/3641","https://github.com/graphql-java/graphql-java/releases/tag/v19.11","https://github.com/graphql-java/graphql-java/releases/tag/v20.9","https://github.com/graphql-java/graphql-java/releases/tag/v21.5","https://github.com/graphql-java/graphql-java/commit/16c159111507ef04d7e1839b2c23281d90c42b2b","https://github.com/graphql-java/graphql-java/commit/469caf6ee600ab6709ad5e8a06f371fe2ef3b8dd","https://github.com/graphql-java/graphql-java/commit/fc6f304e66cab18b6d06a80c7009524938939a03"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h9mq-f6q5-6c8m","description":"GraphQL Java does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service"},"relatedVulnerabilities":[{"id":"CVE-2024-40094","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-40094","date":"2026-11-02","epss":0.00943,"percentile":0.61044}],"urls":["https://github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a","https://github.com/graphql-java/graphql-java/discussions/3641","https://github.com/graphql-java/graphql-java/pull/3539","https://github.com/graphql-java/graphql-java/releases/tag/v19.11","https://github.com/graphql-java/graphql-java/releases/tag/v20.9","https://github.com/graphql-java/graphql-java/releases/tag/v21.5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-40094","description":"GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions."}]},{"artifact":{"id":"cfda19effa7c6d29","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.3?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.3","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-32989","versionConstraint":"< 3.7.3-4ubuntu1.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-32989","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.7"],"available":[{"date":"2025-07-14","kind":"advisory","version":"3.7.3-4ubuntu1.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-32989","cwe":"CWE-295","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32989","date":"2026-11-02","epss":0.01467,"percentile":0.73702}],"risk":0.7335,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-32989"},"relatedVulnerabilities":[{"id":"CVE-2025-32989","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-32989","cwe":"CWE-295","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32989","date":"2026-11-02","epss":0.01467,"percentile":0.73702}],"urls":["https://access.redhat.com/errata/RHSA-2025:16115","https://access.redhat.com/errata/RHSA-2025:16116","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:17348","https://access.redhat.com/errata/RHSA-2025:17361","https://access.redhat.com/errata/RHSA-2025:19088","https://access.redhat.com/errata/RHSA-2025:22529","https://access.redhat.com/errata/RHSA-2026:7477","https://access.redhat.com/security/cve/CVE-2025-32989","https://bugzilla.redhat.com/show_bug.cgi?id=2359621","https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html","http://www.openwall.com/lists/oss-security/2025/07/11/3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-32989","description":"A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly."}]},{"artifact":{"id":"41fd2c72127de89f","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.108.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jpm-x58v-624v","versionConstraint":"<4.1.108.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jpm-x58v-624v","fix":{"state":"fixed","versions":["4.1.108.Final"],"available":[{"date":"2024-03-26","kind":"first-observed","version":"4.1.108.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29025","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-29025","date":"2026-11-02","epss":0.0138,"percentile":0.72123}],"risk":0.7107,"urls":["https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v","https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3","https://github.com/vietj/netty/tree/post-request-decoder","https://nvd.nist.gov/vuln/detail/CVE-2024-29025","https://lists.debian.org/debian-lts-announce/2024/06/msg00015.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jpm-x58v-624v","description":"Netty's HttpPostRequestDecoder can OOM"},"relatedVulnerabilities":[{"id":"CVE-2024-29025","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29025","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-29025","date":"2026-11-02","epss":0.0138,"percentile":0.72123}],"urls":["https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3","https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v","https://lists.debian.org/debian-lts-announce/2024/06/msg00015.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-29025","description":"Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final."}]},{"artifact":{"id":"b400511196d0cd9e","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.108.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jpm-x58v-624v","versionConstraint":"<4.1.108.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jpm-x58v-624v","fix":{"state":"fixed","versions":["4.1.108.Final"],"available":[{"date":"2024-03-26","kind":"first-observed","version":"4.1.108.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29025","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-29025","date":"2026-11-02","epss":0.0138,"percentile":0.72123}],"risk":0.7107,"urls":["https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v","https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3","https://github.com/vietj/netty/tree/post-request-decoder","https://nvd.nist.gov/vuln/detail/CVE-2024-29025","https://lists.debian.org/debian-lts-announce/2024/06/msg00015.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jpm-x58v-624v","description":"Netty's HttpPostRequestDecoder can OOM"},"relatedVulnerabilities":[{"id":"CVE-2024-29025","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29025","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-29025","date":"2026-11-02","epss":0.0138,"percentile":0.72123}],"urls":["https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3","https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v","https://lists.debian.org/debian-lts-announce/2024/06/msg00015.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-29025","description":"Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final."}]},{"artifact":{"id":"0ae96c8bb001b7ff","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.108.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jpm-x58v-624v","versionConstraint":"<4.1.108.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jpm-x58v-624v","fix":{"state":"fixed","versions":["4.1.108.Final"],"available":[{"date":"2024-03-26","kind":"first-observed","version":"4.1.108.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29025","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-29025","date":"2026-11-02","epss":0.0138,"percentile":0.72123}],"risk":0.7107,"urls":["https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v","https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3","https://github.com/vietj/netty/tree/post-request-decoder","https://nvd.nist.gov/vuln/detail/CVE-2024-29025","https://lists.debian.org/debian-lts-announce/2024/06/msg00015.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jpm-x58v-624v","description":"Netty's HttpPostRequestDecoder can OOM"},"relatedVulnerabilities":[{"id":"CVE-2024-29025","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-29025","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-29025","date":"2026-11-02","epss":0.0138,"percentile":0.72123}],"urls":["https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3","https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v","https://lists.debian.org/debian-lts-announce/2024/06/msg00015.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-29025","description":"Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final."}]},{"artifact":{"id":"1e5e94c1bdb3aa3d","cpes":["cpe:2.3:a:libssh-4:libssh-4:0.9.6-2ubuntu0.22.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libssh-4:libssh_4:0.9.6-2ubuntu0.22.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libssh_4:libssh-4:0.9.6-2ubuntu0.22.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libssh_4:libssh_4:0.9.6-2ubuntu0.22.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh-4:0.9.6-2ubuntu0.22.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh_4:0.9.6-2ubuntu0.22.04.2:*:*:*:*:*:*:*"],"name":"libssh-4","purl":"pkg:deb/ubuntu/libssh-4@0.9.6-2ubuntu0.22.04.2?arch=amd64&distro=ubuntu-22.04&upstream=libssh","type":"deb","version":"0.9.6-2ubuntu0.22.04.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","LGPL-2.1","LGPL-2.1+~OpenSSL","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh-4/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libssh-4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh-4:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libssh-4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"0.9.6-2ubuntu0.22.04.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6918","versionConstraint":"< 0.9.6-2ubuntu0.22.04.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libssh","version":"0.9.6-2ubuntu0.22.04.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-6918","fix":{"state":"fixed","versions":["0.9.6-2ubuntu0.22.04.3"],"available":[{"date":"2024-01-22","kind":"advisory","version":"0.9.6-2ubuntu0.22.04.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2023-6918","cwe":"CWE-252","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-6918","cwe":"CWE-252","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-6918","date":"2026-11-02","epss":0.01409,"percentile":0.7264}],"risk":0.7045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6918"},"relatedVulnerabilities":[{"id":"CVE-2023-6918","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6918","cwe":"CWE-252","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-6918","cwe":"CWE-252","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-6918","date":"2026-11-02","epss":0.01409,"percentile":0.7264}],"urls":["https://access.redhat.com/errata/RHSA-2024:2504","https://access.redhat.com/errata/RHSA-2024:3233","https://access.redhat.com/security/cve/CVE-2023-6918","https://bugzilla.redhat.com/show_bug.cgi?id=2254997","https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/","https://www.libssh.org/security/advisories/CVE-2023-6918.txt","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/","https://security.netapp.com/advisory/ntap-20250214-0009/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6918","description":"A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection."}]},{"artifact":{"id":"4d5407177cb8d0dd","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6129","versionConstraint":"< 3.0.2-0ubuntu1.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-6129","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.14"],"available":[{"date":"2024-02-05","kind":"advisory","version":"3.0.2-0ubuntu1.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2023-6129","cwe":"CWE-440","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-6129","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-6129","date":"2026-11-02","epss":0.02323,"percentile":0.8348}],"risk":0.6969000000000001,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6129"},"relatedVulnerabilities":[{"id":"CVE-2023-6129","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6129","cwe":"CWE-440","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-6129","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-6129","date":"2026-11-02","epss":0.02323,"percentile":0.8348}],"urls":["https://github.com/openssl/openssl/commit/050d26383d4e264966fb83428e72d5d48f402d35","https://github.com/openssl/openssl/commit/5b139f95c9a47a55a0c54100f3837b1eee942b04","https://github.com/openssl/openssl/commit/f3fc5808fe9ff74042d639839610d03b8fdcc015","https://www.openssl.org/news/secadv/20240109.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://security.netapp.com/advisory/ntap-20240216-0009/","https://security.netapp.com/advisory/ntap-20240426-0008/","https://security.netapp.com/advisory/ntap-20240426-0013/","https://security.netapp.com/advisory/ntap-20240503-0011/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6129","description":"Issue summary: The POLY1305 MAC (message authentication code) implementation\ncontains a bug that might corrupt the internal state of applications running\non PowerPC CPU based platforms if the CPU provides vector instructions.\n\nImpact summary: If an attacker can influence whether the POLY1305 MAC\nalgorithm is used, the application state might be corrupted with various\napplication dependent consequences.\n\nThe POLY1305 MAC (message authentication code) implementation in OpenSSL for\nPowerPC CPUs restores the contents of vector registers in a different order\nthan they are saved. Thus the contents of some of these vector registers\nare corrupted when returning to the caller. The vulnerable code is used only\non newer PowerPC processors supporting the PowerISA 2.07 instructions.\n\nThe consequences of this kind of internal application state corruption can\nbe various - from no consequences, if the calling application does not\ndepend on the contents of non-volatile XMM registers at all, to the worst\nconsequences, where the attacker could get complete control of the application\nprocess. However unless the compiler uses the vector registers for storing\npointers, the most likely consequence, if any, would be an incorrect result\nof some application dependent calculations or a crash leading to a denial of\nservice.\n\nThe POLY1305 MAC algorithm is most frequently used as part of the\nCHACHA20-POLY1305 AEAD (authenticated encryption with associated data)\nalgorithm. The most common usage of this AEAD cipher is with TLS protocol\nversions 1.2 and 1.3. If this cipher is enabled on the server a malicious\nclient can influence whether this AEAD cipher is used. This implies that\nTLS server applications using OpenSSL can be potentially impacted. However\nwe are currently not aware of any concrete application that would be affected\nby this issue therefore we consider this a Low severity security issue."}]},{"artifact":{"id":"1014a67cbf322356","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-6129","versionConstraint":"< 3.0.2-0ubuntu1.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-6129","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.14"],"available":[{"date":"2024-02-05","kind":"advisory","version":"3.0.2-0ubuntu1.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2023-6129","cwe":"CWE-440","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-6129","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-6129","date":"2026-11-02","epss":0.02323,"percentile":0.8348}],"risk":0.6969000000000001,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6129"},"relatedVulnerabilities":[{"id":"CVE-2023-6129","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6129","cwe":"CWE-440","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-6129","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-6129","date":"2026-11-02","epss":0.02323,"percentile":0.8348}],"urls":["https://github.com/openssl/openssl/commit/050d26383d4e264966fb83428e72d5d48f402d35","https://github.com/openssl/openssl/commit/5b139f95c9a47a55a0c54100f3837b1eee942b04","https://github.com/openssl/openssl/commit/f3fc5808fe9ff74042d639839610d03b8fdcc015","https://www.openssl.org/news/secadv/20240109.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://security.netapp.com/advisory/ntap-20240216-0009/","https://security.netapp.com/advisory/ntap-20240426-0008/","https://security.netapp.com/advisory/ntap-20240426-0013/","https://security.netapp.com/advisory/ntap-20240503-0011/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6129","description":"Issue summary: The POLY1305 MAC (message authentication code) implementation\ncontains a bug that might corrupt the internal state of applications running\non PowerPC CPU based platforms if the CPU provides vector instructions.\n\nImpact summary: If an attacker can influence whether the POLY1305 MAC\nalgorithm is used, the application state might be corrupted with various\napplication dependent consequences.\n\nThe POLY1305 MAC (message authentication code) implementation in OpenSSL for\nPowerPC CPUs restores the contents of vector registers in a different order\nthan they are saved. Thus the contents of some of these vector registers\nare corrupted when returning to the caller. The vulnerable code is used only\non newer PowerPC processors supporting the PowerISA 2.07 instructions.\n\nThe consequences of this kind of internal application state corruption can\nbe various - from no consequences, if the calling application does not\ndepend on the contents of non-volatile XMM registers at all, to the worst\nconsequences, where the attacker could get complete control of the application\nprocess. However unless the compiler uses the vector registers for storing\npointers, the most likely consequence, if any, would be an incorrect result\nof some application dependent calculations or a crash leading to a denial of\nservice.\n\nThe POLY1305 MAC algorithm is most frequently used as part of the\nCHACHA20-POLY1305 AEAD (authenticated encryption with associated data)\nalgorithm. The most common usage of this AEAD cipher is with TLS protocol\nversions 1.2 and 1.3. If this cipher is enabled on the server a malicious\nclient can influence whether this AEAD cipher is used. This implies that\nTLS server applications using OpenSSL can be potentially impacted. However\nwe are currently not aware of any concrete application that would be affected\nby this issue therefore we consider this a Low severity security issue."}]},{"artifact":{"id":"af534de498eed696","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-45492","versionConstraint":"< 2.4.7-1ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-45492","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.4"],"available":[{"date":"2024-09-17","kind":"advisory","version":"2.4.7-1ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-45492","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45492","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45492","date":"2026-11-02","epss":0.01393,"percentile":0.72369}],"risk":0.6965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-45492"},"relatedVulnerabilities":[{"id":"CVE-2024-45492","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-45492","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45492","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45492","date":"2026-11-02","epss":0.01393,"percentile":0.72369}],"urls":["https://github.com/libexpat/libexpat/issues/889","https://github.com/libexpat/libexpat/pull/892","https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html","https://security.netapp.com/advisory/ntap-20241018-0005/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45492","description":"An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX)."}]},{"artifact":{"id":"4d5407177cb8d0dd","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6237","versionConstraint":"< 3.0.2-0ubuntu1.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-6237","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.14"],"available":[{"date":"2024-02-05","kind":"advisory","version":"3.0.2-0ubuntu1.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2023-6237","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2023-6237","date":"2026-11-02","epss":0.02303,"percentile":0.83326}],"risk":0.6909,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6237"},"relatedVulnerabilities":[{"id":"CVE-2023-6237","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6237","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2023-6237","date":"2026-11-02","epss":0.02303,"percentile":0.83326}],"urls":["https://github.com/openssl/openssl/commit/0b0f7abfb37350794a4b8960fafc292cd5d1b84d","https://github.com/openssl/openssl/commit/18c02492138d1eb8b6548cb26e7b625fb2414a2a","https://github.com/openssl/openssl/commit/a830f551557d3d66a84bbb18a5b889c640c36294","https://www.openssl.org/news/secadv/20240115.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://security.netapp.com/advisory/ntap-20240531-0007/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6237","description":"Issue summary: Checking excessively long invalid RSA public keys may take\na long time.\n\nImpact summary: Applications that use the function EVP_PKEY_public_check()\nto check RSA public keys may experience long delays. Where the key that\nis being checked has been obtained from an untrusted source this may lead\nto a Denial of Service.\n\nWhen function EVP_PKEY_public_check() is called on RSA public keys,\na computation is done to confirm that the RSA modulus, n, is composite.\nFor valid RSA keys, n is a product of two or more large primes and this\ncomputation completes quickly. However, if n is an overly large prime,\nthen this computation would take a long time.\n\nAn application that calls EVP_PKEY_public_check() and supplies an RSA key\nobtained from an untrusted source could be vulnerable to a Denial of Service\nattack.\n\nThe function EVP_PKEY_public_check() is not called from other OpenSSL\nfunctions however it is called from the OpenSSL pkey command line\napplication. For that reason that application is also vulnerable if used\nwith the '-pubin' and '-check' options on untrusted data.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue."}]},{"artifact":{"id":"1014a67cbf322356","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-6237","versionConstraint":"< 3.0.2-0ubuntu1.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-6237","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.14"],"available":[{"date":"2024-02-05","kind":"advisory","version":"3.0.2-0ubuntu1.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2023-6237","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2023-6237","date":"2026-11-02","epss":0.02303,"percentile":0.83326}],"risk":0.6909,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6237"},"relatedVulnerabilities":[{"id":"CVE-2023-6237","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6237","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2023-6237","date":"2026-11-02","epss":0.02303,"percentile":0.83326}],"urls":["https://github.com/openssl/openssl/commit/0b0f7abfb37350794a4b8960fafc292cd5d1b84d","https://github.com/openssl/openssl/commit/18c02492138d1eb8b6548cb26e7b625fb2414a2a","https://github.com/openssl/openssl/commit/a830f551557d3d66a84bbb18a5b889c640c36294","https://www.openssl.org/news/secadv/20240115.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://security.netapp.com/advisory/ntap-20240531-0007/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6237","description":"Issue summary: Checking excessively long invalid RSA public keys may take\na long time.\n\nImpact summary: Applications that use the function EVP_PKEY_public_check()\nto check RSA public keys may experience long delays. Where the key that\nis being checked has been obtained from an untrusted source this may lead\nto a Denial of Service.\n\nWhen function EVP_PKEY_public_check() is called on RSA public keys,\na computation is done to confirm that the RSA modulus, n, is composite.\nFor valid RSA keys, n is a product of two or more large primes and this\ncomputation completes quickly. However, if n is an overly large prime,\nthen this computation would take a long time.\n\nAn application that calls EVP_PKEY_public_check() and supplies an RSA key\nobtained from an untrusted source could be vulnerable to a Denial of Service\nattack.\n\nThe function EVP_PKEY_public_check() is not called from other OpenSSL\nfunctions however it is called from the OpenSSL pkey command line\napplication. For that reason that application is also vulnerable if used\nwith the '-pubin' and '-check' options on untrusted data.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7592","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-7592","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-11-02","epss":0.02303,"percentile":0.83325}],"risk":0.6909,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7592"},"relatedVulnerabilities":[{"id":"CVE-2024-7592","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-11-02","epss":0.02303,"percentile":0.83325}],"urls":["https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621","https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef","https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06","https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a","https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f","https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774","https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1","https://github.com/python/cpython/issues/123067","https://github.com/python/cpython/pull/123075","https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7592","description":"There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7592","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-7592","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-11-02","epss":0.02303,"percentile":0.83325}],"risk":0.6909,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7592"},"relatedVulnerabilities":[{"id":"CVE-2024-7592","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-11-02","epss":0.02303,"percentile":0.83325}],"urls":["https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621","https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef","https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06","https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a","https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f","https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774","https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1","https://github.com/python/cpython/issues/123067","https://github.com/python/cpython/pull/123075","https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7592","description":"There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-7592","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-7592","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-11-02","epss":0.02303,"percentile":0.83325}],"risk":0.6909,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7592"},"relatedVulnerabilities":[{"id":"CVE-2024-7592","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-11-02","epss":0.02303,"percentile":0.83325}],"urls":["https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621","https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef","https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06","https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a","https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f","https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774","https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1","https://github.com/python/cpython/issues/123067","https://github.com/python/cpython/pull/123075","https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7592","description":"There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7592","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-7592","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-11-02","epss":0.02303,"percentile":0.83325}],"risk":0.6909,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7592"},"relatedVulnerabilities":[{"id":"CVE-2024-7592","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-11-02","epss":0.02303,"percentile":0.83325}],"urls":["https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621","https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef","https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06","https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a","https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f","https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774","https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1","https://github.com/python/cpython/issues/123067","https://github.com/python/cpython/pull/123075","https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7592","description":"There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue."}]},{"artifact":{"id":"ebd7a017631da953","cpes":["cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:io.netty:netty-handler","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x4gw-5cx5-pgmh","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-x4gw-5cx5-pgmh","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-11-02","epss":0.00921,"percentile":0.6031}],"risk":0.69075,"urls":["https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-45416"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x4gw-5cx5-pgmh","description":"Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes"},"relatedVulnerabilities":[{"id":"CVE-2026-45416","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-11-02","epss":0.00921,"percentile":0.6031}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-45416","https://bugzilla.redhat.com/show_bug.cgi?id=2488391","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45416","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"72a1968e6efdfa5e","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-handler-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"4c0acdb8bb73647ebb3847ac2d503d53d72c02b4","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-handler-4.1.100.Final.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-handler-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x4gw-5cx5-pgmh","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-x4gw-5cx5-pgmh","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-11-02","epss":0.00921,"percentile":0.6031}],"risk":0.69075,"urls":["https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-45416"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x4gw-5cx5-pgmh","description":"Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes"},"relatedVulnerabilities":[{"id":"CVE-2026-45416","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-11-02","epss":0.00921,"percentile":0.6031}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-45416","https://bugzilla.redhat.com/show_bug.cgi?id=2488391","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45416","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"f9e961d53cf996e8","cpes":["cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:io.netty:netty-handler","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x4gw-5cx5-pgmh","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-x4gw-5cx5-pgmh","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-11-02","epss":0.00921,"percentile":0.6031}],"risk":0.69075,"urls":["https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-45416"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x4gw-5cx5-pgmh","description":"Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes"},"relatedVulnerabilities":[{"id":"CVE-2026-45416","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-11-02","epss":0.00921,"percentile":0.6031}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-45416","https://bugzilla.redhat.com/show_bug.cgi?id=2488391","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45416","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"cfda19effa7c6d29","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.3?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.3","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-0567","versionConstraint":"< 3.7.3-4ubuntu1.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-0567","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.4"],"available":[{"date":"2024-01-22","kind":"advisory","version":"3.7.3-4ubuntu1.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-0567","cwe":"CWE-347","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-0567","cwe":"CWE-347","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-0567","date":"2026-11-02","epss":0.0138,"percentile":0.72125}],"risk":0.69,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-0567"},"relatedVulnerabilities":[{"id":"CVE-2024-0567","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0567","cwe":"CWE-347","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-0567","cwe":"CWE-347","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-0567","date":"2026-11-02","epss":0.0138,"percentile":0.72125}],"urls":["https://access.redhat.com/errata/RHSA-2024:0533","https://access.redhat.com/errata/RHSA-2024:1082","https://access.redhat.com/errata/RHSA-2024:1383","https://access.redhat.com/errata/RHSA-2024:2094","https://access.redhat.com/security/cve/CVE-2024-0567","https://bugzilla.redhat.com/show_bug.cgi?id=2258544","https://gitlab.com/gnutls/gnutls/-/issues/1521","https://lists.gnupg.org/pipermail/gnutls-help/2024-January/004841.html","http://www.openwall.com/lists/oss-security/2024/01/19/3","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZEIOLORQ7N6WRPFXZSYDL2MC4LP7VFV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNXKVR5YNUEBNHAHM5GSYKBZX4W2HMN2/","https://security.netapp.com/advisory/ntap-20240202-0011/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0567","description":"A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack."}]},{"artifact":{"id":"af534de498eed696","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-59375","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-59375","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-59375","cwe":"CWE-770","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-59375","date":"2026-11-02","epss":0.0138,"percentile":0.72119}],"risk":0.69,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-59375"},"relatedVulnerabilities":[{"id":"CVE-2025-59375","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-59375","cwe":"CWE-770","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-59375","date":"2026-11-02","epss":0.0138,"percentile":0.72119}],"urls":["https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes#L45-L74","https://github.com/libexpat/libexpat/blob/R_2_7_2/expat/Changes","https://github.com/libexpat/libexpat/issues/1018","https://github.com/libexpat/libexpat/pull/1034","https://issues.oss-fuzz.com/issues/439133977","http://www.openwall.com/lists/oss-security/2025/09/16/2","http://www.openwall.com/lists/oss-security/2026/05/01/5","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-59375","description":"libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing."}]},{"artifact":{"id":"3058891d9c69e832","cpes":["cpe:2.3:a:com.atlassian.confluence:confluence:8.7.2:*:*:*:*:*:*:*","cpe:2.3:a:confluence:confluence:8.7.2:*:*:*:*:*:*:*","cpe:2.3:a:atlassian:confluence:8.7.2:*:*:*:*:*:*:*"],"name":"confluence","purl":"pkg:maven/com.atlassian.confluence/confluence@8.7.2","type":"java-archive","version":"8.7.2","language":"java","licenses":[],"metadata":{"pomGroupID":"com.atlassian.confluence","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","manifestName":"","pomArtifactID":"confluence","archiveDigests":[{"value":"afaf3eba1f92068ba7584de95e3aafadc7dc66c5","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.9.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-21686","versionConstraint":">= 7.13, < 7.19.22||>= 7.20, < 8.5.9||>= 8.6.0, < 8.9.1 (maven)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.atlassian.confluence:confluence","version":"8.7.2"},"language":"java","namespace":"nvd:language:java"}}],"vulnerability":{"id":"CVE-2024-21686","fix":{"state":"fixed","versions":["7.19.22","8.5.9","8.9.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"7.19.22"},{"date":"2025-09-04","kind":"first-observed","version":"8.5.9"},{"date":"2025-09-04","kind":"first-observed","version":"8.9.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"impactScore":5.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@atlassian.com","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.3,"impactScore":5.2,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21686","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-21686","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-21686","date":"2026-11-02","epss":0.0089,"percentile":0.59375}],"risk":0.68975,"urls":["https://confluence.atlassian.com/pages/viewpage.action?pageId=1417150917","https://jira.atlassian.com/browse/CONFSERVER-96134"],"severity":"High","namespace":"nvd:language:java","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21686","description":"This High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server.\n\nThis Stored XSS vulnerability, with a CVSS Score of 7.3, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to confidentiality, high impact to integrity, no impact to availability, and requires user interaction.\n\nAtlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions listed on this CVE\n\nSee the release notes (https://confluence.atlassian.com/doc/confluence-release-notes-327.html). You can download the latest version of Confluence Data Center and Server from the download center (https://www.atlassian.com/software/confluence/download-archives).\n\nThis vulnerability was reported via our Bug Bounty program."},"relatedVulnerabilities":[]},{"artifact":{"id":"1f8e56f352643db0","cpes":["cpe:2.3:a:libtasn1-6:libtasn1-6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1-6:libtasn1_6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1-6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1_6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1-6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1_6:4.18.0-4build1:*:*:*:*:*:*:*"],"name":"libtasn1-6","purl":"pkg:deb/ubuntu/libtasn1-6@4.18.0-4build1?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"4.18.0-4build1","language":"","licenses":["sha256:88a94e40a34bb28145805747cad4018e7eb976b5fd0bf2329dedf90088ebc6e4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtasn1-6/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libtasn1-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.18.0-4ubuntu0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-13151","versionConstraint":"< 4.18.0-4ubuntu0.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libtasn1-6","version":"4.18.0-4build1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-13151","fix":{"state":"fixed","versions":["4.18.0-4ubuntu0.2"],"available":[{"date":"2026-01-12","kind":"advisory","version":"4.18.0-4ubuntu0.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-13151","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-13151","date":"2026-11-02","epss":0.0137,"percentile":0.71907}],"risk":0.685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13151"},"relatedVulnerabilities":[{"id":"CVE-2025-13151","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13151","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-13151","date":"2026-11-02","epss":0.0137,"percentile":0.71907}],"urls":["https://gitlab.com/gnutls/libtasn1","https://gitlab.com/gnutls/libtasn1/-/merge_requests/121","http://www.openwall.com/lists/oss-security/2026/01/08/5","https://www.kb.cert.org/vuls/id/271649"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13151","description":"Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.22"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-20918","versionConstraint":"< 1.8.0_402||>= 1.9, < 8.0.402||>= 12, < 17.0.10||>= 18, < 21.0.2||>= 9, < 11.0.22 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-20918","fix":{"state":"fixed","versions":["1.8.0_402","8.0.402","11.0.22","17.0.10","21.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_402"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.402"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.10"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.22"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-20918","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-20918","date":"2026-11-02","epss":0.00918,"percentile":0.60243}],"risk":0.68391,"urls":["https://lists.debian.org/debian-lts-announce/2024/01/msg00023.html","https://security.netapp.com/advisory/ntap-20240201-0002/","https://www.oracle.com/security-alerts/cpujan2024.html","https://security.netapp.com/advisory/ntap-20241108-0002/","https://openjdk.org/groups/vulnerability/advisories/2024-01-16"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-20918","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and  22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.22"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-20952","versionConstraint":"< 1.8.0_402||>= 1.9, < 8.0.402||>= 12, < 17.0.10||>= 18, < 21.0.2||>= 9, < 11.0.22 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-20952","fix":{"state":"fixed","versions":["1.8.0_402","8.0.402","11.0.22","17.0.10","21.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_402"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.402"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.10"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.22"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-20952","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-20952","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-20952","date":"2026-11-02","epss":0.00918,"percentile":0.60243}],"risk":0.68391,"urls":["https://lists.debian.org/debian-lts-announce/2024/01/msg00023.html","https://security.netapp.com/advisory/ntap-20240201-0002/","https://www.oracle.com/security-alerts/cpujan2024.html","https://security.netapp.com/advisory/ntap-20241108-0002/","https://openjdk.org/groups/vulnerability/advisories/2024-01-16"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-20952","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and  22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"af534de498eed696","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8176","versionConstraint":"< 2.4.7-1ubuntu0.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-8176","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.6"],"available":[{"date":"2025-04-08","kind":"advisory","version":"2.4.7-1ubuntu0.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-8176","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-8176","date":"2026-11-02","epss":0.01353,"percentile":0.71566}],"risk":0.6765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8176"},"relatedVulnerabilities":[{"id":"CVE-2024-8176","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8176","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-8176","date":"2026-11-02","epss":0.01353,"percentile":0.71566}],"urls":["https://access.redhat.com/errata/RHSA-2025:13681","https://access.redhat.com/errata/RHSA-2025:22033","https://access.redhat.com/errata/RHSA-2025:22034","https://access.redhat.com/errata/RHSA-2025:22035","https://access.redhat.com/errata/RHSA-2025:22607","https://access.redhat.com/errata/RHSA-2025:22785","https://access.redhat.com/errata/RHSA-2025:22842","https://access.redhat.com/errata/RHSA-2025:22871","https://access.redhat.com/errata/RHSA-2025:3531","https://access.redhat.com/errata/RHSA-2025:3734","https://access.redhat.com/errata/RHSA-2025:3913","https://access.redhat.com/errata/RHSA-2025:4048","https://access.redhat.com/errata/RHSA-2025:4446","https://access.redhat.com/errata/RHSA-2025:4447","https://access.redhat.com/errata/RHSA-2025:4448","https://access.redhat.com/errata/RHSA-2025:4449","https://access.redhat.com/errata/RHSA-2025:7444","https://access.redhat.com/errata/RHSA-2025:7512","https://access.redhat.com/errata/RHSA-2025:8385","https://access.redhat.com/security/cve/CVE-2024-8176","https://bugzilla.redhat.com/show_bug.cgi?id=2310137","https://github.com/libexpat/libexpat/issues/893","https://github.com/libexpat/libexpat/pull/973","http://seclists.org/fulldisclosure/2025/May/10","http://seclists.org/fulldisclosure/2025/May/11","http://seclists.org/fulldisclosure/2025/May/12","http://seclists.org/fulldisclosure/2025/May/6","http://seclists.org/fulldisclosure/2025/May/7","http://seclists.org/fulldisclosure/2025/May/8","http://www.openwall.com/lists/oss-security/2025/03/15/1","http://www.openwall.com/lists/oss-security/2025/09/24/11","https://blog.hartwork.org/posts/expat-2-7-0-released/","https://bugzilla.suse.com/show_bug.cgi?id=1239618","https://github.com/libexpat/libexpat/blob/R_2_7_0/expat/Changes#L40-L52","https://gitlab.alpinelinux.org/alpine/aports/-/commit/d068c3ff36fc6f4789988a09c69b434db757db53","https://security-tracker.debian.org/tracker/CVE-2024-8176","https://security.netapp.com/advisory/ntap-20250328-0009/","https://ubuntu.com/security/CVE-2024-8176","https://www.kb.cert.org/vuls/id/760160","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8176","description":"A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage."}]},{"artifact":{"id":"cfda19effa7c6d29","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.3?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.3","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42009","versionConstraint":"< 3.7.3-4ubuntu1.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-42009","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.9"],"available":[{"date":"2026-05-20","kind":"advisory","version":"3.7.3-4ubuntu1.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-42009","cwe":"CWE-475","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-42009","cwe":"CWE-475","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42009","date":"2026-11-02","epss":0.01335,"percentile":0.71172}],"risk":0.6675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42009"},"relatedVulnerabilities":[{"id":"CVE-2026-42009","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42009","cwe":"CWE-475","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-42009","cwe":"CWE-475","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42009","date":"2026-11-02","epss":0.01335,"percentile":0.71172}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:29794","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:34372","https://access.redhat.com/errata/RHSA-2026:34764","https://access.redhat.com/errata/RHSA-2026:34788","https://access.redhat.com/errata/RHSA-2026:36004","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:40762","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:56786","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:56911","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-42009","https://bugzilla.redhat.com/show_bug.cgi?id=2467279","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-2","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42009.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42009","description":"A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service."}]},{"artifact":{"id":"b9d62df08eb83108","cpes":["cpe:2.3:a:org.eclipse.jetty:jetty-http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty-http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty_http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty-http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty_http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:10.0.15:*:*:*:*:*:*:*"],"name":"jetty-http","purl":"pkg:maven/org.eclipse.jetty/jetty-http@10.0.15","type":"java-archive","version":"10.0.15","language":"java","licenses":[],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar:org.eclipse.jetty:jetty-http","manifestName":"","pomArtifactID":"jetty-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"10.0.16"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hmr7-m48g-48f6","versionConstraint":">=10.0.0,<=10.0.15 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-http","version":"10.0.15"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hmr7-m48g-48f6","fix":{"state":"fixed","versions":["10.0.16"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"10.0.16"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-40167","cwe":"CWE-130","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2023-40167","date":"2026-11-02","epss":0.01279,"percentile":0.69991}],"risk":0.658685,"urls":["https://github.com/eclipse/jetty.project/security/advisories/GHSA-hmr7-m48g-48f6","https://www.rfc-editor.org/rfc/rfc9110#section-8.6","https://nvd.nist.gov/vuln/detail/CVE-2023-40167","https://www.debian.org/security/2023/dsa-5507","https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hmr7-m48g-48f6","description":"Jetty accepts \"+\" prefixed value in Content-Length"},"relatedVulnerabilities":[{"id":"CVE-2023-40167","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-40167","cwe":"CWE-130","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2023-40167","date":"2026-11-02","epss":0.01279,"percentile":0.69991}],"urls":["https://github.com/eclipse/jetty.project/security/advisories/GHSA-hmr7-m48g-48f6","https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html","https://www.debian.org/security/2023/dsa-5507","https://www.rfc-editor.org/rfc/rfc9110#section-8.6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-40167","description":"Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field.  This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses.  There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario."}]},{"artifact":{"id":"f02275b79327efaf","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33599","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33599","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-33599","date":"2026-11-02","epss":0.0131,"percentile":0.70644}],"risk":0.655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33599"},"relatedVulnerabilities":[{"id":"CVE-2024-33599","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-33599","date":"2026-11-02","epss":0.0131,"percentile":0.70644}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0011/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0005","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33599","description":"nscd: Stack-based buffer overflow in netgroup cache\n\nIf the Name Service Cache Daemon's (nscd) fixed size cache is exhausted\nby client requests then a subsequent client request for netgroup data\nmay result in a stack-based buffer overflow.  This flaw was introduced\nin glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"8da7e53d1801cfa5","cpes":["cpe:2.3:a:libc6:libc6:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33599","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33599","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-33599","date":"2026-11-02","epss":0.0131,"percentile":0.70644}],"risk":0.655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33599"},"relatedVulnerabilities":[{"id":"CVE-2024-33599","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-33599","date":"2026-11-02","epss":0.0131,"percentile":0.70644}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0011/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0005","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33599","description":"nscd: Stack-based buffer overflow in netgroup cache\n\nIf the Name Service Cache Daemon's (nscd) fixed size cache is exhausted\nby client requests then a subsequent client request for netgroup data\nmay result in a stack-based buffer overflow.  This flaw was introduced\nin glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"a88b7869c938a730","cpes":["cpe:2.3:a:locales:locales:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/ubuntu/locales@2.35-0ubuntu3.6?arch=all&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33599","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33599","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-33599","date":"2026-11-02","epss":0.0131,"percentile":0.70644}],"risk":0.655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33599"},"relatedVulnerabilities":[{"id":"CVE-2024-33599","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2024-33599","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-33599","date":"2026-11-02","epss":0.0131,"percentile":0.70644}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0011/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0005","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33599","description":"nscd: Stack-based buffer overflow in netgroup cache\n\nIf the Name Service Cache Daemon's (nscd) fixed size cache is exhausted\nby client requests then a subsequent client request for netgroup data\nmay result in a stack-based buffer overflow.  This flaw was introduced\nin glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"6e09d16bb8282f2f","cpes":["cpe:2.3:a:apache:httpcore5-h2:5.1.3:*:*:*:*:*:*:*","cpe:2.3:a:apache:httpcore5_h2:5.1.3:*:*:*:*:*:*:*"],"name":"httpcore5-h2","purl":"pkg:maven/org.apache.httpcomponents.core5/httpcore5-h2@5.1.3","type":"java-archive","version":"5.1.3","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.httpcomponents.core5","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.streams.streams-core-plugin-9.1.36.jar:org.apache.httpcomponents.core5:httpcore5-h2","manifestName":"","pomArtifactID":"httpcore5-h2","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.streams.streams-core-plugin-9.1.36.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.streams.streams-core-plugin-9.1.36.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.4.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v3jc-474w-2wm6","versionConstraint":"<5.4.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents.core5:httpcore5-h2","version":"5.1.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-v3jc-474w-2wm6","fix":{"state":"fixed","versions":["5.4.3"],"available":[{"date":"2026-08-14","kind":"first-observed","version":"5.4.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54428","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-54428","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54428","date":"2026-11-02","epss":0.00871,"percentile":0.58856}],"risk":0.65325,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-54428","https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd","http://www.openwall.com/lists/oss-security/2026/07/01/3","https://github.com/apache/httpcomponents-core/commit/1ea1239bbbe3442a8382a87279c0a8119a7e358e","https://github.com/apache/httpcomponents-core/commit/cc30ee058a7b10cbf4ad3dd6270ab6d1f6a74c49"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v3jc-474w-2wm6","description":"Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK"},"relatedVulnerabilities":[{"id":"CVE-2026-54428","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54428","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-54428","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54428","date":"2026-11-02","epss":0.00871,"percentile":0.58856}],"urls":["https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd","http://www.openwall.com/lists/oss-security/2026/07/01/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54428","description":"Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied."}]},{"artifact":{"id":"43fedf9e669c31b4","cpes":["cpe:2.3:a:apache:httpcore5-h2:5.1.3:*:*:*:*:*:*:*","cpe:2.3:a:apache:httpcore5_h2:5.1.3:*:*:*:*:*:*:*"],"name":"httpcore5-h2","purl":"pkg:maven/org.apache.httpcomponents.core5/httpcore5-h2@5.1.3","type":"java-archive","version":"5.1.3","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.httpcomponents.core5","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.streams.streams-aggregator-plugin-9.1.36.jar:org.apache.httpcomponents.core5:httpcore5-h2","manifestName":"","pomArtifactID":"httpcore5-h2","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.streams.streams-aggregator-plugin-9.1.36.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.streams.streams-aggregator-plugin-9.1.36.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.4.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v3jc-474w-2wm6","versionConstraint":"<5.4.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents.core5:httpcore5-h2","version":"5.1.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-v3jc-474w-2wm6","fix":{"state":"fixed","versions":["5.4.3"],"available":[{"date":"2026-08-14","kind":"first-observed","version":"5.4.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54428","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-54428","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54428","date":"2026-11-02","epss":0.00871,"percentile":0.58856}],"risk":0.65325,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-54428","https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd","http://www.openwall.com/lists/oss-security/2026/07/01/3","https://github.com/apache/httpcomponents-core/commit/1ea1239bbbe3442a8382a87279c0a8119a7e358e","https://github.com/apache/httpcomponents-core/commit/cc30ee058a7b10cbf4ad3dd6270ab6d1f6a74c49"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v3jc-474w-2wm6","description":"Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK"},"relatedVulnerabilities":[{"id":"CVE-2026-54428","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54428","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-54428","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54428","date":"2026-11-02","epss":0.00871,"percentile":0.58856}],"urls":["https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd","http://www.openwall.com/lists/oss-security/2026/07/01/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54428","description":"Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied."}]},{"artifact":{"id":"01453c64c307ae11","cpes":["cpe:2.3:a:apache:httpcore5-h2:5.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:httpcore5_h2:5.2:*:*:*:*:*:*:*"],"name":"httpcore5-h2","purl":"pkg:maven/org.apache.httpcomponents.core5/httpcore5-h2@5.2","type":"java-archive","version":"5.2","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.httpcomponents.core5","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.httpcomponents.core5_httpcore5-h2-5.2.jar","manifestName":"","pomArtifactID":"httpcore5-h2","archiveDigests":[{"value":"698bd8c759ccc7fd7398f3179ff45d0e5a7ccc16","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.httpcomponents.core5_httpcore5-h2-5.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.httpcomponents.core5_httpcore5-h2-5.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.4.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v3jc-474w-2wm6","versionConstraint":"<5.4.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents.core5:httpcore5-h2","version":"5.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-v3jc-474w-2wm6","fix":{"state":"fixed","versions":["5.4.3"],"available":[{"date":"2026-08-14","kind":"first-observed","version":"5.4.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54428","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-54428","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54428","date":"2026-11-02","epss":0.00871,"percentile":0.58856}],"risk":0.65325,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-54428","https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd","http://www.openwall.com/lists/oss-security/2026/07/01/3","https://github.com/apache/httpcomponents-core/commit/1ea1239bbbe3442a8382a87279c0a8119a7e358e","https://github.com/apache/httpcomponents-core/commit/cc30ee058a7b10cbf4ad3dd6270ab6d1f6a74c49"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v3jc-474w-2wm6","description":"Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK"},"relatedVulnerabilities":[{"id":"CVE-2026-54428","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54428","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-54428","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54428","date":"2026-11-02","epss":0.00871,"percentile":0.58856}],"urls":["https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd","http://www.openwall.com/lists/oss-security/2026/07/01/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54428","description":"Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied."}]},{"artifact":{"id":"8cc59be486875be8","cpes":["cpe:2.3:a:apache:httpcore5-h2:5.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:httpcore5_h2:5.2:*:*:*:*:*:*:*"],"name":"httpcore5-h2","purl":"pkg:maven/org.apache.httpcomponents.core5/httpcore5-h2@5.2","type":"java-archive","version":"5.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.httpcomponents.core5","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.team-calendars.team-calendars-18.7.6.jar:org.apache.httpcomponents.core5:httpcore5-h2","manifestName":"","pomArtifactID":"httpcore5-h2","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.team-calendars.team-calendars-18.7.6.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.team-calendars.team-calendars-18.7.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.4.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v3jc-474w-2wm6","versionConstraint":"<5.4.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents.core5:httpcore5-h2","version":"5.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-v3jc-474w-2wm6","fix":{"state":"fixed","versions":["5.4.3"],"available":[{"date":"2026-08-14","kind":"first-observed","version":"5.4.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54428","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-54428","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54428","date":"2026-11-02","epss":0.00871,"percentile":0.58856}],"risk":0.65325,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-54428","https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd","http://www.openwall.com/lists/oss-security/2026/07/01/3","https://github.com/apache/httpcomponents-core/commit/1ea1239bbbe3442a8382a87279c0a8119a7e358e","https://github.com/apache/httpcomponents-core/commit/cc30ee058a7b10cbf4ad3dd6270ab6d1f6a74c49"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v3jc-474w-2wm6","description":"Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK"},"relatedVulnerabilities":[{"id":"CVE-2026-54428","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54428","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-54428","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54428","date":"2026-11-02","epss":0.00871,"percentile":0.58856}],"urls":["https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd","http://www.openwall.com/lists/oss-security/2026/07/01/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54428","description":"Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied."}]},{"artifact":{"id":"d51503eb951ff697","cpes":["cpe:2.3:a:apache:httpcore5-h2:5.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:httpcore5_h2:5.2:*:*:*:*:*:*:*"],"name":"httpcore5-h2","purl":"pkg:maven/org.apache.httpcomponents.core5/httpcore5-h2@5.2","type":"java-archive","version":"5.2","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.httpcomponents.core5","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar:META-INF/lib/httpcore5-h2-5.2.jar","manifestName":"","pomArtifactID":"httpcore5-h2","archiveDigests":[{"value":"698bd8c759ccc7fd7398f3179ff45d0e5a7ccc16","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar:META-INF/lib/httpcore5-h2-5.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.4.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v3jc-474w-2wm6","versionConstraint":"<5.4.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents.core5:httpcore5-h2","version":"5.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-v3jc-474w-2wm6","fix":{"state":"fixed","versions":["5.4.3"],"available":[{"date":"2026-08-14","kind":"first-observed","version":"5.4.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54428","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-54428","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54428","date":"2026-11-02","epss":0.00871,"percentile":0.58856}],"risk":0.65325,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-54428","https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd","http://www.openwall.com/lists/oss-security/2026/07/01/3","https://github.com/apache/httpcomponents-core/commit/1ea1239bbbe3442a8382a87279c0a8119a7e358e","https://github.com/apache/httpcomponents-core/commit/cc30ee058a7b10cbf4ad3dd6270ab6d1f6a74c49"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v3jc-474w-2wm6","description":"Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK"},"relatedVulnerabilities":[{"id":"CVE-2026-54428","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54428","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-54428","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54428","date":"2026-11-02","epss":0.00871,"percentile":0.58856}],"urls":["https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd","http://www.openwall.com/lists/oss-security/2026/07/01/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54428","description":"Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied."}]},{"artifact":{"id":"cfda19effa7c6d29","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.3?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.3","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-12243","versionConstraint":"< 3.7.3-4ubuntu1.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-12243","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.6"],"available":[{"date":"2025-02-20","kind":"advisory","version":"3.7.3-4ubuntu1.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-12243","cwe":"CWE-407","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-12243","date":"2026-11-02","epss":0.01292,"percentile":0.70265}],"risk":0.6459999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-12243"},"relatedVulnerabilities":[{"id":"CVE-2024-12243","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-12243","cwe":"CWE-407","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-12243","date":"2026-11-02","epss":0.01292,"percentile":0.70265}],"urls":["https://access.redhat.com/errata/RHSA-2025:17361","https://access.redhat.com/errata/RHSA-2025:4051","https://access.redhat.com/errata/RHSA-2025:7076","https://access.redhat.com/errata/RHSA-2025:8020","https://access.redhat.com/errata/RHSA-2025:8385","https://access.redhat.com/security/cve/CVE-2024-12243","https://bugzilla.redhat.com/show_bug.cgi?id=2344615","https://gitlab.com/gnutls/gnutls/-/issues/1553","https://gitlab.com/gnutls/libtasn1/-/issues/52","https://lists.debian.org/debian-lts-announce/2025/02/msg00027.html","https://security.netapp.com/advisory/ntap-20250523-0002/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-12243","description":"A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition."}]},{"artifact":{"id":"12d87f5fb5083850","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:249.11-0ubuntu3.11:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/ubuntu/libsystemd0@249.11-0ubuntu3.11?arch=amd64&distro=ubuntu-22.04&upstream=systemd","type":"deb","version":"249.11-0ubuntu3.11","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"249.11-0ubuntu3.16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4598","versionConstraint":"< 249.11-0ubuntu3.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"systemd","version":"249.11-0ubuntu3.11"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-4598","fix":{"state":"fixed","versions":["249.11-0ubuntu3.16"],"available":[{"date":"2025-06-09","kind":"advisory","version":"249.11-0ubuntu3.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-11-02","epss":0.01277,"percentile":0.69957}],"risk":0.6385,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-4598"},"relatedVulnerabilities":[{"id":"CVE-2025-4598","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-11-02","epss":0.01277,"percentile":0.69957}],"urls":["https://access.redhat.com/errata/RHSA-2025:22660","https://access.redhat.com/errata/RHSA-2025:22868","https://access.redhat.com/errata/RHSA-2025:23227","https://access.redhat.com/errata/RHSA-2025:23234","https://access.redhat.com/errata/RHSA-2026:0414","https://access.redhat.com/errata/RHSA-2026:1652","https://access.redhat.com/errata/RHSA-2026:18153","https://access.redhat.com/security/cve/CVE-2025-4598","https://bugzilla.redhat.com/show_bug.cgi?id=2369242","https://www.openwall.com/lists/oss-security/2025/05/29/3","http://seclists.org/fulldisclosure/2025/Jun/9","http://www.openwall.com/lists/oss-security/2025/06/05/1","http://www.openwall.com/lists/oss-security/2025/06/05/3","http://www.openwall.com/lists/oss-security/2025/08/18/3","https://blogs.oracle.com/linux/post/analysis-of-cve-2025-4598","https://ciq.com/blog/the-real-danger-of-systemd-coredump-cve-2025-4598/","https://lists.debian.org/debian-lts-announce/2025/07/msg00022.html","https://www.openwall.com/lists/oss-security/2025/08/18/3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4598","description":"A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\n\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality."}]},{"artifact":{"id":"8877930a44354042","cpes":["cpe:2.3:a:libudev1:libudev1:249.11-0ubuntu3.11:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/ubuntu/libudev1@249.11-0ubuntu3.11?arch=amd64&distro=ubuntu-22.04&upstream=systemd","type":"deb","version":"249.11-0ubuntu3.11","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"249.11-0ubuntu3.16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4598","versionConstraint":"< 249.11-0ubuntu3.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"systemd","version":"249.11-0ubuntu3.11"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-4598","fix":{"state":"fixed","versions":["249.11-0ubuntu3.16"],"available":[{"date":"2025-06-09","kind":"advisory","version":"249.11-0ubuntu3.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-11-02","epss":0.01277,"percentile":0.69957}],"risk":0.6385,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-4598"},"relatedVulnerabilities":[{"id":"CVE-2025-4598","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-11-02","epss":0.01277,"percentile":0.69957}],"urls":["https://access.redhat.com/errata/RHSA-2025:22660","https://access.redhat.com/errata/RHSA-2025:22868","https://access.redhat.com/errata/RHSA-2025:23227","https://access.redhat.com/errata/RHSA-2025:23234","https://access.redhat.com/errata/RHSA-2026:0414","https://access.redhat.com/errata/RHSA-2026:1652","https://access.redhat.com/errata/RHSA-2026:18153","https://access.redhat.com/security/cve/CVE-2025-4598","https://bugzilla.redhat.com/show_bug.cgi?id=2369242","https://www.openwall.com/lists/oss-security/2025/05/29/3","http://seclists.org/fulldisclosure/2025/Jun/9","http://www.openwall.com/lists/oss-security/2025/06/05/1","http://www.openwall.com/lists/oss-security/2025/06/05/3","http://www.openwall.com/lists/oss-security/2025/08/18/3","https://blogs.oracle.com/linux/post/analysis-of-cve-2025-4598","https://ciq.com/blog/the-real-danger-of-systemd-coredump-cve-2025-4598/","https://lists.debian.org/debian-lts-announce/2025/07/msg00022.html","https://www.openwall.com/lists/oss-security/2025/08/18/3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4598","description":"A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\n\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8088","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-8088","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-8088","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2024-8088","date":"2026-11-02","epss":0.01275,"percentile":0.69922}],"risk":0.6375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8088"},"relatedVulnerabilities":[{"id":"CVE-2024-8088","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:L/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8088","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2024-8088","date":"2026-11-02","epss":0.01275,"percentile":0.69922}],"urls":["https://github.com/python/cpython/commit/0aa1ee22ab6e204e9d3d0e9dd63ea648ed691ef1","https://github.com/python/cpython/commit/2231286d78d328c2f575e0b05b16fe447d1656d6","https://github.com/python/cpython/commit/795f2597a4be988e2bb19b69ff9958e981cb894e","https://github.com/python/cpython/commit/7bc367e464ce50b956dd232c1dfa1cad4e7fb814","https://github.com/python/cpython/commit/7e8883a3f04d308302361aeffc73e0e9837f19d4","https://github.com/python/cpython/commit/8c7348939d8a3ecd79d630075f6be1b0c5b41f64","https://github.com/python/cpython/commit/95b073bddefa6243effa08e131e297c0383e7f6a","https://github.com/python/cpython/commit/962055268ed4f2ca1d717bfc8b6385de50a23ab7","https://github.com/python/cpython/commit/9cd03263100ddb1657826cc4a71470786cab3932","https://github.com/python/cpython/commit/dcc5182f27c1500006a1ef78e10613bb45788dea","https://github.com/python/cpython/commit/e0264a61119d551658d9445af38323ba94fc16db","https://github.com/python/cpython/commit/fc0b8259e693caa8400fa8b6ac1e494e47ea7798","https://github.com/python/cpython/issues/122905","https://github.com/python/cpython/issues/123270","https://github.com/python/cpython/pull/122906","https://mail.python.org/archives/list/security-announce@python.org/thread/GNFCKVI4TCATKQLALJ5SN4L4CSPSMILU/","http://www.openwall.com/lists/oss-security/2024/08/22/1","http://www.openwall.com/lists/oss-security/2024/08/22/4","http://www.openwall.com/lists/oss-security/2024/08/23/1","http://www.openwall.com/lists/oss-security/2024/08/23/2","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241011-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8088","description":"There is a HIGH severity vulnerability affecting the CPython \"zipfile\"\nmodule affecting \"zipfile.Path\". Note that the more common API \"zipfile.ZipFile\" class is unaffected.\n\n\n\n\n\nWhen iterating over names of entries in a zip archive (for example, methods\nof \"zipfile.Path\" like \"namelist()\", \"iterdir()\", etc)\nthe process can be put into an infinite loop with a maliciously crafted\nzip archive. This defect applies when reading only metadata or extracting\nthe contents of the zip archive. Programs that are not handling\nuser-controlled zip archives are not affected."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8088","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-8088","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-8088","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2024-8088","date":"2026-11-02","epss":0.01275,"percentile":0.69922}],"risk":0.6375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8088"},"relatedVulnerabilities":[{"id":"CVE-2024-8088","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:L/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8088","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2024-8088","date":"2026-11-02","epss":0.01275,"percentile":0.69922}],"urls":["https://github.com/python/cpython/commit/0aa1ee22ab6e204e9d3d0e9dd63ea648ed691ef1","https://github.com/python/cpython/commit/2231286d78d328c2f575e0b05b16fe447d1656d6","https://github.com/python/cpython/commit/795f2597a4be988e2bb19b69ff9958e981cb894e","https://github.com/python/cpython/commit/7bc367e464ce50b956dd232c1dfa1cad4e7fb814","https://github.com/python/cpython/commit/7e8883a3f04d308302361aeffc73e0e9837f19d4","https://github.com/python/cpython/commit/8c7348939d8a3ecd79d630075f6be1b0c5b41f64","https://github.com/python/cpython/commit/95b073bddefa6243effa08e131e297c0383e7f6a","https://github.com/python/cpython/commit/962055268ed4f2ca1d717bfc8b6385de50a23ab7","https://github.com/python/cpython/commit/9cd03263100ddb1657826cc4a71470786cab3932","https://github.com/python/cpython/commit/dcc5182f27c1500006a1ef78e10613bb45788dea","https://github.com/python/cpython/commit/e0264a61119d551658d9445af38323ba94fc16db","https://github.com/python/cpython/commit/fc0b8259e693caa8400fa8b6ac1e494e47ea7798","https://github.com/python/cpython/issues/122905","https://github.com/python/cpython/issues/123270","https://github.com/python/cpython/pull/122906","https://mail.python.org/archives/list/security-announce@python.org/thread/GNFCKVI4TCATKQLALJ5SN4L4CSPSMILU/","http://www.openwall.com/lists/oss-security/2024/08/22/1","http://www.openwall.com/lists/oss-security/2024/08/22/4","http://www.openwall.com/lists/oss-security/2024/08/23/1","http://www.openwall.com/lists/oss-security/2024/08/23/2","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241011-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8088","description":"There is a HIGH severity vulnerability affecting the CPython \"zipfile\"\nmodule affecting \"zipfile.Path\". Note that the more common API \"zipfile.ZipFile\" class is unaffected.\n\n\n\n\n\nWhen iterating over names of entries in a zip archive (for example, methods\nof \"zipfile.Path\" like \"namelist()\", \"iterdir()\", etc)\nthe process can be put into an infinite loop with a maliciously crafted\nzip archive. This defect applies when reading only metadata or extracting\nthe contents of the zip archive. Programs that are not handling\nuser-controlled zip archives are not affected."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-8088","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-8088","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-8088","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2024-8088","date":"2026-11-02","epss":0.01275,"percentile":0.69922}],"risk":0.6375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8088"},"relatedVulnerabilities":[{"id":"CVE-2024-8088","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:L/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8088","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2024-8088","date":"2026-11-02","epss":0.01275,"percentile":0.69922}],"urls":["https://github.com/python/cpython/commit/0aa1ee22ab6e204e9d3d0e9dd63ea648ed691ef1","https://github.com/python/cpython/commit/2231286d78d328c2f575e0b05b16fe447d1656d6","https://github.com/python/cpython/commit/795f2597a4be988e2bb19b69ff9958e981cb894e","https://github.com/python/cpython/commit/7bc367e464ce50b956dd232c1dfa1cad4e7fb814","https://github.com/python/cpython/commit/7e8883a3f04d308302361aeffc73e0e9837f19d4","https://github.com/python/cpython/commit/8c7348939d8a3ecd79d630075f6be1b0c5b41f64","https://github.com/python/cpython/commit/95b073bddefa6243effa08e131e297c0383e7f6a","https://github.com/python/cpython/commit/962055268ed4f2ca1d717bfc8b6385de50a23ab7","https://github.com/python/cpython/commit/9cd03263100ddb1657826cc4a71470786cab3932","https://github.com/python/cpython/commit/dcc5182f27c1500006a1ef78e10613bb45788dea","https://github.com/python/cpython/commit/e0264a61119d551658d9445af38323ba94fc16db","https://github.com/python/cpython/commit/fc0b8259e693caa8400fa8b6ac1e494e47ea7798","https://github.com/python/cpython/issues/122905","https://github.com/python/cpython/issues/123270","https://github.com/python/cpython/pull/122906","https://mail.python.org/archives/list/security-announce@python.org/thread/GNFCKVI4TCATKQLALJ5SN4L4CSPSMILU/","http://www.openwall.com/lists/oss-security/2024/08/22/1","http://www.openwall.com/lists/oss-security/2024/08/22/4","http://www.openwall.com/lists/oss-security/2024/08/23/1","http://www.openwall.com/lists/oss-security/2024/08/23/2","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241011-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8088","description":"There is a HIGH severity vulnerability affecting the CPython \"zipfile\"\nmodule affecting \"zipfile.Path\". Note that the more common API \"zipfile.ZipFile\" class is unaffected.\n\n\n\n\n\nWhen iterating over names of entries in a zip archive (for example, methods\nof \"zipfile.Path\" like \"namelist()\", \"iterdir()\", etc)\nthe process can be put into an infinite loop with a maliciously crafted\nzip archive. This defect applies when reading only metadata or extracting\nthe contents of the zip archive. Programs that are not handling\nuser-controlled zip archives are not affected."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8088","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-8088","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-8088","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2024-8088","date":"2026-11-02","epss":0.01275,"percentile":0.69922}],"risk":0.6375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8088"},"relatedVulnerabilities":[{"id":"CVE-2024-8088","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:L/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8088","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2024-8088","date":"2026-11-02","epss":0.01275,"percentile":0.69922}],"urls":["https://github.com/python/cpython/commit/0aa1ee22ab6e204e9d3d0e9dd63ea648ed691ef1","https://github.com/python/cpython/commit/2231286d78d328c2f575e0b05b16fe447d1656d6","https://github.com/python/cpython/commit/795f2597a4be988e2bb19b69ff9958e981cb894e","https://github.com/python/cpython/commit/7bc367e464ce50b956dd232c1dfa1cad4e7fb814","https://github.com/python/cpython/commit/7e8883a3f04d308302361aeffc73e0e9837f19d4","https://github.com/python/cpython/commit/8c7348939d8a3ecd79d630075f6be1b0c5b41f64","https://github.com/python/cpython/commit/95b073bddefa6243effa08e131e297c0383e7f6a","https://github.com/python/cpython/commit/962055268ed4f2ca1d717bfc8b6385de50a23ab7","https://github.com/python/cpython/commit/9cd03263100ddb1657826cc4a71470786cab3932","https://github.com/python/cpython/commit/dcc5182f27c1500006a1ef78e10613bb45788dea","https://github.com/python/cpython/commit/e0264a61119d551658d9445af38323ba94fc16db","https://github.com/python/cpython/commit/fc0b8259e693caa8400fa8b6ac1e494e47ea7798","https://github.com/python/cpython/issues/122905","https://github.com/python/cpython/issues/123270","https://github.com/python/cpython/pull/122906","https://mail.python.org/archives/list/security-announce@python.org/thread/GNFCKVI4TCATKQLALJ5SN4L4CSPSMILU/","http://www.openwall.com/lists/oss-security/2024/08/22/1","http://www.openwall.com/lists/oss-security/2024/08/22/4","http://www.openwall.com/lists/oss-security/2024/08/23/1","http://www.openwall.com/lists/oss-security/2024/08/23/2","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241011-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8088","description":"There is a HIGH severity vulnerability affecting the CPython \"zipfile\"\nmodule affecting \"zipfile.Path\". Note that the more common API \"zipfile.ZipFile\" class is unaffected.\n\n\n\n\n\nWhen iterating over names of entries in a zip archive (for example, methods\nof \"zipfile.Path\" like \"namelist()\", \"iterdir()\", etc)\nthe process can be put into an infinite loop with a maliciously crafted\nzip archive. This defect applies when reading only metadata or extracting\nthe contents of the zip archive. Programs that are not handling\nuser-controlled zip archives are not affected."}]},{"artifact":{"id":"8e71e0de8f0f474a","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@8.20.1","type":"java-archive","version":"8.20.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.plugins.authentication.atlassian-authentication-plugin-4.2.26.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.plugins.authentication.atlassian-authentication-plugin-4.2.26.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.plugins.authentication.atlassian-authentication-plugin-4.2.26.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gvpg-vgmx-xg6w","versionConstraint":"<9.37.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"8.20.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gvpg-vgmx-xg6w","fix":{"state":"fixed","versions":["9.37.2"],"available":[{"date":"2024-03-16","kind":"first-observed","version":"9.37.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"risk":0.63492,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-52428","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://connect2id.com/products/nimbus-jose-jwt","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gvpg-vgmx-xg6w","description":"Denial of Service in Connect2id Nimbus JOSE+JWT"},"relatedVulnerabilities":[{"id":"CVE-2023-52428","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/","https://connect2id.com/products/nimbus-jose-jwt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52428","description":"In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component."}]},{"artifact":{"id":"e82faf748fca2b9d","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:8.22:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@8.22","type":"java-archive","version":"8.22","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gvpg-vgmx-xg6w","versionConstraint":"<9.37.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"8.22"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gvpg-vgmx-xg6w","fix":{"state":"fixed","versions":["9.37.2"],"available":[{"date":"2024-03-16","kind":"first-observed","version":"9.37.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"risk":0.63492,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-52428","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://connect2id.com/products/nimbus-jose-jwt","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gvpg-vgmx-xg6w","description":"Denial of Service in Connect2id Nimbus JOSE+JWT"},"relatedVulnerabilities":[{"id":"CVE-2023-52428","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/","https://connect2id.com/products/nimbus-jose-jwt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52428","description":"In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component."}]},{"artifact":{"id":"59064f7c295c14ff","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:8.22.1:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@8.22.1","type":"java-archive","version":"8.22.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.upm.atlassian-universal-plugin-manager-plugin-6.4.1.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.upm.atlassian-universal-plugin-manager-plugin-6.4.1.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.upm.atlassian-universal-plugin-manager-plugin-6.4.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gvpg-vgmx-xg6w","versionConstraint":"<9.37.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"8.22.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gvpg-vgmx-xg6w","fix":{"state":"fixed","versions":["9.37.2"],"available":[{"date":"2024-03-16","kind":"first-observed","version":"9.37.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"risk":0.63492,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-52428","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://connect2id.com/products/nimbus-jose-jwt","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gvpg-vgmx-xg6w","description":"Denial of Service in Connect2id Nimbus JOSE+JWT"},"relatedVulnerabilities":[{"id":"CVE-2023-52428","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/","https://connect2id.com/products/nimbus-jose-jwt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52428","description":"In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component."}]},{"artifact":{"id":"f4e147ea7b18f56d","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.28:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.28","type":"java-archive","version":"9.28","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-collaborative-editor-plugin-18.7.51.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-collaborative-editor-plugin-18.7.51.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-collaborative-editor-plugin-18.7.51.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gvpg-vgmx-xg6w","versionConstraint":"<9.37.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.28"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gvpg-vgmx-xg6w","fix":{"state":"fixed","versions":["9.37.2"],"available":[{"date":"2024-03-16","kind":"first-observed","version":"9.37.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"risk":0.63492,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-52428","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://connect2id.com/products/nimbus-jose-jwt","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gvpg-vgmx-xg6w","description":"Denial of Service in Connect2id Nimbus JOSE+JWT"},"relatedVulnerabilities":[{"id":"CVE-2023-52428","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/","https://connect2id.com/products/nimbus-jose-jwt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52428","description":"In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component."}]},{"artifact":{"id":"ddfa7e7209741c36","cpes":["cpe:2.3:a:com.nimbusds.nimbus-jose-jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds.nimbus-jose-jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:connect2id-ltd-:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:connect2id-ltd-:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:connect2id_ltd_:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:connect2id_ltd_:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.31","type":"java-archive","version":"9.31","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.nimbusds_nimbus-jose-jwt-9.31.jar","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":[{"value":"229ba7b31d1f886968896c48aeeba5a1586b00bc","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.nimbusds_nimbus-jose-jwt-9.31.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.nimbusds_nimbus-jose-jwt-9.31.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gvpg-vgmx-xg6w","versionConstraint":"<9.37.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gvpg-vgmx-xg6w","fix":{"state":"fixed","versions":["9.37.2"],"available":[{"date":"2024-03-16","kind":"first-observed","version":"9.37.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"risk":0.63492,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-52428","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://connect2id.com/products/nimbus-jose-jwt","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gvpg-vgmx-xg6w","description":"Denial of Service in Connect2id Nimbus JOSE+JWT"},"relatedVulnerabilities":[{"id":"CVE-2023-52428","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/","https://connect2id.com/products/nimbus-jose-jwt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52428","description":"In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component."}]},{"artifact":{"id":"2abd1ff29a503c5a","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.31","type":"java-archive","version":"9.31","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.oauth2.oauth2-provider-plugin-3.1.5.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.oauth2.oauth2-provider-plugin-3.1.5.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.oauth2.oauth2-provider-plugin-3.1.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gvpg-vgmx-xg6w","versionConstraint":"<9.37.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gvpg-vgmx-xg6w","fix":{"state":"fixed","versions":["9.37.2"],"available":[{"date":"2024-03-16","kind":"first-observed","version":"9.37.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"risk":0.63492,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-52428","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://connect2id.com/products/nimbus-jose-jwt","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gvpg-vgmx-xg6w","description":"Denial of Service in Connect2id Nimbus JOSE+JWT"},"relatedVulnerabilities":[{"id":"CVE-2023-52428","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/","https://connect2id.com/products/nimbus-jose-jwt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52428","description":"In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component."}]},{"artifact":{"id":"5bb9221d86a18ecc","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.31","type":"java-archive","version":"9.31","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.oauth2.oauth2-client-plugin-3.1.5.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.oauth2.oauth2-client-plugin-3.1.5.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.oauth2.oauth2-client-plugin-3.1.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gvpg-vgmx-xg6w","versionConstraint":"<9.37.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gvpg-vgmx-xg6w","fix":{"state":"fixed","versions":["9.37.2"],"available":[{"date":"2024-03-16","kind":"first-observed","version":"9.37.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"risk":0.63492,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-52428","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://connect2id.com/products/nimbus-jose-jwt","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gvpg-vgmx-xg6w","description":"Denial of Service in Connect2id Nimbus JOSE+JWT"},"relatedVulnerabilities":[{"id":"CVE-2023-52428","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/","https://connect2id.com/products/nimbus-jose-jwt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52428","description":"In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component."}]},{"artifact":{"id":"2606a3d8512348e9","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.31","type":"java-archive","version":"9.31","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.jwt.jwt-plugin-3.3.2.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.jwt.jwt-plugin-3.3.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.jwt.jwt-plugin-3.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gvpg-vgmx-xg6w","versionConstraint":"<9.37.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gvpg-vgmx-xg6w","fix":{"state":"fixed","versions":["9.37.2"],"available":[{"date":"2024-03-16","kind":"first-observed","version":"9.37.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"risk":0.63492,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-52428","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://connect2id.com/products/nimbus-jose-jwt","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gvpg-vgmx-xg6w","description":"Denial of Service in Connect2id Nimbus JOSE+JWT"},"relatedVulnerabilities":[{"id":"CVE-2023-52428","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52428","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52428","date":"2026-11-02","epss":0.00814,"percentile":0.57043}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/","https://connect2id.com/products/nimbus-jose-jwt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52428","description":"In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component."}]},{"artifact":{"id":"cfda19effa7c6d29","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.3?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.3","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33846","versionConstraint":"< 3.7.3-4ubuntu1.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-33846","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.9"],"available":[{"date":"2026-05-20","kind":"advisory","version":"3.7.3-4ubuntu1.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-33846","cwe":"CWE-130","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-33846","cwe":"CWE-130","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33846","date":"2026-11-02","epss":0.01263,"percentile":0.69691}],"risk":0.6315000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33846"},"relatedVulnerabilities":[{"id":"CVE-2026-33846","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33846","cwe":"CWE-130","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-33846","cwe":"CWE-130","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33846","date":"2026-11-02","epss":0.01263,"percentile":0.69691}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:34372","https://access.redhat.com/errata/RHSA-2026:36004","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:56786","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:56911","https://access.redhat.com/errata/RHSA-2026:57402","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-33846","https://bugzilla.redhat.com/show_bug.cgi?id=2450625","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33846.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33846","description":"A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption."}]},{"artifact":{"id":"bab8d09d07950909","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.11.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.2","type":"java-archive","version":"2.11.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.hazelcast_hazelcast-3.12.13.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.hazelcast_hazelcast-3.12.13.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.hazelcast_hazelcast-3.12.13.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.15.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h46c-h94j-95f3","versionConstraint":"<2.15.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.11.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h46c-h94j-95f3","fix":{"state":"fixed","versions":["2.15.0"],"available":[{"date":"2025-06-28","kind":"first-observed","version":"2.15.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"risk":0.62532,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3","https://nvd.nist.gov/vuln/detail/CVE-2025-52999","https://github.com/FasterXML/jackson-core/pull/943"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h46c-h94j-95f3","description":"jackson-core can throw a StackoverflowError when processing deeply nested data"},"relatedVulnerabilities":[{"id":"CVE-2025-52999","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"urls":["https://github.com/FasterXML/jackson-core/pull/943","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52999","description":"jackson-core contains core low-level incremental (\"streaming\") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources."}]},{"artifact":{"id":"8fba25e88f80966a","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.11.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.2","type":"java-archive","version":"2.11.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.15.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h46c-h94j-95f3","versionConstraint":"<2.15.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.11.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h46c-h94j-95f3","fix":{"state":"fixed","versions":["2.15.0"],"available":[{"date":"2025-06-28","kind":"first-observed","version":"2.15.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"risk":0.62532,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3","https://nvd.nist.gov/vuln/detail/CVE-2025-52999","https://github.com/FasterXML/jackson-core/pull/943"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h46c-h94j-95f3","description":"jackson-core can throw a StackoverflowError when processing deeply nested data"},"relatedVulnerabilities":[{"id":"CVE-2025-52999","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"urls":["https://github.com/FasterXML/jackson-core/pull/943","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52999","description":"jackson-core contains core low-level incremental (\"streaming\") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources."}]},{"artifact":{"id":"00a31800f16e4d02","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.12.7:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.12.7","type":"java-archive","version":"2.12.7","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.15.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h46c-h94j-95f3","versionConstraint":"<2.15.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.12.7"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h46c-h94j-95f3","fix":{"state":"fixed","versions":["2.15.0"],"available":[{"date":"2025-06-28","kind":"first-observed","version":"2.15.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"risk":0.62532,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3","https://nvd.nist.gov/vuln/detail/CVE-2025-52999","https://github.com/FasterXML/jackson-core/pull/943"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h46c-h94j-95f3","description":"jackson-core can throw a StackoverflowError when processing deeply nested data"},"relatedVulnerabilities":[{"id":"CVE-2025-52999","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"urls":["https://github.com/FasterXML/jackson-core/pull/943","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52999","description":"jackson-core contains core low-level incremental (\"streaming\") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources."}]},{"artifact":{"id":"0817be99e5231885","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.13.4:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4","type":"java-archive","version":"2.13.4","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.15.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h46c-h94j-95f3","versionConstraint":"<2.15.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.13.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h46c-h94j-95f3","fix":{"state":"fixed","versions":["2.15.0"],"available":[{"date":"2025-06-28","kind":"first-observed","version":"2.15.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"risk":0.62532,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3","https://nvd.nist.gov/vuln/detail/CVE-2025-52999","https://github.com/FasterXML/jackson-core/pull/943"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h46c-h94j-95f3","description":"jackson-core can throw a StackoverflowError when processing deeply nested data"},"relatedVulnerabilities":[{"id":"CVE-2025-52999","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"urls":["https://github.com/FasterXML/jackson-core/pull/943","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52999","description":"jackson-core contains core low-level incremental (\"streaming\") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources."}]},{"artifact":{"id":"e2fc9ff677ffb6c7","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar:META-INF/lib/jackson-core-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"7a07bc535ccf0b7f6929c4d0f2ab9b294ef7c4a3","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar:META-INF/lib/jackson-core-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.15.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h46c-h94j-95f3","versionConstraint":"<2.15.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h46c-h94j-95f3","fix":{"state":"fixed","versions":["2.15.0"],"available":[{"date":"2025-06-28","kind":"first-observed","version":"2.15.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"risk":0.62532,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3","https://nvd.nist.gov/vuln/detail/CVE-2025-52999","https://github.com/FasterXML/jackson-core/pull/943"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h46c-h94j-95f3","description":"jackson-core can throw a StackoverflowError when processing deeply nested data"},"relatedVulnerabilities":[{"id":"CVE-2025-52999","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"urls":["https://github.com/FasterXML/jackson-core/pull/943","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52999","description":"jackson-core contains core low-level incremental (\"streaming\") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources."}]},{"artifact":{"id":"e9be8ec26ef33e8f","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.15.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h46c-h94j-95f3","versionConstraint":"<2.15.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h46c-h94j-95f3","fix":{"state":"fixed","versions":["2.15.0"],"available":[{"date":"2025-06-28","kind":"first-observed","version":"2.15.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"risk":0.62532,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3","https://nvd.nist.gov/vuln/detail/CVE-2025-52999","https://github.com/FasterXML/jackson-core/pull/943"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h46c-h94j-95f3","description":"jackson-core can throw a StackoverflowError when processing deeply nested data"},"relatedVulnerabilities":[{"id":"CVE-2025-52999","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52999","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-52999","date":"2026-11-02","epss":0.00772,"percentile":0.55679}],"urls":["https://github.com/FasterXML/jackson-core/pull/943","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52999","description":"jackson-core contains core low-level incremental (\"streaming\") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources."}]},{"artifact":{"id":"4d5407177cb8d0dd","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.30"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84782","versionConstraint":"< 3.0.2-0ubuntu1.30 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.30"],"available":[{"date":"2026-09-29","kind":"advisory","version":"3.0.2-0ubuntu1.30"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-11-02","epss":0.00831,"percentile":0.57589}],"risk":0.62325,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84782"},"relatedVulnerabilities":[{"id":"CVE-2026-84782","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-11-02","epss":0.00831,"percentile":0.57589}],"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"1014a67cbf322356","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.30"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84782","versionConstraint":"< 3.0.2-0ubuntu1.30 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.30"],"available":[{"date":"2026-09-29","kind":"advisory","version":"3.0.2-0ubuntu1.30"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-11-02","epss":0.00831,"percentile":0.57589}],"risk":0.62325,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84782"},"relatedVulnerabilities":[{"id":"CVE-2026-84782","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-11-02","epss":0.00831,"percentile":0.57589}],"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"05335dcf368b3f4b","cpes":["cpe:2.3:a:apache:log4j-core:2.17.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.17.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.17.2:*:*:*:*:*:*:*"],"name":"log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2","type":"java-archive","version":"2.17.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.logging.log4j","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:org.apache.logging.log4j:log4j-core","manifestName":"","pomArtifactID":"log4j-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.25.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3pxv-7cmr-fjr4","versionConstraint":">=2.0-alpha1,<2.25.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.17.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3pxv-7cmr-fjr4","fix":{"state":"fixed","versions":["2.25.4"],"available":[{"date":"2026-04-11","kind":"first-observed","version":"2.25.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34480","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-34480","date":"2026-11-02","epss":0.01046,"percentile":0.64178}],"risk":0.6223700000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-34480","https://github.com/apache/logging-log4j2/pull/4077","https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout","https://logging.apache.org/security.html#CVE-2026-34480","http://www.openwall.com/lists/oss-security/2026/04/10/9"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3pxv-7cmr-fjr4","description":"Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters"},"relatedVulnerabilities":[{"id":"CVE-2026-34480","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34480","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-34480","date":"2026-11-02","epss":0.01046,"percentile":0.64178}],"urls":["https://github.com/apache/logging-log4j2/pull/4077","https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout","https://logging.apache.org/security.html#CVE-2026-34480","http://www.openwall.com/lists/oss-security/2026/04/10/9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34480","description":"Apache Log4j Core's  XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets  producing invalid XML output whenever a log message or MDC value contains such characters.\n\nThe impact depends on the StAX implementation in use:\n\n  *  JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.\n  *  Alternative StAX implementations (e.g.,  Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.\n\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output."}]},{"artifact":{"id":"b02bab32ef44b63e","cpes":["cpe:2.3:a:apache:log4j-core:2.18.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.18.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.18.0:*:*:*:*:*:*:*"],"name":"log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0","type":"java-archive","version":"2.18.0","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.logging.log4j","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar:org.apache.logging.log4j:log4j-core","manifestName":"","pomArtifactID":"log4j-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.25.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3pxv-7cmr-fjr4","versionConstraint":">=2.0-alpha1,<2.25.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.18.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3pxv-7cmr-fjr4","fix":{"state":"fixed","versions":["2.25.4"],"available":[{"date":"2026-04-11","kind":"first-observed","version":"2.25.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34480","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-34480","date":"2026-11-02","epss":0.01046,"percentile":0.64178}],"risk":0.6223700000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-34480","https://github.com/apache/logging-log4j2/pull/4077","https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout","https://logging.apache.org/security.html#CVE-2026-34480","http://www.openwall.com/lists/oss-security/2026/04/10/9"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3pxv-7cmr-fjr4","description":"Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters"},"relatedVulnerabilities":[{"id":"CVE-2026-34480","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34480","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-34480","date":"2026-11-02","epss":0.01046,"percentile":0.64178}],"urls":["https://github.com/apache/logging-log4j2/pull/4077","https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout","https://logging.apache.org/security.html#CVE-2026-34480","http://www.openwall.com/lists/oss-security/2026/04/10/9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34480","description":"Apache Log4j Core's  XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets  producing invalid XML output whenever a log message or MDC value contains such characters.\n\nThe impact depends on the StAX implementation in use:\n\n  *  JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.\n  *  Alternative StAX implementations (e.g.,  Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.\n\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output."}]},{"artifact":{"id":"57dff2c200851b6e","cpes":["cpe:2.3:a:apache:log4j-core:2.19.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.19.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.19.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:2.19.0:*:*:*:*:*:*:*"],"name":"log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0","type":"java-archive","version":"2.19.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.logging.log4j","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.logging.log4j_log4j-core-2.19.0.jar","manifestName":"","pomArtifactID":"log4j-core","archiveDigests":[{"value":"3b6eeb4de4c49c0fe38a4ee27188ff5fee44d0bb","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.logging.log4j_log4j-core-2.19.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.logging.log4j_log4j-core-2.19.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.25.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3pxv-7cmr-fjr4","versionConstraint":">=2.0-alpha1,<2.25.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.19.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3pxv-7cmr-fjr4","fix":{"state":"fixed","versions":["2.25.4"],"available":[{"date":"2026-04-11","kind":"first-observed","version":"2.25.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34480","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-34480","date":"2026-11-02","epss":0.01046,"percentile":0.64178}],"risk":0.6223700000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-34480","https://github.com/apache/logging-log4j2/pull/4077","https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout","https://logging.apache.org/security.html#CVE-2026-34480","http://www.openwall.com/lists/oss-security/2026/04/10/9"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3pxv-7cmr-fjr4","description":"Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters"},"relatedVulnerabilities":[{"id":"CVE-2026-34480","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34480","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-34480","date":"2026-11-02","epss":0.01046,"percentile":0.64178}],"urls":["https://github.com/apache/logging-log4j2/pull/4077","https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout","https://logging.apache.org/security.html#CVE-2026-34480","http://www.openwall.com/lists/oss-security/2026/04/10/9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34480","description":"Apache Log4j Core's  XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets  producing invalid XML output whenever a log message or MDC value contains such characters.\n\nThe impact depends on the StAX implementation in use:\n\n  *  JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.\n  *  Alternative StAX implementations (e.g.,  Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.\n\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output."}]},{"artifact":{"id":"df642c8f2e021107","cpes":["cpe:2.3:a:apache:log4j-core:2.19.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.19.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.19.0:*:*:*:*:*:*:*"],"name":"log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0","type":"java-archive","version":"2.19.0","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.logging.log4j","virtualPath":"/opt/atlassian/confluence/bin/synchrony-proxy-watchdog.jar:org.apache.logging.log4j:log4j-core","manifestName":"","pomArtifactID":"log4j-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/synchrony-proxy-watchdog.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/synchrony-proxy-watchdog.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.25.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3pxv-7cmr-fjr4","versionConstraint":">=2.0-alpha1,<2.25.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.19.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3pxv-7cmr-fjr4","fix":{"state":"fixed","versions":["2.25.4"],"available":[{"date":"2026-04-11","kind":"first-observed","version":"2.25.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34480","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-34480","date":"2026-11-02","epss":0.01046,"percentile":0.64178}],"risk":0.6223700000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-34480","https://github.com/apache/logging-log4j2/pull/4077","https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout","https://logging.apache.org/security.html#CVE-2026-34480","http://www.openwall.com/lists/oss-security/2026/04/10/9"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3pxv-7cmr-fjr4","description":"Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters"},"relatedVulnerabilities":[{"id":"CVE-2026-34480","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34480","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-34480","date":"2026-11-02","epss":0.01046,"percentile":0.64178}],"urls":["https://github.com/apache/logging-log4j2/pull/4077","https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout","https://logging.apache.org/security.html#CVE-2026-34480","http://www.openwall.com/lists/oss-security/2026/04/10/9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34480","description":"Apache Log4j Core's  XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets  producing invalid XML output whenever a log message or MDC value contains such characters.\n\nThe impact depends on the StAX implementation in use:\n\n  *  JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.\n  *  Alternative StAX implementations (e.g.,  Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.\n\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.27"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-21587","versionConstraint":"< 1.8.0_452||>= 1.9, < 8.0.452||>= 12, < 17.0.15||>= 18, < 21.0.7||>= 22, < 24.0.1||>= 9, < 11.0.27 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-21587","fix":{"state":"fixed","versions":["1.8.0_452","8.0.452","11.0.27","17.0.15","21.0.7","24.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_452"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.452"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.15"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.7"},{"date":"2025-09-04","kind":"first-observed","version":"24.0.1"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.27"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-21587","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-21587","date":"2026-11-02","epss":0.00833,"percentile":0.57644}],"risk":0.620585,"urls":["https://www.oracle.com/security-alerts/cpuapr2025.html","https://lists.debian.org/debian-lts-announce/2025/05/msg00026.html","https://security.netapp.com/advisory/ntap-20250502-0005/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-21587","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE:8u441, 8u441-perf, 11.0.26, 17.0.14, 21.0.6, 24; Oracle GraalVM for JDK:17.0.14, 21.0.6, 24; Oracle GraalVM Enterprise Edition:20.3.17 and  21.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed06e31ab89c5a4d","cpes":["cpe:2.3:a:ion-java:ion-java:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:ion-java:ion_java:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:ion_java:ion-java:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:ion_java:ion_java:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:ion:ion-java:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:ion:ion_java:1.0.2:*:*:*:*:*:*:*"],"name":"ion-java","purl":"pkg:maven/software.amazon.ion/ion-java@1.0.2","type":"java-archive","version":"1.0.2","language":"java","licenses":["The Apache License, Version 2.0"],"metadata":{"pomGroupID":"software.amazon.ion","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar:software.amazon.ion:ion-java","manifestName":"","pomArtifactID":"ion-java","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-264p-99wq-f4j6","versionConstraint":"<1.10.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"software.amazon.ion:ion-java","version":"1.0.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-264p-99wq-f4j6","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21634","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-21634","date":"2026-11-02","epss":0.00827,"percentile":0.57462}],"risk":0.62025,"urls":["https://github.com/amazon-ion/ion-java/security/advisories/GHSA-264p-99wq-f4j6","https://nvd.nist.gov/vuln/detail/CVE-2024-21634","https://security.netapp.com/advisory/ntap-20241108-0002"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-264p-99wq-f4j6","description":"Ion Java StackOverflow vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-21634","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21634","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-21634","date":"2026-11-02","epss":0.00827,"percentile":0.57462}],"urls":["https://github.com/amazon-ion/ion-java/security/advisories/GHSA-264p-99wq-f4j6","https://security.netapp.com/advisory/ntap-20241108-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21634","description":"Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in `ion-java` for applications that use `ion-java` to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the `IonValue` model and then invoke certain `IonValue` methods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using the `IonValue` model, results in a `StackOverflowError` originating from the `ion-java` library. The patch is included in `ion-java` 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with."}]},{"artifact":{"id":"b400511196d0cd9e","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-57rv-r2g8-2cj3","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-57rv-r2g8-2cj3","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-11-02","epss":0.00838,"percentile":0.57777}],"risk":0.62012,"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://nvd.nist.gov/vuln/detail/CVE-2026-42584"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-57rv-r2g8-2cj3","description":"Netty has HttpClientCodec response desynchronization"},"relatedVulnerabilities":[{"id":"CVE-2026-42584","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-11-02","epss":0.00838,"percentile":0.57777}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42584","https://bugzilla.redhat.com/show_bug.cgi?id=2477224","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42584.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42584","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"0ae96c8bb001b7ff","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-57rv-r2g8-2cj3","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-57rv-r2g8-2cj3","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-11-02","epss":0.00838,"percentile":0.57777}],"risk":0.62012,"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://nvd.nist.gov/vuln/detail/CVE-2026-42584"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-57rv-r2g8-2cj3","description":"Netty has HttpClientCodec response desynchronization"},"relatedVulnerabilities":[{"id":"CVE-2026-42584","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-11-02","epss":0.00838,"percentile":0.57777}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42584","https://bugzilla.redhat.com/show_bug.cgi?id=2477224","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42584.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42584","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"41fd2c72127de89f","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-57rv-r2g8-2cj3","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-57rv-r2g8-2cj3","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-11-02","epss":0.00838,"percentile":0.57777}],"risk":0.62012,"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://nvd.nist.gov/vuln/detail/CVE-2026-42584"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-57rv-r2g8-2cj3","description":"Netty has HttpClientCodec response desynchronization"},"relatedVulnerabilities":[{"id":"CVE-2026-42584","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-11-02","epss":0.00838,"percentile":0.57777}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42584","https://bugzilla.redhat.com/show_bug.cgi?id=2477224","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42584.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42584","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"f02275b79327efaf","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33600","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33600","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33600","cwe":"CWE-476","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33600","date":"2026-11-02","epss":0.01216,"percentile":0.68595}],"risk":0.608,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33600"},"relatedVulnerabilities":[{"id":"CVE-2024-33600","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33600","cwe":"CWE-476","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33600","date":"2026-11-02","epss":0.01216,"percentile":0.68595}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0013/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0006","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33600","description":"nscd: Null pointer crashes after notfound response\n\nIf the Name Service Cache Daemon's (nscd) cache fails to add a not-found\nnetgroup response to the cache, the client request can result in a null\npointer dereference.  This flaw was introduced in glibc 2.15 when the\ncache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"8da7e53d1801cfa5","cpes":["cpe:2.3:a:libc6:libc6:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33600","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33600","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33600","cwe":"CWE-476","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33600","date":"2026-11-02","epss":0.01216,"percentile":0.68595}],"risk":0.608,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33600"},"relatedVulnerabilities":[{"id":"CVE-2024-33600","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33600","cwe":"CWE-476","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33600","date":"2026-11-02","epss":0.01216,"percentile":0.68595}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0013/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0006","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33600","description":"nscd: Null pointer crashes after notfound response\n\nIf the Name Service Cache Daemon's (nscd) cache fails to add a not-found\nnetgroup response to the cache, the client request can result in a null\npointer dereference.  This flaw was introduced in glibc 2.15 when the\ncache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"a88b7869c938a730","cpes":["cpe:2.3:a:locales:locales:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/ubuntu/locales@2.35-0ubuntu3.6?arch=all&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33600","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33600","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33600","cwe":"CWE-476","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33600","date":"2026-11-02","epss":0.01216,"percentile":0.68595}],"risk":0.608,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33600"},"relatedVulnerabilities":[{"id":"CVE-2024-33600","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33600","cwe":"CWE-476","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33600","date":"2026-11-02","epss":0.01216,"percentile":0.68595}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0013/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0006","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33600","description":"nscd: Null pointer crashes after notfound response\n\nIf the Name Service Cache Daemon's (nscd) cache fails to add a not-found\nnetgroup response to the cache, the client request can result in a null\npointer dereference.  This flaw was introduced in glibc 2.15 when the\ncache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"91181cefcfea5284","cpes":["cpe:2.3:a:libldap-2.5-0:libldap-2.5-0:2.5.16\\+dfsg-0ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.5-0:libldap_2.5_0:2.5.16\\+dfsg-0ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.5_0:libldap-2.5-0:2.5.16\\+dfsg-0ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.5_0:libldap_2.5_0:2.5.16\\+dfsg-0ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.5:libldap-2.5-0:2.5.16\\+dfsg-0ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.5:libldap_2.5_0:2.5.16\\+dfsg-0ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.5:libldap-2.5-0:2.5.16\\+dfsg-0ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.5:libldap_2.5_0:2.5.16\\+dfsg-0ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.5-0:2.5.16\\+dfsg-0ubuntu0.22.04.1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.5_0:2.5.16\\+dfsg-0ubuntu0.22.04.1:*:*:*:*:*:*:*"],"name":"libldap-2.5-0","purl":"pkg:deb/ubuntu/libldap-2.5-0@2.5.16%2Bdfsg-0ubuntu0.22.04.1?arch=amd64&distro=ubuntu-22.04&upstream=openldap","type":"deb","version":"2.5.16+dfsg-0ubuntu0.22.04.1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.5-0/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libldap-2.5-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.5-0:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libldap-2.5-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.5.16+dfsg-0ubuntu0.22.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-2953","versionConstraint":"< 2.5.16+dfsg-0ubuntu0.22.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openldap","version":"2.5.16+dfsg-0ubuntu0.22.04.1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-2953","fix":{"state":"fixed","versions":["2.5.16+dfsg-0ubuntu0.22.04.2"],"available":[{"date":"2024-01-30","kind":"advisory","version":"2.5.16+dfsg-0ubuntu0.22.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2023-2953","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-2953","cwe":"CWE-476","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2953","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2953","date":"2026-11-02","epss":0.01999,"percentile":0.80741}],"risk":0.5997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-2953"},"relatedVulnerabilities":[{"id":"CVE-2023-2953","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-2953","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-2953","cwe":"CWE-476","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2953","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2953","date":"2026-11-02","epss":0.01999,"percentile":0.80741}],"urls":["http://seclists.org/fulldisclosure/2023/Jul/47","http://seclists.org/fulldisclosure/2023/Jul/48","http://seclists.org/fulldisclosure/2023/Jul/52","https://access.redhat.com/security/cve/CVE-2023-2953","https://bugs.openldap.org/show_bug.cgi?id=9904","https://security.netapp.com/advisory/ntap-20230703-0005/","https://support.apple.com/kb/HT213843","https://support.apple.com/kb/HT213844","https://support.apple.com/kb/HT213845","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-806742.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-2953","description":"A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function."}]},{"artifact":{"id":"7f5afd36e2a50847","cpes":["cpe:2.3:a:curl:curl:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.19"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-9681","versionConstraint":"< 7.81.0-1ubuntu1.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-9681","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.19"],"available":[{"date":"2024-11-18","kind":"advisory","version":"7.81.0-1ubuntu1.19"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-9681","cwe":"CWE-697","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-9681","date":"2026-11-02","epss":0.01987,"percentile":0.80618}],"risk":0.5961,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9681"},"relatedVulnerabilities":[{"id":"CVE-2024-9681","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9681","cwe":"CWE-697","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-9681","date":"2026-11-02","epss":0.01987,"percentile":0.80618}],"urls":["https://curl.se/docs/CVE-2024-9681.html","https://curl.se/docs/CVE-2024-9681.json","https://hackerone.com/reports/2764830","http://seclists.org/fulldisclosure/2025/Apr/10","http://seclists.org/fulldisclosure/2025/Apr/11","http://seclists.org/fulldisclosure/2025/Apr/12","http://seclists.org/fulldisclosure/2025/Apr/13","http://seclists.org/fulldisclosure/2025/Apr/4","http://seclists.org/fulldisclosure/2025/Apr/5","http://seclists.org/fulldisclosure/2025/Apr/8","http://seclists.org/fulldisclosure/2025/Apr/9","http://www.openwall.com/lists/oss-security/2024/11/06/2","https://security.netapp.com/advisory/ntap-20241213-0006/","https://github.com/curl/curl/commit/7385610d0c74c6a25","https://github.com/curl/curl/commit/a94973805df96269bf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9681","description":"When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain's cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl's HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent's entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended."}]},{"artifact":{"id":"eebde1772607afd6","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.19"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-9681","versionConstraint":"< 7.81.0-1ubuntu1.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-9681","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.19"],"available":[{"date":"2024-11-18","kind":"advisory","version":"7.81.0-1ubuntu1.19"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-9681","cwe":"CWE-697","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-9681","date":"2026-11-02","epss":0.01987,"percentile":0.80618}],"risk":0.5961,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9681"},"relatedVulnerabilities":[{"id":"CVE-2024-9681","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9681","cwe":"CWE-697","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-9681","date":"2026-11-02","epss":0.01987,"percentile":0.80618}],"urls":["https://curl.se/docs/CVE-2024-9681.html","https://curl.se/docs/CVE-2024-9681.json","https://hackerone.com/reports/2764830","http://seclists.org/fulldisclosure/2025/Apr/10","http://seclists.org/fulldisclosure/2025/Apr/11","http://seclists.org/fulldisclosure/2025/Apr/12","http://seclists.org/fulldisclosure/2025/Apr/13","http://seclists.org/fulldisclosure/2025/Apr/4","http://seclists.org/fulldisclosure/2025/Apr/5","http://seclists.org/fulldisclosure/2025/Apr/8","http://seclists.org/fulldisclosure/2025/Apr/9","http://www.openwall.com/lists/oss-security/2024/11/06/2","https://security.netapp.com/advisory/ntap-20241213-0006/","https://github.com/curl/curl/commit/7385610d0c74c6a25","https://github.com/curl/curl/commit/a94973805df96269bf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9681","description":"When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain's cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl's HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent's entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended."}]},{"artifact":{"id":"7f5afd36e2a50847","cpes":["cpe:2.3:a:curl:curl:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.20"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-11053","versionConstraint":"< 7.81.0-1ubuntu1.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-11053","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.20"],"available":[{"date":"2024-12-16","kind":"advisory","version":"7.81.0-1ubuntu1.20"}]},"cvss":[],"epss":[{"cve":"CVE-2024-11053","date":"2026-11-02","epss":0.01966,"percentile":0.80366}],"risk":0.5898,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-11053"},"relatedVulnerabilities":[{"id":"CVE-2024-11053","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-11-02","epss":0.01966,"percentile":0.80366}],"urls":["https://curl.se/docs/CVE-2024-11053.html","https://curl.se/docs/CVE-2024-11053.json","https://hackerone.com/reports/2829063","http://www.openwall.com/lists/oss-security/2024/12/11/1","https://security.netapp.com/advisory/ntap-20250124-0012/","https://security.netapp.com/advisory/ntap-20250131-0003/","https://security.netapp.com/advisory/ntap-20250131-0004/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-212953.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11053","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password."}]},{"artifact":{"id":"eebde1772607afd6","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.20"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11053","versionConstraint":"< 7.81.0-1ubuntu1.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-11053","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.20"],"available":[{"date":"2024-12-16","kind":"advisory","version":"7.81.0-1ubuntu1.20"}]},"cvss":[],"epss":[{"cve":"CVE-2024-11053","date":"2026-11-02","epss":0.01966,"percentile":0.80366}],"risk":0.5898,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-11053"},"relatedVulnerabilities":[{"id":"CVE-2024-11053","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-11-02","epss":0.01966,"percentile":0.80366}],"urls":["https://curl.se/docs/CVE-2024-11053.html","https://curl.se/docs/CVE-2024-11053.json","https://hackerone.com/reports/2829063","http://www.openwall.com/lists/oss-security/2024/12/11/1","https://security.netapp.com/advisory/ntap-20250124-0012/","https://security.netapp.com/advisory/ntap-20250131-0003/","https://security.netapp.com/advisory/ntap-20250131-0004/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-212953.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11053","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.28"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-50106","versionConstraint":"< 1.8.0_462||>= 1.9, < 8.0.462||>= 12, < 17.0.16||>= 18, < 21.0.8||>= 22, < 24.0.2||>= 9, < 11.0.28 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-50106","fix":{"state":"fixed","versions":["1.8.0_462","8.0.462","11.0.28","17.0.16","21.0.8","24.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_462"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.462"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.16"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.8"},{"date":"2025-09-04","kind":"first-observed","version":"24.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.28"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-50106","date":"2026-11-02","epss":0.00751,"percentile":0.54998}],"risk":0.5857800000000001,"urls":["https://www.oracle.com/security-alerts/cpujul2025.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00014.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50106","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and  24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."},"relatedVulnerabilities":[]},{"artifact":{"id":"a7889115aa3b75ad","cpes":["cpe:2.3:a:apache:httpcore5:5.1.3:*:*:*:*:*:*:*","cpe:2.3:a:apache:core5:5.1.3:*:*:*:*:*:*:*"],"name":"httpcore5","purl":"pkg:maven/org.apache.httpcomponents.core5/httpcore5@5.1.3","type":"java-archive","version":"5.1.3","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.httpcomponents.core5","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.streams.streams-aggregator-plugin-9.1.36.jar:org.apache.httpcomponents.core5:httpcore5","manifestName":"","pomArtifactID":"httpcore5","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.streams.streams-aggregator-plugin-9.1.36.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.streams.streams-aggregator-plugin-9.1.36.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.4.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hf6x-8p5f-cgmf","versionConstraint":"<5.4.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents.core5:httpcore5","version":"5.1.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hf6x-8p5f-cgmf","fix":{"state":"fixed","versions":["5.4.3"],"available":[{"date":"2026-08-13","kind":"first-observed","version":"5.4.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54399","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54399","date":"2026-11-02","epss":0.00779,"percentile":0.55905}],"risk":0.58425,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-54399","https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy","http://www.openwall.com/lists/oss-security/2026/07/01/4","https://github.com/apache/httpcomponents-core/commit/d96a00fec9b2e19f8005e35681df5f6cd6e21a9e","https://github.com/apache/httpcomponents-core/commit/fdc53a32fe0fccf098cc67e71cd125e447c759ed"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hf6x-8p5f-cgmf","description":"Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service"},"relatedVulnerabilities":[{"id":"CVE-2026-54399","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54399","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54399","date":"2026-11-02","epss":0.00779,"percentile":0.55905}],"urls":["https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy","http://www.openwall.com/lists/oss-security/2026/07/01/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54399","description":"Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length"}]},{"artifact":{"id":"e0329d1ef96ae2fa","cpes":["cpe:2.3:a:apache:httpcore5:5.1.3:*:*:*:*:*:*:*","cpe:2.3:a:apache:core5:5.1.3:*:*:*:*:*:*:*"],"name":"httpcore5","purl":"pkg:maven/org.apache.httpcomponents.core5/httpcore5@5.1.3","type":"java-archive","version":"5.1.3","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.httpcomponents.core5","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.streams.streams-core-plugin-9.1.36.jar:org.apache.httpcomponents.core5:httpcore5","manifestName":"","pomArtifactID":"httpcore5","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.streams.streams-core-plugin-9.1.36.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.streams.streams-core-plugin-9.1.36.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.4.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hf6x-8p5f-cgmf","versionConstraint":"<5.4.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents.core5:httpcore5","version":"5.1.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hf6x-8p5f-cgmf","fix":{"state":"fixed","versions":["5.4.3"],"available":[{"date":"2026-08-13","kind":"first-observed","version":"5.4.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54399","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54399","date":"2026-11-02","epss":0.00779,"percentile":0.55905}],"risk":0.58425,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-54399","https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy","http://www.openwall.com/lists/oss-security/2026/07/01/4","https://github.com/apache/httpcomponents-core/commit/d96a00fec9b2e19f8005e35681df5f6cd6e21a9e","https://github.com/apache/httpcomponents-core/commit/fdc53a32fe0fccf098cc67e71cd125e447c759ed"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hf6x-8p5f-cgmf","description":"Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service"},"relatedVulnerabilities":[{"id":"CVE-2026-54399","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54399","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54399","date":"2026-11-02","epss":0.00779,"percentile":0.55905}],"urls":["https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy","http://www.openwall.com/lists/oss-security/2026/07/01/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54399","description":"Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length"}]},{"artifact":{"id":"36b37877bd447472","cpes":["cpe:2.3:a:apache:httpcore5:5.2.3:*:*:*:*:*:*:*","cpe:2.3:a:apache:core5:5.2.3:*:*:*:*:*:*:*"],"name":"httpcore5","purl":"pkg:maven/org.apache.httpcomponents.core5/httpcore5@5.2.3","type":"java-archive","version":"5.2.3","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.httpcomponents.core5","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.httpcomponents.core5_httpcore5-5.2.3.jar","manifestName":"","pomArtifactID":"httpcore5","archiveDigests":[{"value":"687cede1a44f70c7741abfab6ee2aa53dd2bfb54","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.httpcomponents.core5_httpcore5-5.2.3.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.httpcomponents.core5_httpcore5-5.2.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.4.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hf6x-8p5f-cgmf","versionConstraint":"<5.4.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents.core5:httpcore5","version":"5.2.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hf6x-8p5f-cgmf","fix":{"state":"fixed","versions":["5.4.3"],"available":[{"date":"2026-08-13","kind":"first-observed","version":"5.4.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54399","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54399","date":"2026-11-02","epss":0.00779,"percentile":0.55905}],"risk":0.58425,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-54399","https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy","http://www.openwall.com/lists/oss-security/2026/07/01/4","https://github.com/apache/httpcomponents-core/commit/d96a00fec9b2e19f8005e35681df5f6cd6e21a9e","https://github.com/apache/httpcomponents-core/commit/fdc53a32fe0fccf098cc67e71cd125e447c759ed"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hf6x-8p5f-cgmf","description":"Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service"},"relatedVulnerabilities":[{"id":"CVE-2026-54399","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54399","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54399","date":"2026-11-02","epss":0.00779,"percentile":0.55905}],"urls":["https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy","http://www.openwall.com/lists/oss-security/2026/07/01/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54399","description":"Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length"}]},{"artifact":{"id":"ce9fdc60e38c28ae","cpes":["cpe:2.3:a:apache:httpcore5:5.2.3:*:*:*:*:*:*:*","cpe:2.3:a:apache:core5:5.2.3:*:*:*:*:*:*:*"],"name":"httpcore5","purl":"pkg:maven/org.apache.httpcomponents.core5/httpcore5@5.2.3","type":"java-archive","version":"5.2.3","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.httpcomponents.core5","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar:META-INF/lib/httpcore5-5.2.3.jar","manifestName":"","pomArtifactID":"httpcore5","archiveDigests":[{"value":"687cede1a44f70c7741abfab6ee2aa53dd2bfb54","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar:META-INF/lib/httpcore5-5.2.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.4.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hf6x-8p5f-cgmf","versionConstraint":"<5.4.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents.core5:httpcore5","version":"5.2.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hf6x-8p5f-cgmf","fix":{"state":"fixed","versions":["5.4.3"],"available":[{"date":"2026-08-13","kind":"first-observed","version":"5.4.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54399","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54399","date":"2026-11-02","epss":0.00779,"percentile":0.55905}],"risk":0.58425,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-54399","https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy","http://www.openwall.com/lists/oss-security/2026/07/01/4","https://github.com/apache/httpcomponents-core/commit/d96a00fec9b2e19f8005e35681df5f6cd6e21a9e","https://github.com/apache/httpcomponents-core/commit/fdc53a32fe0fccf098cc67e71cd125e447c759ed"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hf6x-8p5f-cgmf","description":"Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service"},"relatedVulnerabilities":[{"id":"CVE-2026-54399","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54399","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54399","date":"2026-11-02","epss":0.00779,"percentile":0.55905}],"urls":["https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy","http://www.openwall.com/lists/oss-security/2026/07/01/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54399","description":"Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length"}]},{"artifact":{"id":"4ec54bcef774f9c5","cpes":["cpe:2.3:a:apache:httpcore5:5.2.3:*:*:*:*:*:*:*","cpe:2.3:a:apache:core5:5.2.3:*:*:*:*:*:*:*"],"name":"httpcore5","purl":"pkg:maven/org.apache.httpcomponents.core5/httpcore5@5.2.3","type":"java-archive","version":"5.2.3","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.httpcomponents.core5","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-business-blueprints-18.7.17.jar:META-INF/lib/httpcore5-5.2.3.jar","manifestName":"","pomArtifactID":"httpcore5","archiveDigests":[{"value":"687cede1a44f70c7741abfab6ee2aa53dd2bfb54","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-business-blueprints-18.7.17.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-business-blueprints-18.7.17.jar:META-INF/lib/httpcore5-5.2.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.4.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hf6x-8p5f-cgmf","versionConstraint":"<5.4.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents.core5:httpcore5","version":"5.2.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hf6x-8p5f-cgmf","fix":{"state":"fixed","versions":["5.4.3"],"available":[{"date":"2026-08-13","kind":"first-observed","version":"5.4.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54399","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54399","date":"2026-11-02","epss":0.00779,"percentile":0.55905}],"risk":0.58425,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-54399","https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy","http://www.openwall.com/lists/oss-security/2026/07/01/4","https://github.com/apache/httpcomponents-core/commit/d96a00fec9b2e19f8005e35681df5f6cd6e21a9e","https://github.com/apache/httpcomponents-core/commit/fdc53a32fe0fccf098cc67e71cd125e447c759ed"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hf6x-8p5f-cgmf","description":"Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service"},"relatedVulnerabilities":[{"id":"CVE-2026-54399","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54399","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54399","date":"2026-11-02","epss":0.00779,"percentile":0.55905}],"urls":["https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy","http://www.openwall.com/lists/oss-security/2026/07/01/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54399","description":"Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length"}]},{"artifact":{"id":"4cff8f4910aa2cbd","cpes":["cpe:2.3:a:apache:httpcore5:5.2.3:*:*:*:*:*:*:*","cpe:2.3:a:apache:core5:5.2.3:*:*:*:*:*:*:*"],"name":"httpcore5","purl":"pkg:maven/org.apache.httpcomponents.core5/httpcore5@5.2.3","type":"java-archive","version":"5.2.3","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.httpcomponents.core5","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.team-calendars.team-calendars-18.7.6.jar:org.apache.httpcomponents.core5:httpcore5","manifestName":"","pomArtifactID":"httpcore5","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.team-calendars.team-calendars-18.7.6.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.team-calendars.team-calendars-18.7.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.4.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hf6x-8p5f-cgmf","versionConstraint":"<5.4.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents.core5:httpcore5","version":"5.2.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hf6x-8p5f-cgmf","fix":{"state":"fixed","versions":["5.4.3"],"available":[{"date":"2026-08-13","kind":"first-observed","version":"5.4.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54399","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54399","date":"2026-11-02","epss":0.00779,"percentile":0.55905}],"risk":0.58425,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-54399","https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy","http://www.openwall.com/lists/oss-security/2026/07/01/4","https://github.com/apache/httpcomponents-core/commit/d96a00fec9b2e19f8005e35681df5f6cd6e21a9e","https://github.com/apache/httpcomponents-core/commit/fdc53a32fe0fccf098cc67e71cd125e447c759ed"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hf6x-8p5f-cgmf","description":"Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service"},"relatedVulnerabilities":[{"id":"CVE-2026-54399","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54399","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54399","date":"2026-11-02","epss":0.00779,"percentile":0.55905}],"urls":["https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy","http://www.openwall.com/lists/oss-security/2026/07/01/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54399","description":"Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length"}]},{"artifact":{"id":"a8f1f07e02daddd2","cpes":["cpe:2.3:a:org.springframework:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring_webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring_webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_webmvc:5.3.30:*:*:*:*:*:*:*"],"name":"spring-webmvc","purl":"pkg:maven/org.springframework/spring-webmvc@5.3.30","type":"java-archive","version":"5.3.30","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-webmvc-5.3.30.jar","manifestName":"","pomArtifactID":"spring-webmvc","archiveDigests":[{"value":"67ad9ebc6189c91942a52328f58d824cd3171fd9","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-webmvc-5.3.30.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-webmvc-5.3.30.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pc63-qcmh-9cmg","versionConstraint":">=5.3.0,<=5.3.49 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-webmvc","version":"5.3.30"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pc63-qcmh-9cmg","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47884","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47884","date":"2026-11-02","epss":0.00605,"percentile":0.48942}],"risk":0.5687,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-47884","https://spring.io/security/cve-2026-47884","https://github.com/spring-projects/spring-framework/commit/692dbc9160de3b5de50ccedeee014716d0cedb7b"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pc63-qcmh-9cmg","description":"Spring Framework Improper Path Limitation in XsltView"},"relatedVulnerabilities":[{"id":"CVE-2026-47884","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47884","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47884","date":"2026-11-02","epss":0.00605,"percentile":0.48942}],"urls":["https://spring.io/security/cve-2026-47884"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47884","description":"Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an \"/**\" mapping that results in view rendering, and where the view name is not explicitly specified.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19\nSpring Framework 6.1.0 - 6.1.28\nSpring Framework 6.0.0 - 6.0.30\nSpring Framework 5.3.0 - 5.3.49\nSpring Framework 5.2.25.RELEASE and earlier"}]},{"artifact":{"id":"3058891d9c69e832","cpes":["cpe:2.3:a:com.atlassian.confluence:confluence:8.7.2:*:*:*:*:*:*:*","cpe:2.3:a:confluence:confluence:8.7.2:*:*:*:*:*:*:*","cpe:2.3:a:atlassian:confluence:8.7.2:*:*:*:*:*:*:*"],"name":"confluence","purl":"pkg:maven/com.atlassian.confluence/confluence@8.7.2","type":"java-archive","version":"8.7.2","language":"java","licenses":[],"metadata":{"pomGroupID":"com.atlassian.confluence","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","manifestName":"","pomArtifactID":"confluence","archiveDigests":[{"value":"afaf3eba1f92068ba7584de95e3aafadc7dc66c5","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.9.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-21690","versionConstraint":">= 4.3, < 7.19.26||>= 7.20, < 8.5.14||>= 8.6, < 8.9.5||>= 9.0, < 9.0.1 (maven)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.atlassian.confluence:confluence","version":"8.7.2"},"language":"java","namespace":"nvd:language:java"}}],"vulnerability":{"id":"CVE-2024-21690","fix":{"state":"fixed","versions":["7.19.26","8.5.14","8.9.5","9.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"7.19.26"},{"date":"2025-09-04","kind":"first-observed","version":"8.5.14"},{"date":"2025-09-04","kind":"first-observed","version":"8.9.5"},{"date":"2025-09-04","kind":"first-observed","version":"9.0.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@atlassian.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21690","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-21690","date":"2026-11-02","epss":0.00748,"percentile":0.54904}],"risk":0.56661,"urls":["https://confluence.atlassian.com/pages/viewpage.action?pageId=1431535667","https://jira.atlassian.com/browse/CONFSERVER-97720"],"severity":"High","namespace":"nvd:language:java","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21690","description":"This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.1, 8.8.0, and 8.9.0 of Confluence Data Center and Server. \n\t\n\tThis Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability, with a CVSS Score of 7.1, allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser and force a end user to execute unwanted actions on a web application in which they're currently authenticated which has high impact to confidentiality, low impact to integrity, no impact to availability, and requires user interaction. \n\t\n\tAtlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\n\t\t\n\t\t* Confluence Data Center and Server 7.19: Upgrade to a release greater than or equal to 7.19.26\n\t\t\n\t\t* Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.14\n\t\t\n\t\t* Confluence Data Center and Server 9.0: Upgrade to a release greater than or equal to 9.0.1\n\t\t\n\t\t\n\t\n\tSee the release notes (https://confluence.atlassian.com/doc/confluence-release-notes-327.html). You can download the latest version of Confluence Data Center and Server from the download center (https://www.atlassian.com/software/confluence/download-archives). \n\t\n\tThis vulnerability was reported via our Bug Bounty program."},"relatedVulnerabilities":[]},{"artifact":{"id":"af534de498eed696","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-45491","versionConstraint":"< 2.4.7-1ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-45491","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.4"],"available":[{"date":"2024-09-17","kind":"advisory","version":"2.4.7-1ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-45491","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45491","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45491","date":"2026-11-02","epss":0.0113,"percentile":0.66403}],"risk":0.565,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-45491"},"relatedVulnerabilities":[{"id":"CVE-2024-45491","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-45491","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45491","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45491","date":"2026-11-02","epss":0.0113,"percentile":0.66403}],"urls":["https://github.com/libexpat/libexpat/issues/888","https://github.com/libexpat/libexpat/pull/891","https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html","https://security.netapp.com/advisory/ntap-20241018-0003/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45491","description":"An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX)."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.22"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-20926","versionConstraint":"< 1.8.0_402||>= 1.9, < 8.0.402||>= 9, < 11.0.22 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-20926","fix":{"state":"fixed","versions":["1.8.0_402","8.0.402","11.0.22"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_402"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.402"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.22"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-20926","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-20926","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-20926","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-20926","date":"2026-11-02","epss":0.01035,"percentile":0.63868}],"risk":0.564075,"urls":["https://lists.debian.org/debian-lts-announce/2024/01/msg00023.html","https://security.netapp.com/advisory/ntap-20240201-0002/","https://www.oracle.com/security-alerts/cpujan2024.html","https://security.netapp.com/advisory/ntap-20241108-0002/","https://openjdk.org/groups/vulnerability/advisories/2024-01-16"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-20926","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting).  Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and  22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"321c95b881cad611","cpes":["cpe:2.3:a:org.eclipse.jetty:jetty-server:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_server:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty-server:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty_server:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty-server:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty_server:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-server:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_server:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-server:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_server:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:10.0.15:*:*:*:*:*:*:*"],"name":"jetty-server","purl":"pkg:maven/org.eclipse.jetty/jetty-server@10.0.15","type":"java-archive","version":"10.0.15","language":"java","licenses":[],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar:org.eclipse.jetty:jetty-server","manifestName":"","pomArtifactID":"jetty-server","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"10.0.24"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-g8m5-722r-8whq","versionConstraint":">=10.0.0,<=10.0.23 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-server","version":"10.0.15"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-g8m5-722r-8whq","fix":{"state":"fixed","versions":["10.0.24"],"available":[{"date":"2024-10-15","kind":"first-observed","version":"10.0.24"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8184","cwe":"CWE-400","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2024-8184","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-8184","date":"2026-11-02","epss":0.0103,"percentile":0.63718}],"risk":0.56135,"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-g8m5-722r-8whq","https://nvd.nist.gov/vuln/detail/CVE-2024-8184","https://github.com/jetty/jetty.project/pull/11723","https://gitlab.eclipse.org/security/cve-assignement/-/issues/30","https://lists.debian.org/debian-lts-announce/2025/04/msg00001.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-g8m5-722r-8whq","description":"Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks"},"relatedVulnerabilities":[{"id":"CVE-2024-8184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"emo@eclipse.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8184","cwe":"CWE-400","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2024-8184","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-8184","date":"2026-11-02","epss":0.0103,"percentile":0.63718}],"urls":["https://github.com/jetty/jetty.project/pull/11723","https://github.com/jetty/jetty.project/security/advisories/GHSA-g8m5-722r-8whq","https://gitlab.eclipse.org/security/cve-assignement/-/issues/30","https://lists.debian.org/debian-lts-announce/2025/04/msg00001.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8184","description":"There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack.  By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory."}]},{"artifact":{"id":"af534de498eed696","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-50602","versionConstraint":"< 2.4.7-1ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-50602","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.5"],"available":[{"date":"2024-12-10","kind":"advisory","version":"2.4.7-1ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-50602","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-50602","date":"2026-11-02","epss":0.01117,"percentile":0.66097}],"risk":0.5585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-50602"},"relatedVulnerabilities":[{"id":"CVE-2024-50602","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-50602","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-50602","date":"2026-11-02","epss":0.01117,"percentile":0.66097}],"urls":["https://github.com/libexpat/libexpat/pull/915","https://lists.debian.org/debian-lts-announce/2025/04/msg00040.html","https://security.netapp.com/advisory/ntap-20250404-0008/","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://docs.python.org/release/3.10.16/whatsnew/changelog.html","https://docs.python.org/release/3.11.11/whatsnew/changelog.html#python-3-11-11","https://docs.python.org/release/3.12.8/whatsnew/changelog.html#python-3-12-8","https://docs.python.org/release/3.13.1/whatsnew/changelog.html#python-3-13-1","https://docs.python.org/release/3.9.21/whatsnew/changelog.html","https://github.com/python/cpython/issues/126623"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-50602","description":"An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser."}]},{"artifact":{"id":"1f8e56f352643db0","cpes":["cpe:2.3:a:libtasn1-6:libtasn1-6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1-6:libtasn1_6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1-6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1_6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1-6:4.18.0-4build1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1_6:4.18.0-4build1:*:*:*:*:*:*:*"],"name":"libtasn1-6","purl":"pkg:deb/ubuntu/libtasn1-6@4.18.0-4build1?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"4.18.0-4build1","language":"","licenses":["sha256:88a94e40a34bb28145805747cad4018e7eb976b5fd0bf2329dedf90088ebc6e4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtasn1-6/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libtasn1-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.18.0-4ubuntu0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-12133","versionConstraint":"< 4.18.0-4ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libtasn1-6","version":"4.18.0-4build1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-12133","fix":{"state":"fixed","versions":["4.18.0-4ubuntu0.1"],"available":[{"date":"2025-02-18","kind":"advisory","version":"4.18.0-4ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-12133","cwe":"CWE-407","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-12133","date":"2026-11-02","epss":0.0111,"percentile":0.65925}],"risk":0.555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-12133"},"relatedVulnerabilities":[{"id":"CVE-2024-12133","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-12133","cwe":"CWE-407","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-12133","date":"2026-11-02","epss":0.0111,"percentile":0.65925}],"urls":["https://access.redhat.com/errata/RHSA-2025:17347","https://access.redhat.com/errata/RHSA-2025:4049","https://access.redhat.com/errata/RHSA-2025:7077","https://access.redhat.com/errata/RHSA-2025:8021","https://access.redhat.com/errata/RHSA-2025:8385","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/security/cve/CVE-2024-12133","https://bugzilla.redhat.com/show_bug.cgi?id=2344611","https://gitlab.com/gnutls/libtasn1/-/blob/master/doc/security/CVE-2024-12133.md","https://gitlab.com/gnutls/libtasn1/-/issues/52","http://www.openwall.com/lists/oss-security/2025/02/06/6","https://lists.debian.org/debian-lts-announce/2025/02/msg00025.html","https://security.netapp.com/advisory/ntap-20250523-0003/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-12133","description":"A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack."}]},{"artifact":{"id":"c0b145b45a6f9d3f","cpes":["cpe:2.3:a:wget:wget:1.21.2-2ubuntu1:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:deb/ubuntu/wget@1.21.2-2ubuntu1?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"1.21.2-2ubuntu1","language":"","licenses":["sha256:c58cb5a2d94f35f0e9b0f1a038d48b73477aa12782ff17328c21d8a86f5f99d5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/wget/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/wget/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/wget.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/wget.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/wget.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-31879","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"wget","version":"1.21.2-2ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2021-31879","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-31879","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31879","date":"2026-11-02","epss":0.01104,"percentile":0.65763}],"risk":0.5519999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-31879"},"relatedVulnerabilities":[{"id":"CVE-2021-31879","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-31879","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31879","date":"2026-11-02","epss":0.01104,"percentile":0.65763}],"urls":["https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html","https://security.netapp.com/advisory/ntap-20210618-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-31879","description":"GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-6923","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6923","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6923","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-6923","date":"2026-11-02","epss":0.011,"percentile":0.6567}],"risk":0.5499999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6923"},"relatedVulnerabilities":[{"id":"CVE-2024-6923","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.5,"impactScore":3.4,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6923","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-6923","date":"2026-11-02","epss":0.011,"percentile":0.6567}],"urls":["https://github.com/python/cpython/commit/06f28dc236708f72871c64d4bc4b4ea144c50147","https://github.com/python/cpython/commit/097633981879b3c9de9a1dd120d3aa585ecc2384","https://github.com/python/cpython/commit/4766d1200fdf8b6728137aa2927a297e224d5fa7","https://github.com/python/cpython/commit/4aaa4259b5a6e664b7316a4d60bdec7ee0f124d0","https://github.com/python/cpython/commit/b158a76ce094897c870fb6b3de62887b7ccc33f1","https://github.com/python/cpython/commit/f7be505d137a22528cb0fc004422c0081d5d90e6","https://github.com/python/cpython/commit/f7c0f09e69e950cf3c5ada9dbde93898eb975533","https://github.com/python/cpython/issues/121650","https://github.com/python/cpython/pull/122233","https://mail.python.org/archives/list/security-announce@python.org/thread/QH3BUOE2DYQBWP7NAQ7UNHPPOELKISRW/","http://www.openwall.com/lists/oss-security/2024/08/01/3","http://www.openwall.com/lists/oss-security/2024/08/02/2","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/01/msg00005.html","https://security.netapp.com/advisory/ntap-20240926-0003/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6923","description":"There is a MEDIUM severity vulnerability affecting CPython.\n\nThe \nemail module didn’t properly quote newlines for email headers when \nserializing an email message allowing for header injection when an email\n is serialized."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-6923","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6923","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6923","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-6923","date":"2026-11-02","epss":0.011,"percentile":0.6567}],"risk":0.5499999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6923"},"relatedVulnerabilities":[{"id":"CVE-2024-6923","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.5,"impactScore":3.4,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6923","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-6923","date":"2026-11-02","epss":0.011,"percentile":0.6567}],"urls":["https://github.com/python/cpython/commit/06f28dc236708f72871c64d4bc4b4ea144c50147","https://github.com/python/cpython/commit/097633981879b3c9de9a1dd120d3aa585ecc2384","https://github.com/python/cpython/commit/4766d1200fdf8b6728137aa2927a297e224d5fa7","https://github.com/python/cpython/commit/4aaa4259b5a6e664b7316a4d60bdec7ee0f124d0","https://github.com/python/cpython/commit/b158a76ce094897c870fb6b3de62887b7ccc33f1","https://github.com/python/cpython/commit/f7be505d137a22528cb0fc004422c0081d5d90e6","https://github.com/python/cpython/commit/f7c0f09e69e950cf3c5ada9dbde93898eb975533","https://github.com/python/cpython/issues/121650","https://github.com/python/cpython/pull/122233","https://mail.python.org/archives/list/security-announce@python.org/thread/QH3BUOE2DYQBWP7NAQ7UNHPPOELKISRW/","http://www.openwall.com/lists/oss-security/2024/08/01/3","http://www.openwall.com/lists/oss-security/2024/08/02/2","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/01/msg00005.html","https://security.netapp.com/advisory/ntap-20240926-0003/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6923","description":"There is a MEDIUM severity vulnerability affecting CPython.\n\nThe \nemail module didn’t properly quote newlines for email headers when \nserializing an email message allowing for header injection when an email\n is serialized."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-6923","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6923","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6923","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-6923","date":"2026-11-02","epss":0.011,"percentile":0.6567}],"risk":0.5499999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6923"},"relatedVulnerabilities":[{"id":"CVE-2024-6923","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.5,"impactScore":3.4,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6923","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-6923","date":"2026-11-02","epss":0.011,"percentile":0.6567}],"urls":["https://github.com/python/cpython/commit/06f28dc236708f72871c64d4bc4b4ea144c50147","https://github.com/python/cpython/commit/097633981879b3c9de9a1dd120d3aa585ecc2384","https://github.com/python/cpython/commit/4766d1200fdf8b6728137aa2927a297e224d5fa7","https://github.com/python/cpython/commit/4aaa4259b5a6e664b7316a4d60bdec7ee0f124d0","https://github.com/python/cpython/commit/b158a76ce094897c870fb6b3de62887b7ccc33f1","https://github.com/python/cpython/commit/f7be505d137a22528cb0fc004422c0081d5d90e6","https://github.com/python/cpython/commit/f7c0f09e69e950cf3c5ada9dbde93898eb975533","https://github.com/python/cpython/issues/121650","https://github.com/python/cpython/pull/122233","https://mail.python.org/archives/list/security-announce@python.org/thread/QH3BUOE2DYQBWP7NAQ7UNHPPOELKISRW/","http://www.openwall.com/lists/oss-security/2024/08/01/3","http://www.openwall.com/lists/oss-security/2024/08/02/2","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/01/msg00005.html","https://security.netapp.com/advisory/ntap-20240926-0003/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6923","description":"There is a MEDIUM severity vulnerability affecting CPython.\n\nThe \nemail module didn’t properly quote newlines for email headers when \nserializing an email message allowing for header injection when an email\n is serialized."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-6923","versionConstraint":"< 3.10.12-1~22.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-6923","fix":{"state":"fixed","versions":["3.10.12-1~22.04.6"],"available":[{"date":"2024-09-16","kind":"advisory","version":"3.10.12-1~22.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-6923","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-6923","date":"2026-11-02","epss":0.011,"percentile":0.6567}],"risk":0.5499999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-6923"},"relatedVulnerabilities":[{"id":"CVE-2024-6923","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.5,"impactScore":3.4,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6923","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-6923","date":"2026-11-02","epss":0.011,"percentile":0.6567}],"urls":["https://github.com/python/cpython/commit/06f28dc236708f72871c64d4bc4b4ea144c50147","https://github.com/python/cpython/commit/097633981879b3c9de9a1dd120d3aa585ecc2384","https://github.com/python/cpython/commit/4766d1200fdf8b6728137aa2927a297e224d5fa7","https://github.com/python/cpython/commit/4aaa4259b5a6e664b7316a4d60bdec7ee0f124d0","https://github.com/python/cpython/commit/b158a76ce094897c870fb6b3de62887b7ccc33f1","https://github.com/python/cpython/commit/f7be505d137a22528cb0fc004422c0081d5d90e6","https://github.com/python/cpython/commit/f7c0f09e69e950cf3c5ada9dbde93898eb975533","https://github.com/python/cpython/issues/121650","https://github.com/python/cpython/pull/122233","https://mail.python.org/archives/list/security-announce@python.org/thread/QH3BUOE2DYQBWP7NAQ7UNHPPOELKISRW/","http://www.openwall.com/lists/oss-security/2024/08/01/3","http://www.openwall.com/lists/oss-security/2024/08/02/2","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/01/msg00005.html","https://security.netapp.com/advisory/ntap-20240926-0003/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6923","description":"There is a MEDIUM severity vulnerability affecting CPython.\n\nThe \nemail module didn’t properly quote newlines for email headers when \nserializing an email message allowing for header injection when an email\n is serialized."}]},{"artifact":{"id":"da11de78b531bf03","cpes":["cpe:2.3:a:libpng16-16:libpng16-16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16-16:libpng16_16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16_16:libpng16-16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16_16:libpng16_16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16:libpng16-16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16:libpng16_16:1.6.37-3build5:*:*:*:*:*:*:*"],"name":"libpng16-16","purl":"pkg:deb/ubuntu/libpng16-16@1.6.37-3build5?arch=amd64&distro=ubuntu-22.04&upstream=libpng1.6","type":"deb","version":"1.6.37-3build5","language":"","licenses":["Apache-2.0","BSD-3-clause","BSD-like-with-advertising-clause","GPL-2","GPL-2+","expat","libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpng16-16/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libpng16-16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpng16-16:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libpng16-16:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libpng1.6"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.6.37-3ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25646","versionConstraint":"< 1.6.37-3ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libpng1.6","version":"1.6.37-3build5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-25646","fix":{"state":"fixed","versions":["1.6.37-3ubuntu0.4"],"available":[{"date":"2026-02-12","kind":"advisory","version":"1.6.37-3ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-25646","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25646","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25646","cwe":"CWE-125","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25646","date":"2026-11-02","epss":0.01095,"percentile":0.65554}],"risk":0.5475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25646"},"relatedVulnerabilities":[{"id":"CVE-2026-25646","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25646","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25646","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25646","cwe":"CWE-125","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25646","date":"2026-11-02","epss":0.01095,"percentile":0.65554}],"urls":["https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88","https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3","http://www.openwall.com/lists/oss-security/2026/02/09/7","https://access.redhat.com/errata/RHSA-2026:10097","https://access.redhat.com/errata/RHSA-2026:12274","https://access.redhat.com/errata/RHSA-2026:14773","https://access.redhat.com/errata/RHSA-2026:15087","https://access.redhat.com/errata/RHSA-2026:16174","https://access.redhat.com/errata/RHSA-2026:17596","https://access.redhat.com/errata/RHSA-2026:3031","https://access.redhat.com/errata/RHSA-2026:3405","https://access.redhat.com/errata/RHSA-2026:3551","https://access.redhat.com/errata/RHSA-2026:3573","https://access.redhat.com/errata/RHSA-2026:3574","https://access.redhat.com/errata/RHSA-2026:3575","https://access.redhat.com/errata/RHSA-2026:3576","https://access.redhat.com/errata/RHSA-2026:3577","https://access.redhat.com/errata/RHSA-2026:3968","https://access.redhat.com/errata/RHSA-2026:3969","https://access.redhat.com/errata/RHSA-2026:4221","https://access.redhat.com/errata/RHSA-2026:4222","https://access.redhat.com/errata/RHSA-2026:4306","https://access.redhat.com/errata/RHSA-2026:4501","https://access.redhat.com/errata/RHSA-2026:4728","https://access.redhat.com/errata/RHSA-2026:4729","https://access.redhat.com/errata/RHSA-2026:4730","https://access.redhat.com/errata/RHSA-2026:4731","https://access.redhat.com/errata/RHSA-2026:4732","https://access.redhat.com/errata/RHSA-2026:4756","https://access.redhat.com/errata/RHSA-2026:5606","https://access.redhat.com/errata/RHSA-2026:6439","https://access.redhat.com/errata/RHSA-2026:6445","https://access.redhat.com/errata/RHSA-2026:6466","https://access.redhat.com/errata/RHSA-2026:6467","https://access.redhat.com/errata/RHSA-2026:6468","https://access.redhat.com/errata/RHSA-2026:6469","https://access.redhat.com/errata/RHSA-2026:6553","https://access.redhat.com/errata/RHSA-2026:6732","https://access.redhat.com/errata/RHSA-2026:7032","https://access.redhat.com/errata/RHSA-2026:7033","https://access.redhat.com/errata/RHSA-2026:7034","https://access.redhat.com/errata/RHSA-2026:7035","https://access.redhat.com/errata/RHSA-2026:7036","https://access.redhat.com/errata/RHSA-2026:7239","https://access.redhat.com/errata/RHSA-2026:7243","https://access.redhat.com/errata/RHSA-2026:8746","https://access.redhat.com/errata/RHSA-2026:8747","https://access.redhat.com/errata/RHSA-2026:8748","https://access.redhat.com/security/cve/CVE-2026-25646","https://bugzilla.redhat.com/show_bug.cgi?id=2438542","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25646.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25646","description":"LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55."}]},{"artifact":{"id":"7f5afd36e2a50847","cpes":["cpe:2.3:a:curl:curl:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.25"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8925","versionConstraint":"< 7.81.0-1ubuntu1.25 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-8925","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.25"],"available":[{"date":"2026-06-30","kind":"advisory","version":"7.81.0-1ubuntu1.25"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8925","date":"2026-11-02","epss":0.0108,"percentile":0.6511}],"risk":0.54,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8925"},"relatedVulnerabilities":[{"id":"CVE-2026-8925","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8925","date":"2026-11-02","epss":0.0108,"percentile":0.6511}],"urls":["https://curl.se/docs/CVE-2026-8925.html","https://curl.se/docs/CVE-2026-8925.json","https://hackerone.com/reports/3735193"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8925","description":"The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice."}]},{"artifact":{"id":"eebde1772607afd6","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.25"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8925","versionConstraint":"< 7.81.0-1ubuntu1.25 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-8925","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.25"],"available":[{"date":"2026-06-30","kind":"advisory","version":"7.81.0-1ubuntu1.25"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8925","date":"2026-11-02","epss":0.0108,"percentile":0.6511}],"risk":0.54,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8925"},"relatedVulnerabilities":[{"id":"CVE-2026-8925","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8925","date":"2026-11-02","epss":0.0108,"percentile":0.6511}],"urls":["https://curl.se/docs/CVE-2026-8925.html","https://curl.se/docs/CVE-2026-8925.json","https://hackerone.com/reports/3735193"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8925","description":"The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice."}]},{"artifact":{"id":"f02275b79327efaf","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33601","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33601","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33601","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33601","date":"2026-11-02","epss":0.01075,"percentile":0.64985}],"risk":0.5375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33601"},"relatedVulnerabilities":[{"id":"CVE-2024-33601","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33601","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33601","date":"2026-11-02","epss":0.01075,"percentile":0.64985}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0014/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0007","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33601","description":"nscd: netgroup cache may terminate daemon on memory allocation failure\n\nThe Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or\nxrealloc and these functions may terminate the process due to a memory\nallocation failure resulting in a denial of service to the clients.  The\nflaw was introduced in glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"8da7e53d1801cfa5","cpes":["cpe:2.3:a:libc6:libc6:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.35-0ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33601","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33601","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33601","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33601","date":"2026-11-02","epss":0.01075,"percentile":0.64985}],"risk":0.5375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33601"},"relatedVulnerabilities":[{"id":"CVE-2024-33601","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33601","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33601","date":"2026-11-02","epss":0.01075,"percentile":0.64985}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0014/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0007","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33601","description":"nscd: netgroup cache may terminate daemon on memory allocation failure\n\nThe Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or\nxrealloc and these functions may terminate the process due to a memory\nallocation failure resulting in a denial of service to the clients.  The\nflaw was introduced in glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"a88b7869c938a730","cpes":["cpe:2.3:a:locales:locales:2.35-0ubuntu3.6:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/ubuntu/locales@2.35-0ubuntu3.6?arch=all&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.6","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.35-0ubuntu3.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33601","versionConstraint":"< 2.35-0ubuntu3.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-33601","fix":{"state":"fixed","versions":["2.35-0ubuntu3.8"],"available":[{"date":"2024-05-31","kind":"advisory","version":"2.35-0ubuntu3.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-33601","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33601","date":"2026-11-02","epss":0.01075,"percentile":0.64985}],"risk":0.5375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-33601"},"relatedVulnerabilities":[{"id":"CVE-2024-33601","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33601","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-33601","date":"2026-11-02","epss":0.01075,"percentile":0.64985}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html","https://security.netapp.com/advisory/ntap-20240524-0014/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0007","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33601","description":"nscd: netgroup cache may terminate daemon on memory allocation failure\n\nThe Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or\nxrealloc and these functions may terminate the process due to a memory\nallocation failure resulting in a denial of service to the clients.  The\nflaw was introduced in glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary."}]},{"artifact":{"id":"da11de78b531bf03","cpes":["cpe:2.3:a:libpng16-16:libpng16-16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16-16:libpng16_16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16_16:libpng16-16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16_16:libpng16_16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16:libpng16-16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16:libpng16_16:1.6.37-3build5:*:*:*:*:*:*:*"],"name":"libpng16-16","purl":"pkg:deb/ubuntu/libpng16-16@1.6.37-3build5?arch=amd64&distro=ubuntu-22.04&upstream=libpng1.6","type":"deb","version":"1.6.37-3build5","language":"","licenses":["Apache-2.0","BSD-3-clause","BSD-like-with-advertising-clause","GPL-2","GPL-2+","expat","libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpng16-16/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libpng16-16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpng16-16:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libpng16-16:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libpng1.6"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.6.37-3ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33416","versionConstraint":"< 1.6.37-3ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libpng1.6","version":"1.6.37-3build5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-33416","fix":{"state":"fixed","versions":["1.6.37-3ubuntu0.5"],"available":[{"date":"2026-05-07","kind":"advisory","version":"1.6.37-3ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-33416","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33416","date":"2026-11-02","epss":0.01071,"percentile":0.6487}],"risk":0.5355000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33416"},"relatedVulnerabilities":[{"id":"CVE-2026-33416","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33416","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33416","date":"2026-11-02","epss":0.01071,"percentile":0.6487}],"urls":["https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb","https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667","https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25","https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1","https://github.com/pnggroup/libpng/pull/824","https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33416","description":"LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE` each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng 1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS` sets `png_ptr->trans_alpha = info_ptr->trans_alpha` (256-byte buffer) and `png_set_PLTE` sets `info_ptr->palette = png_ptr->palette` (768-byte buffer). In both cases, calling `png_free_data` (with `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr` pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes the issue."}]},{"artifact":{"id":"09a606f6a748f533","cpes":["cpe:2.3:a:apache:tomcat-util:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_util:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-util","purl":"pkg:maven/org.apache.tomcat/tomcat-util@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat","virtualPath":"/opt/atlassian/confluence/lib/tomcat-util.jar","manifestName":"","pomArtifactID":"tomcat-util","archiveDigests":[{"value":"7cb70f17fc728b383573e63c49b44c040158a831","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/lib/tomcat-util.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/lib/tomcat-util.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.119"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4x29-79gh-6v8q","versionConstraint":">=9.0.83,<=9.0.118 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat:tomcat-util","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4x29-79gh-6v8q","fix":{"state":"fixed","versions":["9.0.119"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"9.0.119"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53434","cwe":"CWE-390","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-53434","date":"2026-11-02","epss":0.00586,"percentile":0.48003}],"risk":0.53033,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-53434","https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk","http://www.openwall.com/lists/oss-security/2026/06/29/22","https://github.com/apache/tomcat/commit/7f8ecdbd930d8c5a7fae73aa0eec9124d919e2f5","https://github.com/apache/tomcat/commit/c48ac39c27f4494f8c96b9d56a487253e362d276","https://github.com/apache/tomcat/commit/feec60d6099727db6f911534f6a0f6926ebab070"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4x29-79gh-6v8q","description":"Apache Tomcat util accepted misconfigured CRLs"},"relatedVulnerabilities":[{"id":"CVE-2026-53434","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53434","cwe":"CWE-390","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-53434","date":"2026-11-02","epss":0.00586,"percentile":0.48003}],"urls":["https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk","http://www.openwall.com/lists/oss-security/2026/06/29/22"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53434","description":"Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue."}]},{"artifact":{"id":"8e71e0de8f0f474a","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:8.20.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:8.20.1:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@8.20.1","type":"java-archive","version":"8.20.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.plugins.authentication.atlassian-authentication-plugin-4.2.26.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.plugins.authentication.atlassian-authentication-plugin-4.2.26.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.plugins.authentication.atlassian-authentication-plugin-4.2.26.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xwmg-2g98-w7v9","versionConstraint":"<9.37.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"8.20.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xwmg-2g98-w7v9","fix":{"state":"fixed","versions":["9.37.4"],"available":[{"date":"2025-08-12","kind":"first-observed","version":"9.37.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"risk":0.52974,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-53864","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xwmg-2g98-w7v9","description":"Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON"},"relatedVulnerabilities":[{"id":"CVE-2025-53864","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53864","description":"Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson."}]},{"artifact":{"id":"e82faf748fca2b9d","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:8.22:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:8.22:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@8.22","type":"java-archive","version":"8.22","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xwmg-2g98-w7v9","versionConstraint":"<9.37.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"8.22"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xwmg-2g98-w7v9","fix":{"state":"fixed","versions":["9.37.4"],"available":[{"date":"2025-08-12","kind":"first-observed","version":"9.37.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"risk":0.52974,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-53864","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xwmg-2g98-w7v9","description":"Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON"},"relatedVulnerabilities":[{"id":"CVE-2025-53864","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53864","description":"Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson."}]},{"artifact":{"id":"59064f7c295c14ff","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:8.22.1:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:8.22.1:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@8.22.1","type":"java-archive","version":"8.22.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.upm.atlassian-universal-plugin-manager-plugin-6.4.1.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.upm.atlassian-universal-plugin-manager-plugin-6.4.1.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.upm.atlassian-universal-plugin-manager-plugin-6.4.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xwmg-2g98-w7v9","versionConstraint":"<9.37.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"8.22.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xwmg-2g98-w7v9","fix":{"state":"fixed","versions":["9.37.4"],"available":[{"date":"2025-08-12","kind":"first-observed","version":"9.37.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"risk":0.52974,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-53864","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xwmg-2g98-w7v9","description":"Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON"},"relatedVulnerabilities":[{"id":"CVE-2025-53864","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53864","description":"Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson."}]},{"artifact":{"id":"f4e147ea7b18f56d","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.28:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.28:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.28","type":"java-archive","version":"9.28","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-collaborative-editor-plugin-18.7.51.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-collaborative-editor-plugin-18.7.51.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-collaborative-editor-plugin-18.7.51.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xwmg-2g98-w7v9","versionConstraint":"<9.37.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.28"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xwmg-2g98-w7v9","fix":{"state":"fixed","versions":["9.37.4"],"available":[{"date":"2025-08-12","kind":"first-observed","version":"9.37.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"risk":0.52974,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-53864","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xwmg-2g98-w7v9","description":"Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON"},"relatedVulnerabilities":[{"id":"CVE-2025-53864","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53864","description":"Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson."}]},{"artifact":{"id":"5bb9221d86a18ecc","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.31","type":"java-archive","version":"9.31","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.oauth2.oauth2-client-plugin-3.1.5.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.oauth2.oauth2-client-plugin-3.1.5.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.oauth2.oauth2-client-plugin-3.1.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xwmg-2g98-w7v9","versionConstraint":"<9.37.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xwmg-2g98-w7v9","fix":{"state":"fixed","versions":["9.37.4"],"available":[{"date":"2025-08-12","kind":"first-observed","version":"9.37.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"risk":0.52974,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-53864","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xwmg-2g98-w7v9","description":"Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON"},"relatedVulnerabilities":[{"id":"CVE-2025-53864","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53864","description":"Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson."}]},{"artifact":{"id":"2abd1ff29a503c5a","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.31","type":"java-archive","version":"9.31","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.oauth2.oauth2-provider-plugin-3.1.5.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.oauth2.oauth2-provider-plugin-3.1.5.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.oauth2.oauth2-provider-plugin-3.1.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xwmg-2g98-w7v9","versionConstraint":"<9.37.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xwmg-2g98-w7v9","fix":{"state":"fixed","versions":["9.37.4"],"available":[{"date":"2025-08-12","kind":"first-observed","version":"9.37.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"risk":0.52974,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-53864","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xwmg-2g98-w7v9","description":"Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON"},"relatedVulnerabilities":[{"id":"CVE-2025-53864","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53864","description":"Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson."}]},{"artifact":{"id":"2606a3d8512348e9","cpes":["cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.31","type":"java-archive","version":"9.31","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.jwt.jwt-plugin-3.3.2.jar:com.nimbusds:nimbus-jose-jwt","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.jwt.jwt-plugin-3.3.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.jwt.jwt-plugin-3.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xwmg-2g98-w7v9","versionConstraint":"<9.37.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xwmg-2g98-w7v9","fix":{"state":"fixed","versions":["9.37.4"],"available":[{"date":"2025-08-12","kind":"first-observed","version":"9.37.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"risk":0.52974,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-53864","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xwmg-2g98-w7v9","description":"Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON"},"relatedVulnerabilities":[{"id":"CVE-2025-53864","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53864","description":"Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson."}]},{"artifact":{"id":"ddfa7e7209741c36","cpes":["cpe:2.3:a:com.nimbusds.nimbus-jose-jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds.nimbus-jose-jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:connect2id-ltd-:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:connect2id-ltd-:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:connect2id_ltd_:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:connect2id_ltd_:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose-jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose_jwt:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:com.nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus-jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus_jose:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbusds:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus-jose-jwt:9.31:*:*:*:*:*:*:*","cpe:2.3:a:nimbus:nimbus_jose_jwt:9.31:*:*:*:*:*:*:*"],"name":"nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt@9.31","type":"java-archive","version":"9.31","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.nimbusds","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.nimbusds_nimbus-jose-jwt-9.31.jar","manifestName":"","pomArtifactID":"nimbus-jose-jwt","archiveDigests":[{"value":"229ba7b31d1f886968896c48aeeba5a1586b00bc","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.nimbusds_nimbus-jose-jwt-9.31.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.nimbusds_nimbus-jose-jwt-9.31.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.37.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xwmg-2g98-w7v9","versionConstraint":"<9.37.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.nimbusds:nimbus-jose-jwt","version":"9.31"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xwmg-2g98-w7v9","fix":{"state":"fixed","versions":["9.37.4"],"available":[{"date":"2025-08-12","kind":"first-observed","version":"9.37.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"risk":0.52974,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-53864","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xwmg-2g98-w7v9","description":"Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON"},"relatedVulnerabilities":[{"id":"CVE-2025-53864","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53864","cwe":"CWE-674","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-53864","date":"2026-11-02","epss":0.00981,"percentile":0.62256}],"urls":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53864","description":"Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson."}]},{"artifact":{"id":"4d5407177cb8d0dd","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.25"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34182","versionConstraint":"< 3.0.2-0ubuntu1.25 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-34182","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.25"],"available":[{"date":"2026-06-09","kind":"advisory","version":"3.0.2-0ubuntu1.25"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-34182","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34182","date":"2026-11-02","epss":0.01057,"percentile":0.64455}],"risk":0.5285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34182"},"relatedVulnerabilities":[{"id":"CVE-2026-34182","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34182","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34182","date":"2026-11-02","epss":0.01057,"percentile":0.64455}],"urls":["https://github.com/openssl/openssl/commit/03c1f4d45fb963aee7d5833390c507cd290182bc","https://github.com/openssl/openssl/commit/439ed7d2c0962ce964482727264668bf277c333f","https://github.com/openssl/openssl/commit/7947e6a81eb8776802f159fb6762cb7fcf7e34c7","https://github.com/openssl/openssl/commit/9fd97f8cfdc2c0be214998de3b2b55c8edf6c7ac","https://github.com/openssl/openssl/commit/d2ca86bcd43e4f17d899f347101766b6107676e0","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34182","description":"Issue Summary: Cryptographic Message Services (CMS) processing fails to perform\nsufficient input validation on the cipher and tag length fields of\nAuthEnvelopedData containers, leading to various potential compromises.\n\nImpact Summary: Attackers making use of these vulnerabilities may achieve\nkey-equivalent functionality for a given CMS recipient and/or bypass integrity\nvalidation for a given message.\n\nIn one use case, an attacker may send a CMS message containing\nAuthEnvelopedData with the cipher specified as a non-AEAD cipher.  OpenSSL\nerroneously allows this selection, and attempts to decrypt and validate the\nmessage.\n\nAn on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData\naddressed to the victim can re-emit it with the recipientInfos set left\nbyte-for-byte intact, so the victim's private key still unwraps the genuine CEK\n(the content-encryption key), but with the inner OID rewritten to AES-256-OFB\n(Output Feedback Mode, an unauthenticated keystream mode) and with an\nattacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the\nreal CEK, never consults the MAC field, and CMS_decrypt() returns success.\n\nIf the application under attack responds to the attacker with any indicator\nshowing success or failure of the decryption effort, it is possible for the\nattacker to use this as an oracle to obtain key equivalent functionality for the\nCEK used for the chosen recipient of the message.\n\nIn another use case, an attacker can reduce the tag length of the chosen AEAD\ncipher for a given AuthEnvelopedData container to be a single byte long,\nallowing an attacker to brute force CMS decryption, producing an integrity\nbypass for applications that trust CMS_decrypt() to reject modified content.\n\nThe FIPS modules are not affected by this issue."}]},{"artifact":{"id":"1014a67cbf322356","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.25"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-34182","versionConstraint":"< 3.0.2-0ubuntu1.25 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-34182","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.25"],"available":[{"date":"2026-06-09","kind":"advisory","version":"3.0.2-0ubuntu1.25"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-34182","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34182","date":"2026-11-02","epss":0.01057,"percentile":0.64455}],"risk":0.5285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34182"},"relatedVulnerabilities":[{"id":"CVE-2026-34182","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34182","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34182","date":"2026-11-02","epss":0.01057,"percentile":0.64455}],"urls":["https://github.com/openssl/openssl/commit/03c1f4d45fb963aee7d5833390c507cd290182bc","https://github.com/openssl/openssl/commit/439ed7d2c0962ce964482727264668bf277c333f","https://github.com/openssl/openssl/commit/7947e6a81eb8776802f159fb6762cb7fcf7e34c7","https://github.com/openssl/openssl/commit/9fd97f8cfdc2c0be214998de3b2b55c8edf6c7ac","https://github.com/openssl/openssl/commit/d2ca86bcd43e4f17d899f347101766b6107676e0","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34182","description":"Issue Summary: Cryptographic Message Services (CMS) processing fails to perform\nsufficient input validation on the cipher and tag length fields of\nAuthEnvelopedData containers, leading to various potential compromises.\n\nImpact Summary: Attackers making use of these vulnerabilities may achieve\nkey-equivalent functionality for a given CMS recipient and/or bypass integrity\nvalidation for a given message.\n\nIn one use case, an attacker may send a CMS message containing\nAuthEnvelopedData with the cipher specified as a non-AEAD cipher.  OpenSSL\nerroneously allows this selection, and attempts to decrypt and validate the\nmessage.\n\nAn on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData\naddressed to the victim can re-emit it with the recipientInfos set left\nbyte-for-byte intact, so the victim's private key still unwraps the genuine CEK\n(the content-encryption key), but with the inner OID rewritten to AES-256-OFB\n(Output Feedback Mode, an unauthenticated keystream mode) and with an\nattacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the\nreal CEK, never consults the MAC field, and CMS_decrypt() returns success.\n\nIf the application under attack responds to the attacker with any indicator\nshowing success or failure of the decryption effort, it is possible for the\nattacker to use this as an oracle to obtain key equivalent functionality for the\nCEK used for the chosen recipient of the message.\n\nIn another use case, an attacker can reduce the tag length of the chosen AEAD\ncipher for a given AuthEnvelopedData container to be a single byte long,\nallowing an attacker to brute force CMS decryption, producing an integrity\nbypass for applications that trust CMS_decrypt() to reject modified content.\n\nThe FIPS modules are not affected by this issue."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.31"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-22016","versionConstraint":"< 1.8.0_492||>= 1.9, < 8.0.492||>= 12, < 17.0.19||>= 18, < 21.0.11||>= 22, < 25.0.3||>= 26, < 26.0.1||>= 9, < 11.0.31 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-22016","fix":{"state":"fixed","versions":["1.8.0_492","8.0.492","11.0.31","17.0.19","21.0.11","25.0.3","26.0.1"],"available":[{"date":"2026-04-24","kind":"first-observed","version":"1.8.0_492"},{"date":"2026-04-24","kind":"first-observed","version":"8.0.492"},{"date":"2026-04-24","kind":"first-observed","version":"17.0.19"},{"date":"2026-04-24","kind":"first-observed","version":"21.0.11"},{"date":"2026-04-24","kind":"first-observed","version":"25.0.3"},{"date":"2026-04-24","kind":"first-observed","version":"26.0.1"},{"date":"2026-04-24","kind":"first-observed","version":"11.0.31"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22016","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-22016","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-22016","cwe":"CWE-611","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-22016","date":"2026-11-02","epss":0.00702,"percentile":0.53266}],"risk":0.5265000000000001,"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html","https://access.redhat.com/errata/RHSA-2026:11403","https://access.redhat.com/errata/RHSA-2026:11655","https://access.redhat.com/errata/RHSA-2026:11822","https://access.redhat.com/errata/RHSA-2026:11829","https://access.redhat.com/errata/RHSA-2026:11902","https://access.redhat.com/errata/RHSA-2026:22139","https://access.redhat.com/errata/RHSA-2026:22328","https://access.redhat.com/errata/RHSA-2026:9254","https://access.redhat.com/errata/RHSA-2026:9682","https://access.redhat.com/errata/RHSA-2026:9683","https://access.redhat.com/errata/RHSA-2026:9684","https://access.redhat.com/errata/RHSA-2026:9686","https://access.redhat.com/errata/RHSA-2026:9687","https://access.redhat.com/errata/RHSA-2026:9688","https://access.redhat.com/errata/RHSA-2026:9689","https://access.redhat.com/errata/RHSA-2026:9691","https://access.redhat.com/errata/RHSA-2026:9693","https://access.redhat.com/errata/RHSA-2026:9694","https://access.redhat.com/security/cve/CVE-2026-22016","https://bugzilla.redhat.com/show_bug.cgi?id=2460039","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22016.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22016","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and  21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"41fd2c72127de89f","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.132.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pwqr-wmgm-9rr8","versionConstraint":"<4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pwqr-wmgm-9rr8","fix":{"state":"fixed","versions":["4.1.132.Final"],"available":[{"date":"2026-03-27","kind":"first-observed","version":"4.1.132.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33870","date":"2026-11-02","epss":0.00701,"percentile":0.5322}],"risk":0.52575,"urls":["https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110","https://nvd.nist.gov/vuln/detail/CVE-2026-33870"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pwqr-wmgm-9rr8","description":"Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-33870","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33870","date":"2026-11-02","epss":0.00701,"percentile":0.5322}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:7109","https://access.redhat.com/errata/RHSA-2026:7380","https://access.redhat.com/errata/RHSA-2026:8159","https://access.redhat.com/errata/RHSA-2026:8509","https://access.redhat.com/security/cve/CVE-2026-33870","https://bugzilla.redhat.com/show_bug.cgi?id=2452453","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33870.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33870","description":"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue."}]},{"artifact":{"id":"0ae96c8bb001b7ff","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.132.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pwqr-wmgm-9rr8","versionConstraint":"<4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pwqr-wmgm-9rr8","fix":{"state":"fixed","versions":["4.1.132.Final"],"available":[{"date":"2026-03-27","kind":"first-observed","version":"4.1.132.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33870","date":"2026-11-02","epss":0.00701,"percentile":0.5322}],"risk":0.52575,"urls":["https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110","https://nvd.nist.gov/vuln/detail/CVE-2026-33870"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pwqr-wmgm-9rr8","description":"Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-33870","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33870","date":"2026-11-02","epss":0.00701,"percentile":0.5322}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:7109","https://access.redhat.com/errata/RHSA-2026:7380","https://access.redhat.com/errata/RHSA-2026:8159","https://access.redhat.com/errata/RHSA-2026:8509","https://access.redhat.com/security/cve/CVE-2026-33870","https://bugzilla.redhat.com/show_bug.cgi?id=2452453","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33870.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33870","description":"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue."}]},{"artifact":{"id":"b400511196d0cd9e","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.132.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pwqr-wmgm-9rr8","versionConstraint":"<4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pwqr-wmgm-9rr8","fix":{"state":"fixed","versions":["4.1.132.Final"],"available":[{"date":"2026-03-27","kind":"first-observed","version":"4.1.132.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33870","date":"2026-11-02","epss":0.00701,"percentile":0.5322}],"risk":0.52575,"urls":["https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110","https://nvd.nist.gov/vuln/detail/CVE-2026-33870"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pwqr-wmgm-9rr8","description":"Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-33870","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33870","date":"2026-11-02","epss":0.00701,"percentile":0.5322}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:7109","https://access.redhat.com/errata/RHSA-2026:7380","https://access.redhat.com/errata/RHSA-2026:8159","https://access.redhat.com/errata/RHSA-2026:8509","https://access.redhat.com/security/cve/CVE-2026-33870","https://bugzilla.redhat.com/show_bug.cgi?id=2452453","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33870.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33870","description":"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue."}]},{"artifact":{"id":"cfda19effa7c6d29","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.3?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.3","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42010","versionConstraint":"< 3.7.3-4ubuntu1.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-42010","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.9"],"available":[{"date":"2026-05-20","kind":"advisory","version":"3.7.3-4ubuntu1.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-42010","cwe":"CWE-170","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-42010","cwe":"CWE-626","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-42010","cwe":"CWE-170","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42010","date":"2026-11-02","epss":0.0105,"percentile":0.64282}],"risk":0.525,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42010"},"relatedVulnerabilities":[{"id":"CVE-2026-42010","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42010","cwe":"CWE-170","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-42010","cwe":"CWE-626","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-42010","cwe":"CWE-170","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42010","date":"2026-11-02","epss":0.0105,"percentile":0.64282}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:34764","https://access.redhat.com/errata/RHSA-2026:34788","https://access.redhat.com/errata/RHSA-2026:34790","https://access.redhat.com/errata/RHSA-2026:36004","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:40762","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:62409","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:67857","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-42010","https://bugzilla.redhat.com/show_bug.cgi?id=2467289","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-4","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42010.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42010","description":"A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process."}]},{"artifact":{"id":"6956518b2a60c231","cpes":["cpe:2.3:a:com.sun.mail.jakarta.mail:jakarta.mail:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:com.sun.mail.jakarta.mail:jakarta:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:com.sun.mail.jakarta.mail:mail:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:com.sun.mail:jakarta.mail:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:jakarta.mail:jakarta.mail:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:com.sun.mail:jakarta:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:com.sun:jakarta.mail:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:jakarta.mail:jakarta:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:jakarta:jakarta.mail:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:oracle:jakarta.mail:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:com.sun.mail:mail:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:jakarta.mail:mail:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:mail:jakarta.mail:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:sun:jakarta.mail:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:com.sun:jakarta:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:jakarta:jakarta:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:oracle:jakarta:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:com.sun:mail:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:jakarta:mail:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:mail:jakarta:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:oracle:mail:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:sun:jakarta:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:mail:mail:1.6.7:*:*:*:*:*:*:*","cpe:2.3:a:sun:mail:1.6.7:*:*:*:*:*:*:*"],"name":"jakarta.mail","purl":"pkg:maven/com.sun.mail/jakarta.mail@1.6.7","type":"java-archive","version":"1.6.7","language":"java","licenses":["http://www.eclipse.org/legal/epl-2.0, https://www.gnu.org/software/classpath/license.html, http://www.eclipse.org/org/documents/edl-v10.php"],"metadata":{"pomGroupID":"com.sun.mail","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.sun.mail_jakarta.mail-1.6.7.jar","manifestName":"","pomArtifactID":"jakarta.mail","archiveDigests":[{"value":"319df0e9d536c1a01acdfe49b6e82b97d2393073","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.sun.mail_jakarta.mail-1.6.7.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.sun.mail_jakarta.mail-1.6.7.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.6.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9342-92gg-6v29","versionConstraint":"<1.6.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.sun.mail:jakarta.mail","version":"1.6.7"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9342-92gg-6v29","fix":{"state":"fixed","versions":["1.6.8"],"available":[{"date":"2026-04-17","kind":"first-observed","version":"1.6.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7962","cwe":"CWE-147","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2025-7962","date":"2026-11-02","epss":0.00891,"percentile":0.59414}],"risk":0.5234624999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-7962","https://gitlab.eclipse.org/security/cve-assignement/-/issues/67","https://github.com/eclipse-ee4j/angus-mail/commit/269099b652a0a5c2fa140f1296a18f0fbbea0d44","https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/290","http://www.openwall.com/lists/oss-security/2025/09/03/4","https://github.com/jakartaee/mail-api/issues/765","https://github.com/jakartaee/mail-api/pull/760","https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/290#note_5320539"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9342-92gg-6v29","description":"Jakarta Mail vulnerable to SMTP Injection"},"relatedVulnerabilities":[{"id":"CVE-2025-7962","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"emo@eclipse.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7962","cwe":"CWE-147","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2025-7962","date":"2026-11-02","epss":0.00891,"percentile":0.59414}],"urls":["https://gitlab.eclipse.org/security/cve-assignement/-/issues/67","http://www.openwall.com/lists/oss-security/2025/09/03/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7962","description":"In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \\r and \\n UTF-8 characters to separate different messages."}]},{"artifact":{"id":"c87a73d6229303b3","cpes":["cpe:2.3:a:apache:tomcat-coyote:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_coyote:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-coyote","purl":"pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat","virtualPath":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","manifestName":"","pomArtifactID":"tomcat-coyote","archiveDigests":[{"value":"20f6014eba726230cc33ce7f0248b3261b7bae58","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.116"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-563x-q5rq-57qp","versionConstraint":">=7.0.0,<9.0.116 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat:tomcat-coyote","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-563x-q5rq-57qp","fix":{"state":"fixed","versions":["9.0.116"],"available":[{"date":"2026-05-21","kind":"first-observed","version":"9.0.116"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24880","cwe":"CWE-444","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-24880","date":"2026-11-02","epss":0.00697,"percentile":0.53065}],"risk":0.5227499999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-24880","https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn","http://www.openwall.com/lists/oss-security/2026/04/09/20","https://github.com/apache/tomcat/commit/1b586d6aa8ae65726da5fa8799427b5d4718478a","https://github.com/apache/tomcat/commit/1e71441a15972f56e661b0b549fb9e5d838b83bb","https://github.com/apache/tomcat/commit/2cb06c34f661ca42f7570bbcc21e99806184bcc5","https://github.com/apache/tomcat/commit/6d478dbe18b7c4bb671c30fedf130309b0dab77c","https://github.com/apache/tomcat/commit/f07df938d00f7419b40fa65aa912966d0efac522","https://github.com/apache/tomcat/commit/fde1a8235fb73125217bd41e162aa0a113f33552","https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.53","https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.20","https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.116","https://www.herodevs.com/vulnerability-directory/cve-2026-24880"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-563x-q5rq-57qp","description":"Apache Tomcat has an HTTP Request/Response Smuggling vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-24880","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24880","cwe":"CWE-444","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-24880","date":"2026-11-02","epss":0.00697,"percentile":0.53065}],"urls":["https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn","http://www.openwall.com/lists/oss-security/2026/04/09/20"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24880","description":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOther, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.29"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-53066","versionConstraint":"< 1.8.0_472||>= 1.9, < 8.0.472||>= 12, < 17.0.17||>= 18, < 21.0.9||>= 22, < 25.0.1||>= 9, < 11.0.29 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-53066","fix":{"state":"fixed","versions":["1.8.0_472","8.0.472","11.0.29","17.0.17","21.0.9","25.0.1"],"available":[{"date":"2025-10-23","kind":"first-observed","version":"1.8.0_472"},{"date":"2025-10-23","kind":"first-observed","version":"8.0.472"},{"date":"2025-10-23","kind":"first-observed","version":"17.0.17"},{"date":"2025-10-23","kind":"first-observed","version":"21.0.9"},{"date":"2025-10-23","kind":"first-observed","version":"25.0.1"},{"date":"2025-10-23","kind":"first-observed","version":"11.0.29"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53066","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53066","date":"2026-11-02","epss":0.00694,"percentile":0.52935}],"risk":0.5205,"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html","https://lists.debian.org/debian-lts-announce/2025/10/msg00026.html","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53066","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and  21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"922c00d79fbb52c6","cpes":["cpe:2.3:a:com.hazelcast.osgi.impl.Activator:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast\\,-inc-:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast\\,_inc_:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:com.hazelcast:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:Activator:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:impl:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:osgi:hazelcast:3.12.13:*:*:*:*:*:*:*"],"name":"hazelcast","purl":"pkg:maven/com.hazelcast/hazelcast@3.12.13","type":"java-archive","version":"3.12.13","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.hazelcast","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.hazelcast_hazelcast-3.12.13.jar","manifestName":"","pomArtifactID":"hazelcast","archiveDigests":[{"value":"d3db2f8be00c8a03ddee6a86434e76e6b7fe980d","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.hazelcast_hazelcast-3.12.13.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.hazelcast_hazelcast-3.12.13.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.0.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c5vj-wp4v-mmvx","versionConstraint":"<=5.0.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.hazelcast:hazelcast","version":"3.12.13"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c5vj-wp4v-mmvx","fix":{"state":"fixed","versions":["5.0.5"],"available":[{"date":"2023-07-20","kind":"first-observed","version":"5.0.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-33265","cwe":"CWE-862","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-33265","date":"2026-11-02","epss":0.00688,"percentile":0.52711}],"risk":0.51944,"urls":["https://github.com/hazelcast/hazelcast/security/advisories/GHSA-c5vj-wp4v-mmvx","https://nvd.nist.gov/vuln/detail/CVE-2023-33265","https://github.com/hazelcast/hazelcast","https://github.com/hazelcast/hazelcast/releases/tag/v5.0.5","https://github.com/hazelcast/hazelcast/releases/tag/v5.1.7","https://github.com/hazelcast/hazelcast/releases/tag/v5.2.4","https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c5vj-wp4v-mmvx","description":"Hazelcast Executor Services don't check client permissions properly"},"relatedVulnerabilities":[{"id":"CVE-2023-33265","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-33265","cwe":"CWE-862","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-33265","date":"2026-11-02","epss":0.00688,"percentile":0.52711}],"urls":["https://github.com/hazelcast/hazelcast","https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-33265","description":"In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted."}]},{"artifact":{"id":"ba3011af7d8611fa","cpes":["cpe:2.3:a:com.hazelcast:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast:hazelcast:3.12.13:*:*:*:*:*:*:*"],"name":"hazelcast","purl":"pkg:maven/com.hazelcast/hazelcast@3.12.13","type":"java-archive","version":"3.12.13","language":"java","licenses":[],"metadata":{"pomGroupID":"com.hazelcast","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:com.hazelcast:hazelcast","manifestName":"","pomArtifactID":"hazelcast","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.0.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c5vj-wp4v-mmvx","versionConstraint":"<=5.0.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.hazelcast:hazelcast","version":"3.12.13"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c5vj-wp4v-mmvx","fix":{"state":"fixed","versions":["5.0.5"],"available":[{"date":"2023-07-20","kind":"first-observed","version":"5.0.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-33265","cwe":"CWE-862","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-33265","date":"2026-11-02","epss":0.00688,"percentile":0.52711}],"risk":0.51944,"urls":["https://github.com/hazelcast/hazelcast/security/advisories/GHSA-c5vj-wp4v-mmvx","https://nvd.nist.gov/vuln/detail/CVE-2023-33265","https://github.com/hazelcast/hazelcast","https://github.com/hazelcast/hazelcast/releases/tag/v5.0.5","https://github.com/hazelcast/hazelcast/releases/tag/v5.1.7","https://github.com/hazelcast/hazelcast/releases/tag/v5.2.4","https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c5vj-wp4v-mmvx","description":"Hazelcast Executor Services don't check client permissions properly"},"relatedVulnerabilities":[{"id":"CVE-2023-33265","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-33265","cwe":"CWE-862","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-33265","date":"2026-11-02","epss":0.00688,"percentile":0.52711}],"urls":["https://github.com/hazelcast/hazelcast","https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-33265","description":"In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted."}]},{"artifact":{"id":"4d5407177cb8d0dd","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.23"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-31790","versionConstraint":"< 3.0.2-0ubuntu1.23 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-31790","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.23"],"available":[{"date":"2026-04-08","kind":"advisory","version":"3.0.2-0ubuntu1.23"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-31790","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31790","date":"2026-11-02","epss":0.0103,"percentile":0.63727}],"risk":0.515,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-31790"},"relatedVulnerabilities":[{"id":"CVE-2026-31790","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31790","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31790","date":"2026-11-02","epss":0.0103,"percentile":0.63727}],"urls":["https://github.com/openssl/openssl/commit/001e01db3e996e13ffc72386fe79d03a6683b5ac","https://github.com/openssl/openssl/commit/abd8b2eec7e3f3fda60ecfb68498b246b52af482","https://github.com/openssl/openssl/commit/b922e24e5b23ffb9cb9e14cadff23d91e9f7e406","https://github.com/openssl/openssl/commit/d5f8e71cd0a54e961d0c3b174348f8308486f790","https://github.com/openssl/openssl/commit/eed200f58cd8645ed77e46b7e9f764e284df379e","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31790","description":"Issue summary: Applications using RSASVE key encapsulation to establish\na secret encryption key can send contents of an uninitialized memory buffer to\na malicious peer.\n\nImpact summary: The uninitialized buffer might contain sensitive data from the\nprevious execution of the application process which leads to sensitive data\nleakage to an attacker.\n\nRSA_public_encrypt() returns the number of bytes written on success and -1\non error. The affected code tests only whether the return value is non-zero.\nAs a result, if RSA encryption fails, encapsulation can still return success to\nthe caller, set the output lengths, and leave the caller to use the contents of\nthe ciphertext buffer as if a valid KEM ciphertext had been produced.\n\nIf applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an\nattacker-supplied invalid RSA public key without first validating that key,\nthen this may cause stale or uninitialized contents of the caller-provided\nciphertext buffer to be disclosed to the attacker in place of the KEM\nciphertext.\n\nAs a workaround calling EVP_PKEY_public_check() or\nEVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate\nthe issue.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue."}]},{"artifact":{"id":"1014a67cbf322356","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.23"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-31790","versionConstraint":"< 3.0.2-0ubuntu1.23 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-31790","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.23"],"available":[{"date":"2026-04-08","kind":"advisory","version":"3.0.2-0ubuntu1.23"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-31790","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31790","date":"2026-11-02","epss":0.0103,"percentile":0.63727}],"risk":0.515,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-31790"},"relatedVulnerabilities":[{"id":"CVE-2026-31790","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31790","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31790","date":"2026-11-02","epss":0.0103,"percentile":0.63727}],"urls":["https://github.com/openssl/openssl/commit/001e01db3e996e13ffc72386fe79d03a6683b5ac","https://github.com/openssl/openssl/commit/abd8b2eec7e3f3fda60ecfb68498b246b52af482","https://github.com/openssl/openssl/commit/b922e24e5b23ffb9cb9e14cadff23d91e9f7e406","https://github.com/openssl/openssl/commit/d5f8e71cd0a54e961d0c3b174348f8308486f790","https://github.com/openssl/openssl/commit/eed200f58cd8645ed77e46b7e9f764e284df379e","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31790","description":"Issue summary: Applications using RSASVE key encapsulation to establish\na secret encryption key can send contents of an uninitialized memory buffer to\na malicious peer.\n\nImpact summary: The uninitialized buffer might contain sensitive data from the\nprevious execution of the application process which leads to sensitive data\nleakage to an attacker.\n\nRSA_public_encrypt() returns the number of bytes written on success and -1\non error. The affected code tests only whether the return value is non-zero.\nAs a result, if RSA encryption fails, encapsulation can still return success to\nthe caller, set the output lengths, and leave the caller to use the contents of\nthe ciphertext buffer as if a valid KEM ciphertext had been produced.\n\nIf applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an\nattacker-supplied invalid RSA public key without first validating that key,\nthen this may cause stale or uninitialized contents of the caller-provided\nciphertext buffer to be disclosed to the attacker in place of the KEM\nciphertext.\n\nAs a workaround calling EVP_PKEY_public_check() or\nEVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate\nthe issue.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue."}]},{"artifact":{"id":"445d7588d0d8677a","cpes":["cpe:2.3:a:org.eclipse.jetty:jetty-security:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_security:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty-security:jetty-security:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty-security:jetty_security:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty_security:jetty-security:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty_security:jetty_security:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-security:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_security:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty-security:jetty:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-security:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_security:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty_security:jetty:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:10.0.15:*:*:*:*:*:*:*"],"name":"jetty-security","purl":"pkg:maven/org.eclipse.jetty/jetty-security@10.0.15","type":"java-archive","version":"10.0.15","language":"java","licenses":[],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar:org.eclipse.jetty:jetty-security","manifestName":"","pomArtifactID":"jetty-security","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"10.0.31"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2fvj-hgj9-j2gr","versionConstraint":">=10.0.0,<=10.0.26 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-security","version":"10.0.15"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-2fvj-hgj9-j2gr","fix":{"state":"fixed","versions":["10.0.31"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"10.0.31"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10050","cwe":"CWE-173","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2026-10050","cwe":"CWE-303","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2026-10050","date":"2026-11-02","epss":0.00632,"percentile":0.50306}],"risk":0.51192,"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr","https://github.com/jetty/jetty.project/issues/15136","https://github.com/jetty/jetty.project/pull/15160","https://github.com/jetty/jetty.project/pull/15183","https://github.com/jetty/jetty.project/commit/4bcdbc7db387ce9e20e2c7571a7250280466221d","https://github.com/jetty/jetty.project/commit/d0bb829ccecbf19e3ad3d32f2649b2800f01222d","https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.36","https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.10"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2fvj-hgj9-j2gr","description":"Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution"},"relatedVulnerabilities":[{"id":"CVE-2026-10050","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"emo@eclipse.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10050","cwe":"CWE-173","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2026-10050","cwe":"CWE-303","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2026-10050","date":"2026-11-02","epss":0.00632,"percentile":0.50306}],"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/120"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-10050","description":"In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.\n\n\n\nThis was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.\n\n\n\nIf the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`.\n\n\n\nAn attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters.\n\n\n\nRecent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords."}]},{"artifact":{"id":"41fd2c72127de89f","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jppx-w49h-x2qq","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jppx-w49h-x2qq","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-11-02","epss":0.0063,"percentile":0.50188}],"risk":0.5103,"urls":["https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq","https://nvd.nist.gov/vuln/detail/CVE-2026-56745","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jppx-w49h-x2qq","description":"Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-56745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-11-02","epss":0.0063,"percentile":0.50188}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56745","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"b400511196d0cd9e","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jppx-w49h-x2qq","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jppx-w49h-x2qq","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-11-02","epss":0.0063,"percentile":0.50188}],"risk":0.5103,"urls":["https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq","https://nvd.nist.gov/vuln/detail/CVE-2026-56745","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jppx-w49h-x2qq","description":"Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-56745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-11-02","epss":0.0063,"percentile":0.50188}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56745","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"0ae96c8bb001b7ff","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jppx-w49h-x2qq","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jppx-w49h-x2qq","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-11-02","epss":0.0063,"percentile":0.50188}],"risk":0.5103,"urls":["https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq","https://nvd.nist.gov/vuln/detail/CVE-2026-56745","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jppx-w49h-x2qq","description":"Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-56745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-11-02","epss":0.0063,"percentile":0.50188}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56745","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"b02fdd576120e3c0","cpes":["cpe:2.3:a:org.bitbucket.b_c.jose4j:jose4j:0.9.3:*:*:*:*:*:*:*","cpe:2.3:a:org.bitbucket.b_c:jose4j:0.9.3:*:*:*:*:*:*:*","cpe:2.3:a:bitbucket:jose4j:0.9.3:*:*:*:*:*:*:*","cpe:2.3:a:jose4j:jose4j:0.9.3:*:*:*:*:*:*:*","cpe:2.3:a:b-c:jose4j:0.9.3:*:*:*:*:*:*:*","cpe:2.3:a:b_c:jose4j:0.9.3:*:*:*:*:*:*:*","cpe:2.3:a:b:jose4j:0.9.3:*:*:*:*:*:*:*"],"name":"jose4j","purl":"pkg:maven/org.bitbucket.b_c/jose4j@0.9.3","type":"java-archive","version":"0.9.3","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.bitbucket.b_c","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/jose4j-0.9.3.jar","manifestName":"","pomArtifactID":"jose4j","archiveDigests":[{"value":"9670e11587194cb6b1b2edcaa688a3fab85b4148","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/jose4j-0.9.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.9.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6qvw-249j-h44c","versionConstraint":"<0.9.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bitbucket.b_c:jose4j","version":"0.9.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6qvw-249j-h44c","fix":{"state":"fixed","versions":["0.9.4"],"available":[{"date":"2024-03-01","kind":"first-observed","version":"0.9.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-51775","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-51775","date":"2026-11-02","epss":0.00871,"percentile":0.58863}],"risk":0.500825,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-51775","https://bitbucket.org/b_c/jose4j/issues/212","https://bitbucket.org/b_c/jose4j/commits/1afaa1e174b3","https://security.netapp.com/advisory/ntap-20241108-0002"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6qvw-249j-h44c","description":"jose4j denial of service via specifically crafted JWE"},"relatedVulnerabilities":[{"id":"CVE-2023-51775","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-51775","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-51775","date":"2026-11-02","epss":0.00871,"percentile":0.58863}],"urls":["https://bitbucket.org/b_c/jose4j/issues/212","https://security.netapp.com/advisory/ntap-20241108-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-51775","description":"The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value."}]},{"artifact":{"id":"0ae96c8bb001b7ff","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mvh2-crg5-v77c","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mvh2-crg5-v77c","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c","https://nvd.nist.gov/vuln/detail/CVE-2026-55833","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mvh2-crg5-v77c","description":"Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation"},"relatedVulnerabilities":[{"id":"CVE-2026-55833","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55833","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"41fd2c72127de89f","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mvh2-crg5-v77c","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mvh2-crg5-v77c","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c","https://nvd.nist.gov/vuln/detail/CVE-2026-55833","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mvh2-crg5-v77c","description":"Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation"},"relatedVulnerabilities":[{"id":"CVE-2026-55833","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55833","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"b400511196d0cd9e","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mvh2-crg5-v77c","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mvh2-crg5-v77c","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c","https://nvd.nist.gov/vuln/detail/CVE-2026-55833","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mvh2-crg5-v77c","description":"Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation"},"relatedVulnerabilities":[{"id":"CVE-2026-55833","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55833","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"27608fdc7273561f","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-93wv-jw9v-4972","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-93wv-jw9v-4972","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-08-01","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972","https://nvd.nist.gov/vuln/detail/CVE-2026-56819","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-93wv-jw9v-4972","description":"Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-56819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56819","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"fd269c6f3753e140","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-93wv-jw9v-4972","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-93wv-jw9v-4972","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-08-01","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972","https://nvd.nist.gov/vuln/detail/CVE-2026-56819","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-93wv-jw9v-4972","description":"Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-56819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56819","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"c469f4c848b8146f","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http2-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"cbf1a430ea44dbdedbcde16b185cbb95f28d72c7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http2-4.1.100.Final.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http2-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-93wv-jw9v-4972","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-93wv-jw9v-4972","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-08-01","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972","https://nvd.nist.gov/vuln/detail/CVE-2026-56819","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-93wv-jw9v-4972","description":"Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-56819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-11-02","epss":0.00665,"percentile":0.51799}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56819","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"0ae96c8bb001b7ff","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6jqx-86gh-f27w","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6jqx-86gh-f27w","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-11-02","epss":0.00665,"percentile":0.51798}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w","https://nvd.nist.gov/vuln/detail/CVE-2026-55831","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6jqx-86gh-f27w","description":"Netty SPDY SETTINGS frame count materializes unbounded settings map"},"relatedVulnerabilities":[{"id":"CVE-2026-55831","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-11-02","epss":0.00665,"percentile":0.51798}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55831","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"41fd2c72127de89f","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6jqx-86gh-f27w","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6jqx-86gh-f27w","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-11-02","epss":0.00665,"percentile":0.51798}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w","https://nvd.nist.gov/vuln/detail/CVE-2026-55831","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6jqx-86gh-f27w","description":"Netty SPDY SETTINGS frame count materializes unbounded settings map"},"relatedVulnerabilities":[{"id":"CVE-2026-55831","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-11-02","epss":0.00665,"percentile":0.51798}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55831","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"b400511196d0cd9e","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6jqx-86gh-f27w","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6jqx-86gh-f27w","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-11-02","epss":0.00665,"percentile":0.51798}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w","https://nvd.nist.gov/vuln/detail/CVE-2026-55831","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6jqx-86gh-f27w","description":"Netty SPDY SETTINGS frame count materializes unbounded settings map"},"relatedVulnerabilities":[{"id":"CVE-2026-55831","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-11-02","epss":0.00665,"percentile":0.51798}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55831","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"c7e641408779e5f1","cpes":["cpe:2.3:a:apache:commons-compress:1.21:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_compress:1.21:*:*:*:*:*:*:*","cpe:2.3:a:apache:compress:1.21:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.21:*:*:*:*:*:*:*"],"name":"commons-compress","purl":"pkg:maven/org.apache.commons/commons-compress@1.21","type":"java-archive","version":"1.21","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.commons_commons-compress-1.21.jar","manifestName":"","pomArtifactID":"commons-compress","archiveDigests":[{"value":"4ec95b60d4e86b5c95a0e919cb172a0af98011ef","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.commons_commons-compress-1.21.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.commons_commons-compress-1.21.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4265-ccf5-phj5","versionConstraint":">=1.21,<1.26.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-compress","version":"1.21"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4265-ccf5-phj5","fix":{"state":"fixed","versions":["1.26.0"],"available":[{"date":"2024-02-21","kind":"first-observed","version":"1.26.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":6.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-26308","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-26308","date":"2026-11-02","epss":0.00898,"percentile":0.59602}],"risk":0.49838999999999994,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-26308","https://lists.apache.org/thread/ch5yo2d21p7vlqrhll9b17otbyq4npfg","http://www.openwall.com/lists/oss-security/2024/02/19/2","https://security.netapp.com/advisory/ntap-20240307-0009"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4265-ccf5-phj5","description":"Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file"},"relatedVulnerabilities":[{"id":"CVE-2024-26308","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-26308","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-26308","date":"2026-11-02","epss":0.00898,"percentile":0.59602}],"urls":["http://www.openwall.com/lists/oss-security/2024/02/19/2","https://lists.apache.org/thread/ch5yo2d21p7vlqrhll9b17otbyq4npfg","https://security.netapp.com/advisory/ntap-20240307-0009/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-26308","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.\n\nUsers are recommended to upgrade to version 1.26, which fixes the issue."}]},{"artifact":{"id":"c6cad614092a4471","cpes":["cpe:2.3:a:apache:commons-compress:1.24.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_compress:1.24.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.24.0:*:*:*:*:*:*:*"],"name":"commons-compress","purl":"pkg:maven/org.apache.commons/commons-compress@1.24.0","type":"java-archive","version":"1.24.0","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:org.apache.commons:commons-compress","manifestName":"","pomArtifactID":"commons-compress","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4265-ccf5-phj5","versionConstraint":">=1.21,<1.26.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-compress","version":"1.24.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4265-ccf5-phj5","fix":{"state":"fixed","versions":["1.26.0"],"available":[{"date":"2024-02-21","kind":"first-observed","version":"1.26.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":6.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-26308","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-26308","date":"2026-11-02","epss":0.00898,"percentile":0.59602}],"risk":0.49838999999999994,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-26308","https://lists.apache.org/thread/ch5yo2d21p7vlqrhll9b17otbyq4npfg","http://www.openwall.com/lists/oss-security/2024/02/19/2","https://security.netapp.com/advisory/ntap-20240307-0009"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4265-ccf5-phj5","description":"Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file"},"relatedVulnerabilities":[{"id":"CVE-2024-26308","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-26308","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-26308","date":"2026-11-02","epss":0.00898,"percentile":0.59602}],"urls":["http://www.openwall.com/lists/oss-security/2024/02/19/2","https://lists.apache.org/thread/ch5yo2d21p7vlqrhll9b17otbyq4npfg","https://security.netapp.com/advisory/ntap-20240307-0009/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-26308","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.\n\nUsers are recommended to upgrade to version 1.26, which fixes the issue."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.28"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-50059","versionConstraint":">= 12, < 17.0.16||>= 18, < 21.0.8||>= 22, < 24.0.2||>= 9, < 11.0.28 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-50059","fix":{"state":"fixed","versions":["11.0.28","17.0.16","21.0.8","24.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"17.0.16"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.8"},{"date":"2025-09-04","kind":"first-observed","version":"24.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.28"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50059","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50059","date":"2026-11-02","epss":0.00615,"percentile":0.49489}],"risk":0.49507499999999993,"urls":["https://www.oracle.com/security-alerts/cpujul2025.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00014.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50059","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and  24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"629664b7ba8e78f1","cpes":["cpe:2.3:a:python3-jinja2:python3-jinja2:3.0.3-1:*:*:*:*:*:*:*","cpe:2.3:a:python3-jinja2:python3_jinja2:3.0.3-1:*:*:*:*:*:*:*","cpe:2.3:a:python3_jinja2:python3-jinja2:3.0.3-1:*:*:*:*:*:*:*","cpe:2.3:a:python3_jinja2:python3_jinja2:3.0.3-1:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-jinja2:3.0.3-1:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_jinja2:3.0.3-1:*:*:*:*:*:*:*"],"name":"python3-jinja2","purl":"pkg:deb/ubuntu/python3-jinja2@3.0.3-1?arch=all&distro=ubuntu-22.04&upstream=jinja2","type":"deb","version":"3.0.3-1","language":"","licenses":["BSD-3-Clause","GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3-jinja2/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3-jinja2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3-jinja2.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3-jinja2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3-jinja2.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3-jinja2.list"},{"path":"/var/lib/dpkg/info/python3-jinja2.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3-jinja2.postinst"},{"path":"/var/lib/dpkg/info/python3-jinja2.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3-jinja2.prerm"}],"upstreams":[{"name":"jinja2"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.3-1ubuntu0.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-34064","versionConstraint":"< 3.0.3-1ubuntu0.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"jinja2","version":"3.0.3-1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-34064","fix":{"state":"fixed","versions":["3.0.3-1ubuntu0.2"],"available":[{"date":"2024-05-28","kind":"advisory","version":"3.0.3-1ubuntu0.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-34064","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-34064","date":"2026-11-02","epss":0.00979,"percentile":0.62189}],"risk":0.4895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-34064"},"relatedVulnerabilities":[{"id":"CVE-2024-34064","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-34064","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-34064","date":"2026-11-02","epss":0.00979,"percentile":0.62189}],"urls":["https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb","https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/567XIGSZMABG6TSMYWD7MIYNJSUQQRUC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCLF44KY43BSVMTE6S53B4V5WP3FRRSE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS/","https://lists.debian.org/debian-lts-announce/2024/12/msg00009.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-34064","description":"Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This vulnerability is fixed in 3.1.4."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.26"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-21502","versionConstraint":"< 1.8.0_441||>= 1.9, < 8.0.441||>= 12, < 17.0.14||>= 18, < 21.0.6||>= 22, < 23.0.2||>= 9, < 11.0.26 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-21502","fix":{"state":"fixed","versions":["1.8.0_441","8.0.441","11.0.26","17.0.14","21.0.6","23.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_441"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.441"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.14"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.6"},{"date":"2025-09-04","kind":"first-observed","version":"23.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.26"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-21502","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-21502","date":"2026-11-02","epss":0.00986,"percentile":0.624}],"risk":0.48314000000000007,"urls":["https://www.oracle.com/security-alerts/cpujan2025.html","http://www.openwall.com/lists/oss-security/2025/01/25/6","https://lists.debian.org/debian-lts-announce/2025/01/msg00031.html","https://lists.debian.org/debian-lts-announce/2025/02/msg00004.html","https://security.netapp.com/advisory/ntap-20250124-0009/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-21502","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM for JDK: 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM Enterprise Edition: 20.3.16 and  21.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"b9d62df08eb83108","cpes":["cpe:2.3:a:org.eclipse.jetty:jetty-http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty-http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty_http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty-http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty_http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_http:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:10.0.15:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:10.0.15:*:*:*:*:*:*:*"],"name":"jetty-http","purl":"pkg:maven/org.eclipse.jetty/jetty-http@10.0.15","type":"java-archive","version":"10.0.15","language":"java","licenses":[],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar:org.eclipse.jetty:jetty-http","manifestName":"","pomArtifactID":"jetty-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"12.0.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qh8g-58pp-2wxh","versionConstraint":">=7.0.0,<=12.0.11 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-http","version":"10.0.15"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qh8g-58pp-2wxh","fix":{"state":"fixed","versions":["12.0.12"],"available":[{"date":"2024-10-15","kind":"first-observed","version":"12.0.12"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6763","cwe":"CWE-1286","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2024-6763","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6763","date":"2026-11-02","epss":0.00965,"percentile":0.61703}],"risk":0.48250000000000004,"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh","https://nvd.nist.gov/vuln/detail/CVE-2024-6763","https://github.com/jetty/jetty.project/pull/12012","https://gitlab.eclipse.org/security/cve-assignement/-/issues/25","https://security.netapp.com/advisory/ntap-20250306-0005"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qh8g-58pp-2wxh","description":"Eclipse Jetty URI parsing of invalid authority"},"relatedVulnerabilities":[{"id":"CVE-2024-6763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"emo@eclipse.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6763","cwe":"CWE-1286","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2024-6763","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6763","date":"2026-11-02","epss":0.00965,"percentile":0.61703}],"urls":["https://github.com/jetty/jetty.project/pull/12012","https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh","https://gitlab.eclipse.org/security/cve-assignement/-/issues/25","https://security.netapp.com/advisory/ntap-20250306-0005/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6763","description":"Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.\n\nThe HttpURI class does insufficient validation on the authority segment of a URI.  However the behaviour of HttpURI\n differs from the common browsers in how it handles a URI that would be \nconsidered invalid if fully validated against the RRC.  Specifically HttpURI\n and the browser may differ on the value of the host extracted from an \ninvalid URI and thus a combination of Jetty and a vulnerable browser may\n be vulnerable to a open redirect attack or to a SSRF attack if the URI \nis used after passing validation checks."}]},{"artifact":{"id":"f0642bd85aa62ed2","cpes":["cpe:2.3:a:org.eclipse.jetty.http:jetty-http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.http:jetty_http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty-http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty_http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty-http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty_http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.http:jetty:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty-http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.http:http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty-http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty_http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty-http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty_http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:http:jetty-http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:http:jetty_http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:http:jetty:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:jetty:http:10.0.18:*:*:*:*:*:*:*","cpe:2.3:a:http:http:10.0.18:*:*:*:*:*:*:*"],"name":"jetty-http","purl":"pkg:maven/org.eclipse.jetty/jetty-http@10.0.18","type":"java-archive","version":"10.0.18","language":"java","licenses":["https://www.eclipse.org/legal/epl-2.0/, https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jetty-http-10.0.18.jar","manifestName":"","pomArtifactID":"jetty-http","archiveDigests":[{"value":"9b7f2b580bdcf2a9c27168eac58276c7e6e99ccf","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jetty-http-10.0.18.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jetty-http-10.0.18.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"12.0.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qh8g-58pp-2wxh","versionConstraint":">=7.0.0,<=12.0.11 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-http","version":"10.0.18"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qh8g-58pp-2wxh","fix":{"state":"fixed","versions":["12.0.12"],"available":[{"date":"2024-10-15","kind":"first-observed","version":"12.0.12"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6763","cwe":"CWE-1286","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2024-6763","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6763","date":"2026-11-02","epss":0.00965,"percentile":0.61703}],"risk":0.48250000000000004,"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh","https://nvd.nist.gov/vuln/detail/CVE-2024-6763","https://github.com/jetty/jetty.project/pull/12012","https://gitlab.eclipse.org/security/cve-assignement/-/issues/25","https://security.netapp.com/advisory/ntap-20250306-0005"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qh8g-58pp-2wxh","description":"Eclipse Jetty URI parsing of invalid authority"},"relatedVulnerabilities":[{"id":"CVE-2024-6763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"emo@eclipse.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6763","cwe":"CWE-1286","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2024-6763","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6763","date":"2026-11-02","epss":0.00965,"percentile":0.61703}],"urls":["https://github.com/jetty/jetty.project/pull/12012","https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh","https://gitlab.eclipse.org/security/cve-assignement/-/issues/25","https://security.netapp.com/advisory/ntap-20250306-0005/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6763","description":"Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.\n\nThe HttpURI class does insufficient validation on the authority segment of a URI.  However the behaviour of HttpURI\n differs from the common browsers in how it handles a URI that would be \nconsidered invalid if fully validated against the RRC.  Specifically HttpURI\n and the browser may differ on the value of the host extracted from an \ninvalid URI and thus a combination of Jetty and a vulnerable browser may\n be vulnerable to a open redirect attack or to a SSRF attack if the URI \nis used after passing validation checks."}]},{"artifact":{"id":"c76e629c8d688bb1","cpes":["cpe:2.3:a:libzstd1:libzstd1:1.4.8\\+dfsg-3build1:*:*:*:*:*:*:*"],"name":"libzstd1","purl":"pkg:deb/ubuntu/libzstd1@1.4.8%2Bdfsg-3build1?arch=amd64&distro=ubuntu-22.04&upstream=libzstd","type":"deb","version":"1.4.8+dfsg-3build1","language":"","licenses":["BSD-3-clause","Expat","GPL-2","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzstd1/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libzstd1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzstd1:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libzstd1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libzstd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-4899","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libzstd","version":"1.4.8+dfsg-3build1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-4899","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4899","date":"2026-11-02","epss":0.01588,"percentile":0.75629}],"risk":0.47639999999999993,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-4899"},"relatedVulnerabilities":[{"id":"CVE-2022-4899","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4899","date":"2026-11-02","epss":0.01588,"percentile":0.75629}],"urls":["https://github.com/facebook/zstd/issues/3200","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C63HAGVLQA6FJNDCHR7CNZZL6VSLILB2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEHRBBYYTPA4DETOM5XAKGCP37NUTLOA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QYLDK6ODVC4LJSDULLX6Q2YHTFOWABCN/","https://security.netapp.com/advisory/ntap-20230725-0005/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4899","description":"A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.31"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-34282","versionConstraint":"< 1.8.0_492||>= 1.9, < 8.0.492||>= 12, < 17.0.19||>= 18, < 21.0.11||>= 22, < 25.0.3||>= 26, < 26.0.1||>= 9, < 11.0.31 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-34282","fix":{"state":"fixed","versions":["1.8.0_492","8.0.492","11.0.31","17.0.19","21.0.11","25.0.3","26.0.1"],"available":[{"date":"2026-04-24","kind":"first-observed","version":"1.8.0_492"},{"date":"2026-04-24","kind":"first-observed","version":"8.0.492"},{"date":"2026-04-24","kind":"first-observed","version":"17.0.19"},{"date":"2026-04-24","kind":"first-observed","version":"21.0.11"},{"date":"2026-04-24","kind":"first-observed","version":"25.0.3"},{"date":"2026-04-24","kind":"first-observed","version":"26.0.1"},{"date":"2026-04-24","kind":"first-observed","version":"11.0.31"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34282","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-34282","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-34282","date":"2026-11-02","epss":0.00635,"percentile":0.50447}],"risk":0.47624999999999995,"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html","https://access.redhat.com/errata/RHSA-2026:11403","https://access.redhat.com/errata/RHSA-2026:11655","https://access.redhat.com/errata/RHSA-2026:11822","https://access.redhat.com/errata/RHSA-2026:11829","https://access.redhat.com/errata/RHSA-2026:11902","https://access.redhat.com/errata/RHSA-2026:22328","https://access.redhat.com/errata/RHSA-2026:9254","https://access.redhat.com/errata/RHSA-2026:9686","https://access.redhat.com/errata/RHSA-2026:9687","https://access.redhat.com/errata/RHSA-2026:9688","https://access.redhat.com/errata/RHSA-2026:9689","https://access.redhat.com/errata/RHSA-2026:9691","https://access.redhat.com/errata/RHSA-2026:9693","https://access.redhat.com/errata/RHSA-2026:9694","https://access.redhat.com/security/cve/CVE-2026-34282","https://bugzilla.redhat.com/show_bug.cgi?id=2460044","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34282.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34282","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and  21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."},"relatedVulnerabilities":[]},{"artifact":{"id":"2aeacb91bdecf6f4","cpes":["cpe:2.3:a:org.hibernate.validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:org.hibernate.validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate-validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate-validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate_validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate_validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:org.hibernate.validator:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate-validator:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate_validator:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:validator:validator:6.0.23.Final:*:*:*:*:*:*:*"],"name":"hibernate-validator","purl":"pkg:maven/org.hibernate.validator/hibernate-validator@6.0.23.Final","type":"java-archive","version":"6.0.23.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"org.hibernate.validator","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins-setup/com.atlassian.plugins.rest.atlassian-rest-module-7.1.9.jar:org.hibernate.validator:hibernate-validator","manifestName":"","pomArtifactID":"hibernate-validator","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins-setup/com.atlassian.plugins.rest.atlassian-rest-module-7.1.9.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins-setup/com.atlassian.plugins.rest.atlassian-rest-module-7.1.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.2.0.CR1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7v6m-28jr-rg84","versionConstraint":"<6.2.0.CR1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.hibernate.validator:hibernate-validator","version":"6.0.23.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7v6m-28jr-rg84","fix":{"state":"fixed","versions":["6.2.0.CR1"],"available":[{"date":"2025-06-05","kind":"first-observed","version":"6.2.0.CR1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-35036","cwe":"CWE-94","type":"Secondary","source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"epss":[{"cve":"CVE-2025-35036","date":"2026-11-02","epss":0.00781,"percentile":0.55957}],"risk":0.47250499999999995,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-35036","https://github.com/hibernate/hibernate-validator/pull/1138","https://github.com/hibernate/hibernate-validator/commit/05f795bb7cf18856004f40e5042709e550ed0d6e","https://github.com/hibernate/hibernate-validator/commit/254858d9dcc4e7cd775d1b0f47f482218077c5e1","https://github.com/hibernate/hibernate-validator/commit/d2db40b9e7d22c7a0b44d7665242dfc7b4d14d78","https://github.com/hibernate/hibernate-validator/commit/e076293b0ee1bfa97b6e67d05ad9eee1ad77e893","https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#section-hibernateconstraintvalidatorcontext","https://github.com/hibernate/hibernate-validator/compare/6.1.7.Final...6.2.0.Final","https://hibernate.atlassian.net/browse/HV-1816","https://hibernate.org/validator/documentation/migration-guide/#6-2-0-cr1","https://in.relation.to/2021/01/06/hibernate-validator-700-62-final-released/#expression-language","https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428","https://www.cve.org/CVERecord?id=CVE-2020-5245","https://www.cve.org/CVERecord?id=CVE-2025-4428"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7v6m-28jr-rg84","description":"Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language"},"relatedVulnerabilities":[{"id":"CVE-2025-35036","cvss":[{"type":"Secondary","source":"9119a7d8-5eab-497f-8521-727c672e3725","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"9119a7d8-5eab-497f-8521-727c672e3725","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-35036","cwe":"CWE-94","type":"Secondary","source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"epss":[{"cve":"CVE-2025-35036","date":"2026-11-02","epss":0.00781,"percentile":0.55957}],"urls":["https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#section-hibernateconstraintvalidatorcontext","https://github.com/hibernate/hibernate-validator/commit/05f795bb7cf18856004f40e5042709e550ed0d6e","https://github.com/hibernate/hibernate-validator/commit/254858d9dcc4e7cd775d1b0f47f482218077c5e1","https://github.com/hibernate/hibernate-validator/commit/d2db40b9e7d22c7a0b44d7665242dfc7b4d14d78","https://github.com/hibernate/hibernate-validator/commit/e076293b0ee1bfa97b6e67d05ad9eee1ad77e893","https://github.com/hibernate/hibernate-validator/compare/6.1.7.Final...6.2.0.Final","https://github.com/hibernate/hibernate-validator/pull/1138","https://hibernate.atlassian.net/browse/HV-1816","https://hibernate.org/validator/documentation/migration-guide/#6-2-0-cr1","https://in.relation.to/2021/01/06/hibernate-validator-700-62-final-released/#expression-language","https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/","https://www.cve.org/CVERecord?id=CVE-2020-5245","https://www.cve.org/CVERecord?id=CVE-2025-4428"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-35036","description":"Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data."}]},{"artifact":{"id":"11c26d52decfd1f8","cpes":["cpe:2.3:a:org.hibernate.validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:org.hibernate.validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate-validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate-validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate_validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate_validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:org.hibernate.validator:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate-validator:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate_validator:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:validator:validator:6.0.23.Final:*:*:*:*:*:*:*"],"name":"hibernate-validator","purl":"pkg:maven/org.hibernate.validator/hibernate-validator@6.0.23.Final","type":"java-archive","version":"6.0.23.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"org.hibernate.validator","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.plugins.rest.atlassian-rest-module-7.1.9.jar:org.hibernate.validator:hibernate-validator","manifestName":"","pomArtifactID":"hibernate-validator","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.plugins.rest.atlassian-rest-module-7.1.9.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.plugins.rest.atlassian-rest-module-7.1.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.2.0.CR1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7v6m-28jr-rg84","versionConstraint":"<6.2.0.CR1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.hibernate.validator:hibernate-validator","version":"6.0.23.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7v6m-28jr-rg84","fix":{"state":"fixed","versions":["6.2.0.CR1"],"available":[{"date":"2025-06-05","kind":"first-observed","version":"6.2.0.CR1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-35036","cwe":"CWE-94","type":"Secondary","source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"epss":[{"cve":"CVE-2025-35036","date":"2026-11-02","epss":0.00781,"percentile":0.55957}],"risk":0.47250499999999995,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-35036","https://github.com/hibernate/hibernate-validator/pull/1138","https://github.com/hibernate/hibernate-validator/commit/05f795bb7cf18856004f40e5042709e550ed0d6e","https://github.com/hibernate/hibernate-validator/commit/254858d9dcc4e7cd775d1b0f47f482218077c5e1","https://github.com/hibernate/hibernate-validator/commit/d2db40b9e7d22c7a0b44d7665242dfc7b4d14d78","https://github.com/hibernate/hibernate-validator/commit/e076293b0ee1bfa97b6e67d05ad9eee1ad77e893","https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#section-hibernateconstraintvalidatorcontext","https://github.com/hibernate/hibernate-validator/compare/6.1.7.Final...6.2.0.Final","https://hibernate.atlassian.net/browse/HV-1816","https://hibernate.org/validator/documentation/migration-guide/#6-2-0-cr1","https://in.relation.to/2021/01/06/hibernate-validator-700-62-final-released/#expression-language","https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428","https://www.cve.org/CVERecord?id=CVE-2020-5245","https://www.cve.org/CVERecord?id=CVE-2025-4428"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7v6m-28jr-rg84","description":"Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language"},"relatedVulnerabilities":[{"id":"CVE-2025-35036","cvss":[{"type":"Secondary","source":"9119a7d8-5eab-497f-8521-727c672e3725","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"9119a7d8-5eab-497f-8521-727c672e3725","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-35036","cwe":"CWE-94","type":"Secondary","source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"epss":[{"cve":"CVE-2025-35036","date":"2026-11-02","epss":0.00781,"percentile":0.55957}],"urls":["https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#section-hibernateconstraintvalidatorcontext","https://github.com/hibernate/hibernate-validator/commit/05f795bb7cf18856004f40e5042709e550ed0d6e","https://github.com/hibernate/hibernate-validator/commit/254858d9dcc4e7cd775d1b0f47f482218077c5e1","https://github.com/hibernate/hibernate-validator/commit/d2db40b9e7d22c7a0b44d7665242dfc7b4d14d78","https://github.com/hibernate/hibernate-validator/commit/e076293b0ee1bfa97b6e67d05ad9eee1ad77e893","https://github.com/hibernate/hibernate-validator/compare/6.1.7.Final...6.2.0.Final","https://github.com/hibernate/hibernate-validator/pull/1138","https://hibernate.atlassian.net/browse/HV-1816","https://hibernate.org/validator/documentation/migration-guide/#6-2-0-cr1","https://in.relation.to/2021/01/06/hibernate-validator-700-62-final-released/#expression-language","https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/","https://www.cve.org/CVERecord?id=CVE-2020-5245","https://www.cve.org/CVERecord?id=CVE-2025-4428"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-35036","description":"Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data."}]},{"artifact":{"id":"415edc91fbc5d43e","cpes":["cpe:2.3:a:org.hibernate.validator.hibernate-validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:org.hibernate.validator.hibernate-validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:org.hibernate.validator.hibernate-validator:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:org.hibernate.validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:org.hibernate.validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate-validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate-validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate_validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate_validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:org.hibernate.validator:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate-validator:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate_validator:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:validator:hibernate-validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:validator:hibernate_validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:hibernate:validator:6.0.23.Final:*:*:*:*:*:*:*","cpe:2.3:a:validator:validator:6.0.23.Final:*:*:*:*:*:*:*"],"name":"hibernate-validator","purl":"pkg:maven/org.hibernate.validator/hibernate-validator@6.0.23.Final","type":"java-archive","version":"6.0.23.Final","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.hibernate.validator","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.hibernate.validator_hibernate-validator-6.0.23.Final.jar","manifestName":"","pomArtifactID":"hibernate-validator","archiveDigests":[{"value":"16c36fcd283bf3f774e09a2d525194f29219f758","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.hibernate.validator_hibernate-validator-6.0.23.Final.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.hibernate.validator_hibernate-validator-6.0.23.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.2.0.CR1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7v6m-28jr-rg84","versionConstraint":"<6.2.0.CR1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.hibernate.validator:hibernate-validator","version":"6.0.23.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7v6m-28jr-rg84","fix":{"state":"fixed","versions":["6.2.0.CR1"],"available":[{"date":"2025-06-05","kind":"first-observed","version":"6.2.0.CR1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-35036","cwe":"CWE-94","type":"Secondary","source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"epss":[{"cve":"CVE-2025-35036","date":"2026-11-02","epss":0.00781,"percentile":0.55957}],"risk":0.47250499999999995,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-35036","https://github.com/hibernate/hibernate-validator/pull/1138","https://github.com/hibernate/hibernate-validator/commit/05f795bb7cf18856004f40e5042709e550ed0d6e","https://github.com/hibernate/hibernate-validator/commit/254858d9dcc4e7cd775d1b0f47f482218077c5e1","https://github.com/hibernate/hibernate-validator/commit/d2db40b9e7d22c7a0b44d7665242dfc7b4d14d78","https://github.com/hibernate/hibernate-validator/commit/e076293b0ee1bfa97b6e67d05ad9eee1ad77e893","https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#section-hibernateconstraintvalidatorcontext","https://github.com/hibernate/hibernate-validator/compare/6.1.7.Final...6.2.0.Final","https://hibernate.atlassian.net/browse/HV-1816","https://hibernate.org/validator/documentation/migration-guide/#6-2-0-cr1","https://in.relation.to/2021/01/06/hibernate-validator-700-62-final-released/#expression-language","https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428","https://www.cve.org/CVERecord?id=CVE-2020-5245","https://www.cve.org/CVERecord?id=CVE-2025-4428"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7v6m-28jr-rg84","description":"Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language"},"relatedVulnerabilities":[{"id":"CVE-2025-35036","cvss":[{"type":"Secondary","source":"9119a7d8-5eab-497f-8521-727c672e3725","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"9119a7d8-5eab-497f-8521-727c672e3725","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-35036","cwe":"CWE-94","type":"Secondary","source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"epss":[{"cve":"CVE-2025-35036","date":"2026-11-02","epss":0.00781,"percentile":0.55957}],"urls":["https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#section-hibernateconstraintvalidatorcontext","https://github.com/hibernate/hibernate-validator/commit/05f795bb7cf18856004f40e5042709e550ed0d6e","https://github.com/hibernate/hibernate-validator/commit/254858d9dcc4e7cd775d1b0f47f482218077c5e1","https://github.com/hibernate/hibernate-validator/commit/d2db40b9e7d22c7a0b44d7665242dfc7b4d14d78","https://github.com/hibernate/hibernate-validator/commit/e076293b0ee1bfa97b6e67d05ad9eee1ad77e893","https://github.com/hibernate/hibernate-validator/compare/6.1.7.Final...6.2.0.Final","https://github.com/hibernate/hibernate-validator/pull/1138","https://hibernate.atlassian.net/browse/HV-1816","https://hibernate.org/validator/documentation/migration-guide/#6-2-0-cr1","https://in.relation.to/2021/01/06/hibernate-validator-700-62-final-released/#expression-language","https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/","https://www.cve.org/CVERecord?id=CVE-2020-5245","https://www.cve.org/CVERecord?id=CVE-2025-4428"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-35036","description":"Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data."}]},{"artifact":{"id":"7e51f2d66453ad51","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar:META-INF/lib/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar:META-INF/lib/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"8b225a368370af7c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"051e7df316b5a531","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"7bbe612d6a8369b0","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"3ad576839e998952","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/jackson-databind-2.15.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"9353b021f10c307c00328f52090de2bdb4b6ff9c","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/jackson-databind-2.15.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"93ac7e2aa6804f54","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar:META-INF/lib/jackson-databind-2.15.3.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"a734bc2c47a9453c4efa772461a3aeb273c010d9","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar:META-INF/lib/jackson-databind-2.15.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"e7a8f6a39fc0ef2d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-databind-2.16.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"55d5220f811f88ce","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-databind-2.16.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"ed97116d7d90df11","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"a89c3f9fac63d225","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-02","epss":0.00628,"percentile":0.50099}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.22"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-20921","versionConstraint":"< 1.8.0_402||>= 1.9, < 8.0.402||>= 12, < 17.0.10||>= 18, < 21.0.2||>= 9, < 11.0.22 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-20921","fix":{"state":"fixed","versions":["1.8.0_402","8.0.402","11.0.22","17.0.10","21.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_402"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.402"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.10"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.22"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-20921","cwe":"CWE-276","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-20921","date":"2026-11-02","epss":0.00864,"percentile":0.58632}],"risk":0.4708800000000001,"urls":["https://www.oracle.com/security-alerts/cpujan2024.html","https://security.netapp.com/advisory/ntap-20240201-0002/","https://security.netapp.com/advisory/ntap-20241108-0002/","https://openjdk.org/groups/vulnerability/advisories/2024-01-16"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-20921","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and  22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"cecd721853682098","cpes":["cpe:2.3:a:apache:struts2-core:6.3.0.2-atlassian-3:*:*:*:*:*:*:*","cpe:2.3:a:apache:struts2_core:6.3.0.2-atlassian-3:*:*:*:*:*:*:*","cpe:2.3:a:apache:2-core:6.3.0.2-atlassian-3:*:*:*:*:*:*:*","cpe:2.3:a:apache:2_core:6.3.0.2-atlassian-3:*:*:*:*:*:*:*","cpe:2.3:a:apache:struts:6.3.0.2-atlassian-3:*:*:*:*:*:*:*"],"name":"struts2-core","purl":"pkg:maven/org.apache.struts/struts2-core@6.3.0.2-atlassian-3","type":"java-archive","version":"6.3.0.2-atlassian-3","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.struts","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.struts_struts2-core-6.3.0.2-atlassian-3.jar","manifestName":"","pomArtifactID":"struts2-core","archiveDigests":[{"value":"1924a6457f174e518d1232a7b82996a2c9101441","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.struts_struts2-core-6.3.0.2-atlassian-3.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.struts_struts2-core-6.3.0.2-atlassian-3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.8.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rg58-xhh7-mqjw","versionConstraint":">=2.0.0,<6.8.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.struts:struts2-core","version":"6.3.0.2-atlassian-3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rg58-xhh7-mqjw","fix":{"state":"fixed","versions":["6.8.0"],"available":[{"date":"2025-12-10","kind":"first-observed","version":"6.8.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66675","cwe":"CWE-459","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-66675","date":"2026-11-02","epss":0.00594,"percentile":0.48406}],"risk":0.4662899999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-66675","https://cve.org/CVERecord?id=CVE-2025-64775","https://cwiki.apache.org/confluence/display/WW/S2-068","https://github.com/apache/struts/commit/831568929cfba700f790f6ebe6e335f9f33fb468"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rg58-xhh7-mqjw","description":"Apache Struts has a Denial of Service vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-66675","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66675","cwe":"CWE-459","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-66675","date":"2026-11-02","epss":0.00594,"percentile":0.48406}],"urls":["https://cve.org/CVERecord?id=CVE-2025-64775","https://cwiki.apache.org/confluence/display/WW/S2-068"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66675","description":"Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.\n\nThis issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3.\n\nUsers are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.\n\nIt's related to  https://cve.org/CVERecord?id=CVE-2025-64775  - this CVE addresses missing affected version 6.7.4"}]},{"artifact":{"id":"3058891d9c69e832","cpes":["cpe:2.3:a:com.atlassian.confluence:confluence:8.7.2:*:*:*:*:*:*:*","cpe:2.3:a:confluence:confluence:8.7.2:*:*:*:*:*:*:*","cpe:2.3:a:atlassian:confluence:8.7.2:*:*:*:*:*:*:*"],"name":"confluence","purl":"pkg:maven/com.atlassian.confluence/confluence@8.7.2","type":"java-archive","version":"8.7.2","language":"java","licenses":[],"metadata":{"pomGroupID":"com.atlassian.confluence","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","manifestName":"","pomArtifactID":"confluence","archiveDigests":[{"value":"afaf3eba1f92068ba7584de95e3aafadc7dc66c5","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.confluence_confluence-8.7.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.2.21"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-21580","versionConstraint":"< 9.2.21||>= 10, < 10.2.13 (maven)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.atlassian.confluence:confluence","version":"8.7.2"},"language":"java","namespace":"nvd:language:java"}}],"vulnerability":{"id":"CVE-2026-21580","fix":{"state":"fixed","versions":["9.2.21","10.2.13"],"available":[{"date":"2026-08-22","kind":"first-observed","version":"9.2.21"},{"date":"2026-08-22","kind":"first-observed","version":"10.2.13"}]},"cvss":[{"type":"Secondary","source":"security@atlassian.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21580","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-21580","date":"2026-11-02","epss":0.00508,"percentile":0.43409}],"risk":0.46482000000000007,"urls":["https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999768","https://jira.atlassian.com/browse/CONFSERVER-104381"],"severity":"Critical","namespace":"nvd:language:java","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21580","description":"This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center and Server.\r\n\r\nThis Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability, with a CVSS Score of 8.6, allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser, perform actions as a higher-privileged user, and to get into the system utilizing loopholes exposed from security best-practices being overlooked.\r\n\r\nAtlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\r\n Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.21\r\n\r\n Confluence Data Center and Server 10.2: Upgrade to a release greater than or equal to 10.2.13\r\n\r\nSee the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center and Server from the download center ([https://www.atlassian.com/software/confluence/download-archives]).\r\n\r\nThis vulnerability was reported via our Bug Bounty program."},"relatedVulnerabilities":[]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.24"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-21140","versionConstraint":"< 1.8.0_422||>= 1.9, < 8.0.422||>= 12, < 17.0.12||>= 18, < 21.0.4||>= 22, < 22.0.2||>= 9, < 11.0.24 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-21140","fix":{"state":"fixed","versions":["1.8.0_422","8.0.422","11.0.24","17.0.12","21.0.4","22.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_422"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.422"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.12"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.4"},{"date":"2025-09-04","kind":"first-observed","version":"22.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.24"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21140","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-21140","date":"2026-11-02","epss":0.0094,"percentile":0.60947}],"risk":0.4606,"urls":["https://security.netapp.com/advisory/ntap-20240719-0008/","https://www.oracle.com/security-alerts/cpujul2024.html","https://openjdk.org/groups/vulnerability/advisories/2024-07-16"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21140","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.23"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-21011","versionConstraint":"< 1.8.0_412||>= 1.9, < 8.0.412||>= 12, < 17.0.11||>= 18, < 21.0.3||>= 22, < 22.0.1||>= 9, < 11.0.23 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-21011","fix":{"state":"fixed","versions":["1.8.0_412","8.0.412","11.0.23","17.0.11","21.0.3","22.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_412"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.412"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.11"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.3"},{"date":"2025-09-04","kind":"first-observed","version":"22.0.1"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.23"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21011","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-21011","date":"2026-11-02","epss":0.01372,"percentile":0.71959}],"risk":0.4596199999999999,"urls":["https://lists.debian.org/debian-lts-announce/2024/04/msg00014.html","https://security.netapp.com/advisory/ntap-20240426-0004/","https://www.oracle.com/security-alerts/cpuapr2024.html","https://openjdk.org/groups/vulnerability/advisories/2024-04-16"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21011","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22;   Oracle GraalVM Enterprise Edition: 20.3.13 and  21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"4d5407177cb8d0dd","cpes":["cpe:2.3:a:libssl3:libssl3:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:deb/ubuntu/libssl3@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04&upstream=openssl","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libssl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.29"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63072","versionConstraint":"< 3.0.2-0ubuntu1.29 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-63072","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.29"],"available":[{"date":"2026-08-25","kind":"advisory","version":"3.0.2-0ubuntu1.29"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-11-02","epss":0.00916,"percentile":0.60196}],"risk":0.45799999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63072"},"relatedVulnerabilities":[{"id":"CVE-2026-63072","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-11-02","epss":0.00916,"percentile":0.60196}],"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"1014a67cbf322356","cpes":["cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.12?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.0.2-0ubuntu1.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.2-0ubuntu1.29"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63072","versionConstraint":"< 3.0.2-0ubuntu1.29 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"openssl","version":"3.0.2-0ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-63072","fix":{"state":"fixed","versions":["3.0.2-0ubuntu1.29"],"available":[{"date":"2026-08-25","kind":"advisory","version":"3.0.2-0ubuntu1.29"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-11-02","epss":0.00916,"percentile":0.60196}],"risk":0.45799999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63072"},"relatedVulnerabilities":[{"id":"CVE-2026-63072","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-11-02","epss":0.00916,"percentile":0.60196}],"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.25"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-21235","versionConstraint":"< 1.8.0_432||>= 1.9, < 8.0.432||>= 12, < 17.0.13||>= 18, < 21.0.5||>= 22, < 23.0.1||>= 9, < 11.0.25 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-21235","fix":{"state":"fixed","versions":["1.8.0_432","8.0.432","11.0.25","17.0.13","21.0.5","23.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_432"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.432"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.13"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.5"},{"date":"2025-09-04","kind":"first-observed","version":"23.0.1"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.25"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21235","date":"2026-11-02","epss":0.00929,"percentile":0.60587}],"risk":0.45521,"urls":["https://www.oracle.com/security-alerts/cpuoct2024.html","https://lists.debian.org/debian-lts-announce/2024/10/msg00018.html","https://lists.debian.org/debian-lts-announce/2024/10/msg00020.html","https://openjdk.org/groups/vulnerability/advisories/2024-10-15"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21235","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23;   Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23;   Oracle GraalVM Enterprise Edition: 20.3.15 and  21.3.11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"cfda19effa7c6d29","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.3?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.3","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-32990","versionConstraint":"< 3.7.3-4ubuntu1.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-32990","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.7"],"available":[{"date":"2025-07-14","kind":"advisory","version":"3.7.3-4ubuntu1.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-32990","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32990","date":"2026-11-02","epss":0.00896,"percentile":0.59553}],"risk":0.44799999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-32990"},"relatedVulnerabilities":[{"id":"CVE-2025-32990","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-32990","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32990","date":"2026-11-02","epss":0.00896,"percentile":0.59553}],"urls":["https://access.redhat.com/errata/RHSA-2025:16115","https://access.redhat.com/errata/RHSA-2025:16116","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:17348","https://access.redhat.com/errata/RHSA-2025:17361","https://access.redhat.com/errata/RHSA-2025:17415","https://access.redhat.com/errata/RHSA-2025:19088","https://access.redhat.com/errata/RHSA-2025:22529","https://access.redhat.com/errata/RHSA-2026:7477","https://access.redhat.com/security/cve/CVE-2025-32990","https://bugzilla.redhat.com/show_bug.cgi?id=2359620","https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html","http://www.openwall.com/lists/oss-security/2025/07/11/3","https://lists.debian.org/debian-lts-announce/2025/08/msg00005.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-32990","description":"A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system."}]},{"artifact":{"id":"629664b7ba8e78f1","cpes":["cpe:2.3:a:python3-jinja2:python3-jinja2:3.0.3-1:*:*:*:*:*:*:*","cpe:2.3:a:python3-jinja2:python3_jinja2:3.0.3-1:*:*:*:*:*:*:*","cpe:2.3:a:python3_jinja2:python3-jinja2:3.0.3-1:*:*:*:*:*:*:*","cpe:2.3:a:python3_jinja2:python3_jinja2:3.0.3-1:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-jinja2:3.0.3-1:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_jinja2:3.0.3-1:*:*:*:*:*:*:*"],"name":"python3-jinja2","purl":"pkg:deb/ubuntu/python3-jinja2@3.0.3-1?arch=all&distro=ubuntu-22.04&upstream=jinja2","type":"deb","version":"3.0.3-1","language":"","licenses":["BSD-3-Clause","GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3-jinja2/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3-jinja2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3-jinja2.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3-jinja2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3-jinja2.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3-jinja2.list"},{"path":"/var/lib/dpkg/info/python3-jinja2.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3-jinja2.postinst"},{"path":"/var/lib/dpkg/info/python3-jinja2.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3-jinja2.prerm"}],"upstreams":[{"name":"jinja2"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.3-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-22195","versionConstraint":"< 3.0.3-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"jinja2","version":"3.0.3-1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-22195","fix":{"state":"fixed","versions":["3.0.3-1ubuntu0.1"],"available":[{"date":"2024-01-25","kind":"advisory","version":"3.0.3-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-22195","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-22195","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-22195","date":"2026-11-02","epss":0.00892,"percentile":0.59425}],"risk":0.44600000000000006,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-22195"},"relatedVulnerabilities":[{"id":"CVE-2024-22195","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-22195","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-22195","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-22195","date":"2026-11-02","epss":0.00892,"percentile":0.59425}],"urls":["https://github.com/pallets/jinja/releases/tag/3.1.3","https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95","https://lists.debian.org/debian-lts-announce/2024/01/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5XCWZD464AJJJUBOO7CMPXQ4ROBC6JX2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DELCVUUYX75I5K4Q5WMJG4MUZJA6VAIP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7YWRBX6JQCWC2XXCTZ55C7DPMGICCN3/","https://lists.debian.org/debian-lts-announce/2024/12/msg00009.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-22195","description":"Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based."}]},{"artifact":{"id":"868c3562ab4f302a","cpes":["cpe:2.3:a:org.springframework:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring_web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring_web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-web:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_web:5.3.30:*:*:*:*:*:*:*"],"name":"spring-web","purl":"pkg:maven/org.springframework/spring-web@5.3.30","type":"java-archive","version":"5.3.30","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-web-5.3.30.jar","manifestName":"","pomArtifactID":"spring-web","archiveDigests":[{"value":"e1a1fd179650d4ccbf95d3f475bf1050a1a84484","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-web-5.3.30.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-web-5.3.30.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.3.38"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2rmj-mq67-h97g","versionConstraint":"<5.3.38 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-web","version":"5.3.30"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-2rmj-mq67-h97g","fix":{"state":"fixed","versions":["5.3.38"],"available":[{"date":"2024-09-25","kind":"first-observed","version":"5.3.38"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38809","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-38809","date":"2026-11-02","epss":0.00852,"percentile":0.58253}],"risk":0.43878,"urls":["https://github.com/spring-projects/spring-framework/issues/33372","https://github.com/spring-projects/spring-framework/commit/582bfccbb72e5c8959a0b472d1dc7d03a20520f3","https://github.com/spring-projects/spring-framework/commit/8d16a50907c11f7e6b407d878a26e84eba08a533","https://github.com/spring-projects/spring-framework/commit/bb17ad8314b81850a939fd265fb53b3361705e85","https://spring.io/security/cve-2024-38809","https://nvd.nist.gov/vuln/detail/CVE-2024-38809"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2rmj-mq67-h97g","description":"Spring Framework DoS via conditional HTTP request"},"relatedVulnerabilities":[{"id":"CVE-2024-38809","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38809","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-38809","date":"2026-11-02","epss":0.00852,"percentile":0.58253}],"urls":["https://spring.io/security/cve-2024-38809","https://security.netapp.com/advisory/ntap-20240920-0003/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-38809","description":"Applications that parse ETags from \"If-Match\" or \"If-None-Match\" request headers are vulnerable to DoS attack.\n\nUsers of affected versions should upgrade to the corresponding fixed version.\n\nUsers of older, unsupported versions could enforce a size limit on \"If-Match\" and \"If-None-Match\" headers, e.g. through a Filter."}]},{"artifact":{"id":"0311d276927b1433","cpes":["cpe:2.3:a:net.minidev.json-smart:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:net.minidev.json-smart:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:net.minidev:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:net.minidev:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json-smart:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json-smart:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json_smart:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json_smart:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:minidev:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:minidev:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json:json_smart:2.5.0:*:*:*:*:*:*:*"],"name":"json-smart","purl":"pkg:maven/net.minidev/json-smart@2.5.0","type":"java-archive","version":"2.5.0","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"net.minidev","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.minidev_json-smart-2.5.0.jar","manifestName":"","pomArtifactID":"json-smart","archiveDigests":[{"value":"57a64f421b472849c40e77d2e7cce3a141b41e99","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.minidev_json-smart-2.5.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.minidev_json-smart-2.5.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.5.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pq2g-wx69-c263","versionConstraint":">=2.5.0,<2.5.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"net.minidev:json-smart","version":"2.5.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pq2g-wx69-c263","fix":{"state":"fixed","versions":["2.5.2"],"available":[{"date":"2025-02-13","kind":"first-observed","version":"2.5.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-57699","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-57699","date":"2026-11-02","epss":0.00582,"percentile":0.47827}],"risk":0.4365,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-57699","https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699","https://nvd.nist.gov/vuln/detail/cve-2023-1370","https://github.com/netplex/json-smart-v2/issues/232","https://github.com/netplex/json-smart-v2/issues/233","https://github.com/netplex/json-smart-v2/issues/236","https://github.com/netplex/json-smart-v2/releases/tag/2.5.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pq2g-wx69-c263","description":"Netplex Json-smart Uncontrolled Recursion vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-57699","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-57699","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-57699","date":"2026-11-02","epss":0.00582,"percentile":0.47827}],"urls":["https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699","https://nvd.nist.gov/vuln/detail/cve-2023-1370"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-57699","description":"A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370."}]},{"artifact":{"id":"2912361492953810","cpes":["cpe:2.3:a:net.minidev:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:net.minidev:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json-smart:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json-smart:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json_smart:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json_smart:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:minidev:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:minidev:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json:json_smart:2.5.0:*:*:*:*:*:*:*"],"name":"json-smart","purl":"pkg:maven/net.minidev/json-smart@2.5.0","type":"java-archive","version":"2.5.0","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"net.minidev","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-collaborative-editor-plugin-18.7.51.jar:net.minidev:json-smart","manifestName":"","pomArtifactID":"json-smart","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-collaborative-editor-plugin-18.7.51.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-collaborative-editor-plugin-18.7.51.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.5.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pq2g-wx69-c263","versionConstraint":">=2.5.0,<2.5.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"net.minidev:json-smart","version":"2.5.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pq2g-wx69-c263","fix":{"state":"fixed","versions":["2.5.2"],"available":[{"date":"2025-02-13","kind":"first-observed","version":"2.5.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-57699","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-57699","date":"2026-11-02","epss":0.00582,"percentile":0.47827}],"risk":0.4365,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-57699","https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699","https://nvd.nist.gov/vuln/detail/cve-2023-1370","https://github.com/netplex/json-smart-v2/issues/232","https://github.com/netplex/json-smart-v2/issues/233","https://github.com/netplex/json-smart-v2/issues/236","https://github.com/netplex/json-smart-v2/releases/tag/2.5.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pq2g-wx69-c263","description":"Netplex Json-smart Uncontrolled Recursion vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-57699","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-57699","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-57699","date":"2026-11-02","epss":0.00582,"percentile":0.47827}],"urls":["https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699","https://nvd.nist.gov/vuln/detail/cve-2023-1370"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-57699","description":"A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370."}]},{"artifact":{"id":"df2fb4b7babeb1f3","cpes":["cpe:2.3:a:net.minidev:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:net.minidev:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json-smart:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json-smart:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json_smart:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json_smart:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:minidev:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:minidev:json_smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json:json-smart:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:json:json_smart:2.5.0:*:*:*:*:*:*:*"],"name":"json-smart","purl":"pkg:maven/net.minidev/json-smart@2.5.0","type":"java-archive","version":"2.5.0","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"net.minidev","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.jwt.jwt-plugin-3.3.2.jar:net.minidev:json-smart","manifestName":"","pomArtifactID":"json-smart","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.jwt.jwt-plugin-3.3.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.jwt.jwt-plugin-3.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.5.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pq2g-wx69-c263","versionConstraint":">=2.5.0,<2.5.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"net.minidev:json-smart","version":"2.5.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pq2g-wx69-c263","fix":{"state":"fixed","versions":["2.5.2"],"available":[{"date":"2025-02-13","kind":"first-observed","version":"2.5.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-57699","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-57699","date":"2026-11-02","epss":0.00582,"percentile":0.47827}],"risk":0.4365,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-57699","https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699","https://nvd.nist.gov/vuln/detail/cve-2023-1370","https://github.com/netplex/json-smart-v2/issues/232","https://github.com/netplex/json-smart-v2/issues/233","https://github.com/netplex/json-smart-v2/issues/236","https://github.com/netplex/json-smart-v2/releases/tag/2.5.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pq2g-wx69-c263","description":"Netplex Json-smart Uncontrolled Recursion vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-57699","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-57699","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-57699","date":"2026-11-02","epss":0.00582,"percentile":0.47827}],"urls":["https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699","https://nvd.nist.gov/vuln/detail/cve-2023-1370"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-57699","description":"A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.23"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-21068","versionConstraint":"< 1.8.0_412||>= 1.9, < 8.0.412||>= 12, < 17.0.11||>= 18, < 21.0.3||>= 22, < 22.0.1||>= 9, < 11.0.23 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-21068","fix":{"state":"fixed","versions":["1.8.0_412","8.0.412","11.0.23","17.0.11","21.0.3","22.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_412"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.412"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.11"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.3"},{"date":"2025-09-04","kind":"first-observed","version":"22.0.1"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.23"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21068","date":"2026-11-02","epss":0.013,"percentile":0.70442}],"risk":0.43549999999999994,"urls":["https://lists.debian.org/debian-lts-announce/2024/04/msg00014.html","https://security.netapp.com/advisory/ntap-20240426-0004/","https://www.oracle.com/security-alerts/cpuapr2024.html","https://openjdk.org/groups/vulnerability/advisories/2024-04-16"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21068","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2 and  22; Oracle GraalVM Enterprise Edition: 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.22"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-20919","versionConstraint":"< 1.8.0_402||>= 1.9, < 8.0.402||>= 12, < 17.0.10||>= 18, < 21.0.2||>= 9, < 11.0.22 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-20919","fix":{"state":"fixed","versions":["1.8.0_402","8.0.402","11.0.22","17.0.10","21.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_402"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.402"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.10"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.22"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-20919","date":"2026-11-02","epss":0.00799,"percentile":0.56541}],"risk":0.43545500000000004,"urls":["https://www.oracle.com/security-alerts/cpujan2024.html","https://security.netapp.com/advisory/ntap-20240201-0002/","https://security.netapp.com/advisory/ntap-20241108-0002/","https://openjdk.org/groups/vulnerability/advisories/2024-01-16"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-20919","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and  22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"05335dcf368b3f4b","cpes":["cpe:2.3:a:apache:log4j-core:2.17.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.17.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.17.2:*:*:*:*:*:*:*"],"name":"log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2","type":"java-archive","version":"2.17.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.logging.log4j","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:org.apache.logging.log4j:log4j-core","manifestName":"","pomArtifactID":"log4j-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.25.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vc5p-v9hr-52mj","versionConstraint":">=2.0-beta9,<2.25.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.17.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vc5p-v9hr-52mj","fix":{"state":"fixed","versions":["2.25.3"],"available":[{"date":"2025-12-20","kind":"first-observed","version":"2.25.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68161","cwe":"CWE-297","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-68161","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-68161","date":"2026-11-02","epss":0.00767,"percentile":0.55523}],"risk":0.43335499999999993,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-68161","https://github.com/apache/logging-log4j2/pull/4002","https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","https://logging.apache.org/security.html#CVE-2025-68161","https://github.com/apache/logging-log4j2/commit/3b93748497e1adbbd027fda8a5e7268ec5d0d578","http://www.openwall.com/lists/oss-security/2025/12/18/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vc5p-v9hr-52mj","description":"Apache Log4j does not verify the TLS hostname in its Socket Appender"},"relatedVulnerabilities":[{"id":"CVE-2025-68161","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68161","cwe":"CWE-297","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-68161","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-68161","date":"2026-11-02","epss":0.00767,"percentile":0.55523}],"urls":["https://github.com/apache/logging-log4j2/pull/4002","https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","https://logging.apache.org/security.html#CVE-2025-68161","http://www.openwall.com/lists/oss-security/2025/12/18/1","https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68161","description":"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the  verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName  configuration attribute or the  log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName  system property is set to true.\n\nThis issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:\n\n  *  The attacker is able to intercept or redirect network traffic between the client and the log receiver.\n  *  The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).\n\n\nUsers are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.\n\nAs an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates."}]},{"artifact":{"id":"b02bab32ef44b63e","cpes":["cpe:2.3:a:apache:log4j-core:2.18.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.18.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.18.0:*:*:*:*:*:*:*"],"name":"log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0","type":"java-archive","version":"2.18.0","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.logging.log4j","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar:org.apache.logging.log4j:log4j-core","manifestName":"","pomArtifactID":"log4j-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.25.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vc5p-v9hr-52mj","versionConstraint":">=2.0-beta9,<2.25.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.18.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vc5p-v9hr-52mj","fix":{"state":"fixed","versions":["2.25.3"],"available":[{"date":"2025-12-20","kind":"first-observed","version":"2.25.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68161","cwe":"CWE-297","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-68161","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-68161","date":"2026-11-02","epss":0.00767,"percentile":0.55523}],"risk":0.43335499999999993,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-68161","https://github.com/apache/logging-log4j2/pull/4002","https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","https://logging.apache.org/security.html#CVE-2025-68161","https://github.com/apache/logging-log4j2/commit/3b93748497e1adbbd027fda8a5e7268ec5d0d578","http://www.openwall.com/lists/oss-security/2025/12/18/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vc5p-v9hr-52mj","description":"Apache Log4j does not verify the TLS hostname in its Socket Appender"},"relatedVulnerabilities":[{"id":"CVE-2025-68161","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68161","cwe":"CWE-297","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-68161","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-68161","date":"2026-11-02","epss":0.00767,"percentile":0.55523}],"urls":["https://github.com/apache/logging-log4j2/pull/4002","https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","https://logging.apache.org/security.html#CVE-2025-68161","http://www.openwall.com/lists/oss-security/2025/12/18/1","https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68161","description":"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the  verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName  configuration attribute or the  log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName  system property is set to true.\n\nThis issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:\n\n  *  The attacker is able to intercept or redirect network traffic between the client and the log receiver.\n  *  The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).\n\n\nUsers are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.\n\nAs an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates."}]},{"artifact":{"id":"df642c8f2e021107","cpes":["cpe:2.3:a:apache:log4j-core:2.19.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.19.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.19.0:*:*:*:*:*:*:*"],"name":"log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0","type":"java-archive","version":"2.19.0","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.logging.log4j","virtualPath":"/opt/atlassian/confluence/bin/synchrony-proxy-watchdog.jar:org.apache.logging.log4j:log4j-core","manifestName":"","pomArtifactID":"log4j-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/synchrony-proxy-watchdog.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/synchrony-proxy-watchdog.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.25.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vc5p-v9hr-52mj","versionConstraint":">=2.0-beta9,<2.25.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.19.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vc5p-v9hr-52mj","fix":{"state":"fixed","versions":["2.25.3"],"available":[{"date":"2025-12-20","kind":"first-observed","version":"2.25.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68161","cwe":"CWE-297","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-68161","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-68161","date":"2026-11-02","epss":0.00767,"percentile":0.55523}],"risk":0.43335499999999993,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-68161","https://github.com/apache/logging-log4j2/pull/4002","https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","https://logging.apache.org/security.html#CVE-2025-68161","https://github.com/apache/logging-log4j2/commit/3b93748497e1adbbd027fda8a5e7268ec5d0d578","http://www.openwall.com/lists/oss-security/2025/12/18/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vc5p-v9hr-52mj","description":"Apache Log4j does not verify the TLS hostname in its Socket Appender"},"relatedVulnerabilities":[{"id":"CVE-2025-68161","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68161","cwe":"CWE-297","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-68161","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-68161","date":"2026-11-02","epss":0.00767,"percentile":0.55523}],"urls":["https://github.com/apache/logging-log4j2/pull/4002","https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","https://logging.apache.org/security.html#CVE-2025-68161","http://www.openwall.com/lists/oss-security/2025/12/18/1","https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68161","description":"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the  verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName  configuration attribute or the  log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName  system property is set to true.\n\nThis issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:\n\n  *  The attacker is able to intercept or redirect network traffic between the client and the log receiver.\n  *  The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).\n\n\nUsers are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.\n\nAs an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates."}]},{"artifact":{"id":"57dff2c200851b6e","cpes":["cpe:2.3:a:apache:log4j-core:2.19.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.19.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.19.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:2.19.0:*:*:*:*:*:*:*"],"name":"log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0","type":"java-archive","version":"2.19.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.logging.log4j","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.logging.log4j_log4j-core-2.19.0.jar","manifestName":"","pomArtifactID":"log4j-core","archiveDigests":[{"value":"3b6eeb4de4c49c0fe38a4ee27188ff5fee44d0bb","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.logging.log4j_log4j-core-2.19.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.logging.log4j_log4j-core-2.19.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.25.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vc5p-v9hr-52mj","versionConstraint":">=2.0-beta9,<2.25.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.19.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vc5p-v9hr-52mj","fix":{"state":"fixed","versions":["2.25.3"],"available":[{"date":"2025-12-20","kind":"first-observed","version":"2.25.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68161","cwe":"CWE-297","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-68161","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-68161","date":"2026-11-02","epss":0.00767,"percentile":0.55523}],"risk":0.43335499999999993,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-68161","https://github.com/apache/logging-log4j2/pull/4002","https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","https://logging.apache.org/security.html#CVE-2025-68161","https://github.com/apache/logging-log4j2/commit/3b93748497e1adbbd027fda8a5e7268ec5d0d578","http://www.openwall.com/lists/oss-security/2025/12/18/1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vc5p-v9hr-52mj","description":"Apache Log4j does not verify the TLS hostname in its Socket Appender"},"relatedVulnerabilities":[{"id":"CVE-2025-68161","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68161","cwe":"CWE-297","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2025-68161","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-68161","date":"2026-11-02","epss":0.00767,"percentile":0.55523}],"urls":["https://github.com/apache/logging-log4j2/pull/4002","https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","https://logging.apache.org/security.html#CVE-2025-68161","http://www.openwall.com/lists/oss-security/2025/12/18/1","https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68161","description":"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the  verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName  configuration attribute or the  log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName  system property is set to true.\n\nThis issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:\n\n  *  The attacker is able to intercept or redirect network traffic between the client and the log receiver.\n  *  The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).\n\n\nUsers are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.\n\nAs an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates."}]},{"artifact":{"id":"c87a73d6229303b3","cpes":["cpe:2.3:a:apache:tomcat-coyote:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_coyote:9.0.83:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.83:*:*:*:*:*:*:*"],"name":"tomcat-coyote","purl":"pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83","type":"java-archive","version":"9.0.83","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.tomcat","virtualPath":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","manifestName":"","pomArtifactID":"tomcat-coyote","archiveDigests":[{"value":"20f6014eba726230cc33ce7f0248b3261b7bae58","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/lib/tomcat-coyote.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.0.115"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mgp5-rv84-w37q","versionConstraint":">=9.0.83,<9.0.115 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat:tomcat-coyote","version":"9.0.83"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mgp5-rv84-w37q","fix":{"state":"fixed","versions":["9.0.115"],"available":[{"date":"2026-03-20","kind":"first-observed","version":"9.0.115"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24734","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-24734","cwe":"CWE-295","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-24734","date":"2026-11-02","epss":0.00575,"percentile":0.47453}],"risk":0.43125,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-24734","https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mgp5-rv84-w37q","description":"Apache Tomcat has an Improper Input Validation vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-24734","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24734","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-24734","cwe":"CWE-295","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-24734","date":"2026-11-02","epss":0.00575,"percentile":0.47453}],"urls":["https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml","https://access.redhat.com/errata/RHSA-2026:19054","https://access.redhat.com/errata/RHSA-2026:26323","https://access.redhat.com/errata/RHSA-2026:36790","https://access.redhat.com/errata/RHSA-2026:5611","https://access.redhat.com/errata/RHSA-2026:5612","https://access.redhat.com/errata/RHSA-2026:6569","https://access.redhat.com/errata/RHSA-2026:8334","https://access.redhat.com/security/cve/CVE-2026-24734","https://bugzilla.redhat.com/show_bug.cgi?id=2440426","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24734.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24734","description":"Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.\n\nWhen using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.\n\nThis issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.\n\nApache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.\n\nApache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.23"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-21085","versionConstraint":"< 1.8.0_412||>= 1.9, < 8.0.412||>= 9, < 11.0.23 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-21085","fix":{"state":"fixed","versions":["1.8.0_412","8.0.412","11.0.23"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_412"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.412"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.23"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21085","date":"2026-11-02","epss":0.01286,"percentile":0.70159}],"risk":0.43080999999999997,"urls":["https://lists.debian.org/debian-lts-announce/2024/04/msg00014.html","https://security.netapp.com/advisory/ntap-20240426-0004/","https://www.oracle.com/security-alerts/cpuapr2024.html","https://openjdk.org/groups/vulnerability/advisories/2024-04-16"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21085","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Concurrency).  Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22; Oracle GraalVM Enterprise Edition: 20.3.13 and  21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-02","epss":0.00859,"percentile":0.58481}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-02","epss":0.00859,"percentile":0.58481}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-02","epss":0.00859,"percentile":0.58481}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-02","epss":0.00859,"percentile":0.58481}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-02","epss":0.00859,"percentile":0.58481}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-02","epss":0.00859,"percentile":0.58481}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-02","epss":0.00859,"percentile":0.58481}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-02","epss":0.00859,"percentile":0.58481}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.24"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-21145","versionConstraint":"< 1.8.0_422||>= 1.9, < 8.0.422||>= 12, < 17.0.12||>= 18, < 21.0.4||>= 22, < 22.0.2||>= 9, < 11.0.24 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-21145","fix":{"state":"fixed","versions":["1.8.0_422","8.0.422","11.0.24","17.0.12","21.0.4","22.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_422"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.422"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.12"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.4"},{"date":"2025-09-04","kind":"first-observed","version":"22.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.24"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-21145","date":"2026-11-02","epss":0.00864,"percentile":0.58622}],"risk":0.42335999999999996,"urls":["https://security.netapp.com/advisory/ntap-20240719-0008/","https://www.oracle.com/security-alerts/cpujul2024.html","https://openjdk.org/groups/vulnerability/advisories/2024-07-16"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21145","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.24"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-21138","versionConstraint":"< 1.8.0_422||>= 1.9, < 8.0.422||>= 12, < 17.0.12||>= 18, < 21.0.4||>= 22, < 22.0.2||>= 9, < 11.0.24 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-21138","fix":{"state":"fixed","versions":["1.8.0_422","8.0.422","11.0.24","17.0.12","21.0.4","22.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_422"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.422"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.12"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.4"},{"date":"2025-09-04","kind":"first-observed","version":"22.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.24"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21138","date":"2026-11-02","epss":0.01257,"percentile":0.69557}],"risk":0.421095,"urls":["https://security.netapp.com/advisory/ntap-20240719-0008/","https://www.oracle.com/security-alerts/cpujul2024.html","https://openjdk.org/groups/vulnerability/advisories/2024-07-16"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21138","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"a00af5c4c13e392a","cpes":["cpe:2.3:a:org.jsoup:jsoup:1.15.4:*:*:*:*:*:*:*","cpe:2.3:a:jsoup:jsoup:1.15.4:*:*:*:*:*:*:*"],"name":"jsoup","purl":"pkg:maven/org.jsoup/jsoup@1.15.4","type":"java-archive","version":"1.15.4","language":"java","licenses":["The MIT License"],"metadata":{"pomGroupID":"org.jsoup","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-jira-plugin-18.7.6.jar:org.jsoup:jsoup","manifestName":"","pomArtifactID":"jsoup","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-jira-plugin-18.7.6.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-jira-plugin-18.7.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.23.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-65r4-943x-97jj","versionConstraint":"<1.23.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jsoup:jsoup","version":"1.15.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-65r4-943x-97jj","fix":{"state":"fixed","versions":["1.23.2"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"1.23.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75140","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75140","date":"2026-11-02","epss":0.00525,"percentile":0.4452}],"risk":0.40950000000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-75140","https://github.com/jhy/jsoup/pull/2556","https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder","https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-65r4-943x-97jj","description":"jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations"},"relatedVulnerabilities":[{"id":"CVE-2026-75140","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75140","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75140","date":"2026-11-02","epss":0.00525,"percentile":0.4452}],"urls":["https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","https://github.com/jhy/jsoup/pull/2556","https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75140","description":"jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application."}]},{"artifact":{"id":"c5c678e487a68c7d","cpes":["cpe:2.3:a:org.jsoup:jsoup:1.16.1:*:*:*:*:*:*:*","cpe:2.3:a:jsoup:jsoup:1.16.1:*:*:*:*:*:*:*"],"name":"jsoup","purl":"pkg:maven/org.jsoup/jsoup@1.16.1","type":"java-archive","version":"1.16.1","language":"java","licenses":["The MIT License"],"metadata":{"pomGroupID":"org.jsoup","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.confluence-flyingpdf-plugin-18.7.56.jar:org.jsoup:jsoup","manifestName":"","pomArtifactID":"jsoup","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.confluence-flyingpdf-plugin-18.7.56.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.extra.confluence-flyingpdf-plugin-18.7.56.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.23.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-65r4-943x-97jj","versionConstraint":"<1.23.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jsoup:jsoup","version":"1.16.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-65r4-943x-97jj","fix":{"state":"fixed","versions":["1.23.2"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"1.23.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75140","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75140","date":"2026-11-02","epss":0.00525,"percentile":0.4452}],"risk":0.40950000000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-75140","https://github.com/jhy/jsoup/pull/2556","https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder","https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-65r4-943x-97jj","description":"jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations"},"relatedVulnerabilities":[{"id":"CVE-2026-75140","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75140","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75140","date":"2026-11-02","epss":0.00525,"percentile":0.4452}],"urls":["https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","https://github.com/jhy/jsoup/pull/2556","https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75140","description":"jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application."}]},{"artifact":{"id":"52f176047f791a3a","cpes":["cpe:2.3:a:jonathan-hedley:jsoup:1.16.2:*:*:*:*:*:*:*","cpe:2.3:a:jonathan_hedley:jsoup:1.16.2:*:*:*:*:*:*:*","cpe:2.3:a:org.jsoup:jsoup:1.16.2:*:*:*:*:*:*:*","cpe:2.3:a:jsoup:jsoup:1.16.2:*:*:*:*:*:*:*"],"name":"jsoup","purl":"pkg:maven/org.jsoup/jsoup@1.16.2","type":"java-archive","version":"1.16.2","language":"java","licenses":["https://jsoup.org/license"],"metadata":{"pomGroupID":"org.jsoup","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.jsoup_jsoup-1.16.2.jar","manifestName":"","pomArtifactID":"jsoup","archiveDigests":[{"value":"5d39ff6d1b8331c376a04c50c6716afbcdfe567d","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.jsoup_jsoup-1.16.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/org.jsoup_jsoup-1.16.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.23.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-65r4-943x-97jj","versionConstraint":"<1.23.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jsoup:jsoup","version":"1.16.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-65r4-943x-97jj","fix":{"state":"fixed","versions":["1.23.2"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"1.23.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75140","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75140","date":"2026-11-02","epss":0.00525,"percentile":0.4452}],"risk":0.40950000000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-75140","https://github.com/jhy/jsoup/pull/2556","https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder","https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-65r4-943x-97jj","description":"jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations"},"relatedVulnerabilities":[{"id":"CVE-2026-75140","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75140","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75140","date":"2026-11-02","epss":0.00525,"percentile":0.4452}],"urls":["https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","https://github.com/jhy/jsoup/pull/2556","https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75140","description":"jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application."}]},{"artifact":{"id":"d72b48f24cebfbe3","cpes":["cpe:2.3:a:org.jsoup:jsoup:1.16.2:*:*:*:*:*:*:*","cpe:2.3:a:jsoup:jsoup:1.16.2:*:*:*:*:*:*:*"],"name":"jsoup","purl":"pkg:maven/org.jsoup/jsoup@1.16.2","type":"java-archive","version":"1.16.2","language":"java","licenses":["The MIT License"],"metadata":{"pomGroupID":"org.jsoup","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:org.jsoup:jsoup","manifestName":"","pomArtifactID":"jsoup","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.23.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-65r4-943x-97jj","versionConstraint":"<1.23.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jsoup:jsoup","version":"1.16.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-65r4-943x-97jj","fix":{"state":"fixed","versions":["1.23.2"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"1.23.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75140","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75140","date":"2026-11-02","epss":0.00525,"percentile":0.4452}],"risk":0.40950000000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-75140","https://github.com/jhy/jsoup/pull/2556","https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder","https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-65r4-943x-97jj","description":"jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations"},"relatedVulnerabilities":[{"id":"CVE-2026-75140","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75140","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75140","date":"2026-11-02","epss":0.00525,"percentile":0.4452}],"urls":["https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","https://github.com/jhy/jsoup/pull/2556","https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75140","description":"jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application."}]},{"artifact":{"id":"7f5afd36e2a50847","cpes":["cpe:2.3:a:curl:curl:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.18"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-8096","versionConstraint":"< 7.81.0-1ubuntu1.18 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-8096","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.18"],"available":[{"date":"2024-09-16","kind":"advisory","version":"7.81.0-1ubuntu1.18"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-8096","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8096","date":"2026-11-02","epss":0.00817,"percentile":0.57117}],"risk":0.40850000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8096"},"relatedVulnerabilities":[{"id":"CVE-2024-8096","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8096","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8096","date":"2026-11-02","epss":0.00817,"percentile":0.57117}],"urls":["https://curl.se/docs/CVE-2024-8096.html","https://curl.se/docs/CVE-2024-8096.json","https://hackerone.com/reports/2669852","http://www.openwall.com/lists/oss-security/2024/09/11/1","https://lists.debian.org/debian-lts-announce/2024/11/msg00008.html","https://security.netapp.com/advisory/ntap-20241011-0005/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://github.com/curl/curl/commit/aeb1a281cab13c7ba"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8096","description":"When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine.  If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate."}]},{"artifact":{"id":"eebde1772607afd6","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.18"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8096","versionConstraint":"< 7.81.0-1ubuntu1.18 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-8096","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.18"],"available":[{"date":"2024-09-16","kind":"advisory","version":"7.81.0-1ubuntu1.18"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-8096","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8096","date":"2026-11-02","epss":0.00817,"percentile":0.57117}],"risk":0.40850000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8096"},"relatedVulnerabilities":[{"id":"CVE-2024-8096","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8096","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8096","date":"2026-11-02","epss":0.00817,"percentile":0.57117}],"urls":["https://curl.se/docs/CVE-2024-8096.html","https://curl.se/docs/CVE-2024-8096.json","https://hackerone.com/reports/2669852","http://www.openwall.com/lists/oss-security/2024/09/11/1","https://lists.debian.org/debian-lts-announce/2024/11/msg00008.html","https://security.netapp.com/advisory/ntap-20241011-0005/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://github.com/curl/curl/commit/aeb1a281cab13c7ba"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8096","description":"When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine.  If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-0397","versionConstraint":"< 3.10.12-1~22.04.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-0397","fix":{"state":"fixed","versions":["3.10.12-1~22.04.5"],"available":[{"date":"2024-07-30","kind":"advisory","version":"3.10.12-1~22.04.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-11-02","epss":0.0081,"percentile":0.56931}],"risk":0.40499999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-0397"},"relatedVulnerabilities":[{"id":"CVE-2024-0397","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-11-02","epss":0.0081,"percentile":0.56931}],"urls":["http://www.openwall.com/lists/oss-security/2024/06/17/2","https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d","https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524","https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e","https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286","https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa","https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab","https://github.com/python/cpython/issues/114572","https://github.com/python/cpython/pull/114573","https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20250411-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0397","description":"A defect was discovered in the Python “ssl” module where there is a memory\nrace condition with the ssl.SSLContext methods “cert_store_stats()” and\n“get_ca_certs()”. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-0397","versionConstraint":"< 3.10.12-1~22.04.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-0397","fix":{"state":"fixed","versions":["3.10.12-1~22.04.5"],"available":[{"date":"2024-07-30","kind":"advisory","version":"3.10.12-1~22.04.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-11-02","epss":0.0081,"percentile":0.56931}],"risk":0.40499999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-0397"},"relatedVulnerabilities":[{"id":"CVE-2024-0397","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-11-02","epss":0.0081,"percentile":0.56931}],"urls":["http://www.openwall.com/lists/oss-security/2024/06/17/2","https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d","https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524","https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e","https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286","https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa","https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab","https://github.com/python/cpython/issues/114572","https://github.com/python/cpython/pull/114573","https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20250411-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0397","description":"A defect was discovered in the Python “ssl” module where there is a memory\nrace condition with the ssl.SSLContext methods “cert_store_stats()” and\n“get_ca_certs()”. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-0397","versionConstraint":"< 3.10.12-1~22.04.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-0397","fix":{"state":"fixed","versions":["3.10.12-1~22.04.5"],"available":[{"date":"2024-07-30","kind":"advisory","version":"3.10.12-1~22.04.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-11-02","epss":0.0081,"percentile":0.56931}],"risk":0.40499999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-0397"},"relatedVulnerabilities":[{"id":"CVE-2024-0397","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-11-02","epss":0.0081,"percentile":0.56931}],"urls":["http://www.openwall.com/lists/oss-security/2024/06/17/2","https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d","https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524","https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e","https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286","https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa","https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab","https://github.com/python/cpython/issues/114572","https://github.com/python/cpython/pull/114573","https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20250411-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0397","description":"A defect was discovered in the Python “ssl” module where there is a memory\nrace condition with the ssl.SSLContext methods “cert_store_stats()” and\n“get_ca_certs()”. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-0397","versionConstraint":"< 3.10.12-1~22.04.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-0397","fix":{"state":"fixed","versions":["3.10.12-1~22.04.5"],"available":[{"date":"2024-07-30","kind":"advisory","version":"3.10.12-1~22.04.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-11-02","epss":0.0081,"percentile":0.56931}],"risk":0.40499999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-0397"},"relatedVulnerabilities":[{"id":"CVE-2024-0397","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-11-02","epss":0.0081,"percentile":0.56931}],"urls":["http://www.openwall.com/lists/oss-security/2024/06/17/2","https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d","https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524","https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e","https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286","https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa","https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab","https://github.com/python/cpython/issues/114572","https://github.com/python/cpython/pull/114573","https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20250411-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0397","description":"A defect was discovered in the Python “ssl” module where there is a memory\nrace condition with the ssl.SSLContext methods “cert_store_stats()” and\n“get_ca_certs()”. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5."}]},{"artifact":{"id":"8714e648b2fbdcd7","cpes":["cpe:2.3:a:libnghttp2-14:libnghttp2-14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2-14:libnghttp2_14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2_14:libnghttp2-14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2_14:libnghttp2_14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2:libnghttp2-14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2:libnghttp2_14:1.43.0-1ubuntu0.1:*:*:*:*:*:*:*"],"name":"libnghttp2-14","purl":"pkg:deb/ubuntu/libnghttp2-14@1.43.0-1ubuntu0.1?arch=amd64&distro=ubuntu-22.04&upstream=nghttp2","type":"deb","version":"1.43.0-1ubuntu0.1","language":"","licenses":["BSD-2-clause","Expat","GPL-3","GPL-3+","MIT","SIL-OFL-1.1","all-permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnghttp2-14/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libnghttp2-14/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnghttp2-14:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libnghttp2-14:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nghttp2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.43.0-1ubuntu0.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27135","versionConstraint":"< 1.43.0-1ubuntu0.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nghttp2","version":"1.43.0-1ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-27135","fix":{"state":"fixed","versions":["1.43.0-1ubuntu0.3"],"available":[{"date":"2026-05-05","kind":"advisory","version":"1.43.0-1ubuntu0.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-27135","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27135","cwe":"CWE-617","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27135","date":"2026-11-02","epss":0.00805,"percentile":0.56771}],"risk":0.40249999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-27135"},"relatedVulnerabilities":[{"id":"CVE-2026-27135","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27135","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27135","cwe":"CWE-617","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27135","date":"2026-11-02","epss":0.00805,"percentile":0.56771}],"urls":["https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1","https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6","http://www.openwall.com/lists/oss-security/2026/03/20/3","https://lists.debian.org/debian-lts-announce/2026/05/msg00025.html","https://access.redhat.com/errata/RHSA-2026:10065","https://access.redhat.com/errata/RHSA-2026:11768","https://access.redhat.com/errata/RHSA-2026:13812","https://access.redhat.com/errata/RHSA-2026:14773","https://access.redhat.com/errata/RHSA-2026:14937","https://access.redhat.com/errata/RHSA-2026:15087","https://access.redhat.com/errata/RHSA-2026:16008","https://access.redhat.com/errata/RHSA-2026:16009","https://access.redhat.com/errata/RHSA-2026:16030","https://access.redhat.com/errata/RHSA-2026:16174","https://access.redhat.com/errata/RHSA-2026:17596","https://access.redhat.com/errata/RHSA-2026:19724","https://access.redhat.com/errata/RHSA-2026:19725","https://access.redhat.com/errata/RHSA-2026:20040","https://access.redhat.com/errata/RHSA-2026:20087","https://access.redhat.com/errata/RHSA-2026:21656","https://access.redhat.com/errata/RHSA-2026:21690","https://access.redhat.com/errata/RHSA-2026:21695","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:27200","https://access.redhat.com/errata/RHSA-2026:27201","https://access.redhat.com/errata/RHSA-2026:6190","https://access.redhat.com/errata/RHSA-2026:7080","https://access.redhat.com/errata/RHSA-2026:7123","https://access.redhat.com/errata/RHSA-2026:7302","https://access.redhat.com/errata/RHSA-2026:7310","https://access.redhat.com/errata/RHSA-2026:7350","https://access.redhat.com/errata/RHSA-2026:7666","https://access.redhat.com/errata/RHSA-2026:7667","https://access.redhat.com/errata/RHSA-2026:7668","https://access.redhat.com/errata/RHSA-2026:7670","https://access.redhat.com/errata/RHSA-2026:7675","https://access.redhat.com/errata/RHSA-2026:7896","https://access.redhat.com/errata/RHSA-2026:7983","https://access.redhat.com/errata/RHSA-2026:8339","https://access.redhat.com/errata/RHSA-2026:8538","https://access.redhat.com/errata/RHSA-2026:8539","https://access.redhat.com/errata/RHSA-2026:8540","https://access.redhat.com/errata/RHSA-2026:8541","https://access.redhat.com/errata/RHSA-2026:8545","https://access.redhat.com/errata/RHSA-2026:8546","https://access.redhat.com/errata/RHSA-2026:8547","https://access.redhat.com/errata/RHSA-2026:8548","https://access.redhat.com/errata/RHSA-2026:8868","https://access.redhat.com/errata/RHSA-2026:9711","https://access.redhat.com/errata/RHSA-2026:9832","https://access.redhat.com/errata/RHSA-2026:9874","https://access.redhat.com/security/cve/CVE-2026-27135","https://bugzilla.redhat.com/show_bug.cgi?id=2448754","https://cert-portal.siemens.com/productcert/html/ssa-019113.html","https://cert-portal.siemens.com/productcert/html/ssa-457936.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27135.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27135","description":"nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available."}]},{"artifact":{"id":"cfda19effa7c6d29","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.3?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.3","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3832","versionConstraint":"< 3.7.3-4ubuntu1.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-3832","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.9"],"available":[{"date":"2026-05-20","kind":"advisory","version":"3.7.3-4ubuntu1.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-3832","cwe":"CWE-179","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3832","date":"2026-11-02","epss":0.00804,"percentile":0.56743}],"risk":0.402,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3832"},"relatedVulnerabilities":[{"id":"CVE-2026-3832","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3832","cwe":"CWE-179","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3832","date":"2026-11-02","epss":0.00804,"percentile":0.56743}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-3832","https://bugzilla.redhat.com/show_bug.cgi?id=2445762","https://gitlab.com/gnutls/gnutls/-/issues/1801"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3832","description":"A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12084","versionConstraint":"< 3.10.12-1~22.04.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-12084","fix":{"state":"fixed","versions":["3.10.12-1~22.04.14"],"available":[{"date":"2026-02-05","kind":"advisory","version":"3.10.12-1~22.04.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-11-02","epss":0.00799,"percentile":0.56543}],"risk":0.3995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12084"},"relatedVulnerabilities":[{"id":"CVE-2025-12084","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-11-02","epss":0.00799,"percentile":0.56543}],"urls":["https://github.com/python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0","https://github.com/python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4","https://github.com/python/cpython/commit/27648a1818749ef44c420afe6173af6868715437","https://github.com/python/cpython/commit/41f468786762348960486c166833a218a0a436af","https://github.com/python/cpython/commit/57937a8e5e293f0dcba5115f7b7a11b1e0c9a273","https://github.com/python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907","https://github.com/python/cpython/commit/9c9dda6625a2a90d2a06c657eee021d6be19842d","https://github.com/python/cpython/commit/a46c10ec9d4050ab67b8a932e0859a2ea60c3cb8","https://github.com/python/cpython/commit/a696ba8b4d42fd632afc9bc88ad830a2e4cceed8","https://github.com/python/cpython/commit/c97e87593063d84a2bd9fe7068b30eb44de23dc0","https://github.com/python/cpython/commit/ddcd2acd85d891a53e281c773b3093f9db953964","https://github.com/python/cpython/commit/e91c11449cad34bac3ea55ee09ca557691d92b53","https://github.com/python/cpython/issues/142145","https://github.com/python/cpython/pull/142146"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12084","description":"When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12084","versionConstraint":"< 3.10.12-1~22.04.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-12084","fix":{"state":"fixed","versions":["3.10.12-1~22.04.14"],"available":[{"date":"2026-02-05","kind":"advisory","version":"3.10.12-1~22.04.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-11-02","epss":0.00799,"percentile":0.56543}],"risk":0.3995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12084"},"relatedVulnerabilities":[{"id":"CVE-2025-12084","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-11-02","epss":0.00799,"percentile":0.56543}],"urls":["https://github.com/python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0","https://github.com/python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4","https://github.com/python/cpython/commit/27648a1818749ef44c420afe6173af6868715437","https://github.com/python/cpython/commit/41f468786762348960486c166833a218a0a436af","https://github.com/python/cpython/commit/57937a8e5e293f0dcba5115f7b7a11b1e0c9a273","https://github.com/python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907","https://github.com/python/cpython/commit/9c9dda6625a2a90d2a06c657eee021d6be19842d","https://github.com/python/cpython/commit/a46c10ec9d4050ab67b8a932e0859a2ea60c3cb8","https://github.com/python/cpython/commit/a696ba8b4d42fd632afc9bc88ad830a2e4cceed8","https://github.com/python/cpython/commit/c97e87593063d84a2bd9fe7068b30eb44de23dc0","https://github.com/python/cpython/commit/ddcd2acd85d891a53e281c773b3093f9db953964","https://github.com/python/cpython/commit/e91c11449cad34bac3ea55ee09ca557691d92b53","https://github.com/python/cpython/issues/142145","https://github.com/python/cpython/pull/142146"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12084","description":"When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-12084","versionConstraint":"< 3.10.12-1~22.04.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-12084","fix":{"state":"fixed","versions":["3.10.12-1~22.04.14"],"available":[{"date":"2026-02-05","kind":"advisory","version":"3.10.12-1~22.04.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-11-02","epss":0.00799,"percentile":0.56543}],"risk":0.3995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12084"},"relatedVulnerabilities":[{"id":"CVE-2025-12084","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-11-02","epss":0.00799,"percentile":0.56543}],"urls":["https://github.com/python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0","https://github.com/python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4","https://github.com/python/cpython/commit/27648a1818749ef44c420afe6173af6868715437","https://github.com/python/cpython/commit/41f468786762348960486c166833a218a0a436af","https://github.com/python/cpython/commit/57937a8e5e293f0dcba5115f7b7a11b1e0c9a273","https://github.com/python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907","https://github.com/python/cpython/commit/9c9dda6625a2a90d2a06c657eee021d6be19842d","https://github.com/python/cpython/commit/a46c10ec9d4050ab67b8a932e0859a2ea60c3cb8","https://github.com/python/cpython/commit/a696ba8b4d42fd632afc9bc88ad830a2e4cceed8","https://github.com/python/cpython/commit/c97e87593063d84a2bd9fe7068b30eb44de23dc0","https://github.com/python/cpython/commit/ddcd2acd85d891a53e281c773b3093f9db953964","https://github.com/python/cpython/commit/e91c11449cad34bac3ea55ee09ca557691d92b53","https://github.com/python/cpython/issues/142145","https://github.com/python/cpython/pull/142146"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12084","description":"When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12084","versionConstraint":"< 3.10.12-1~22.04.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-12084","fix":{"state":"fixed","versions":["3.10.12-1~22.04.14"],"available":[{"date":"2026-02-05","kind":"advisory","version":"3.10.12-1~22.04.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-11-02","epss":0.00799,"percentile":0.56543}],"risk":0.3995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12084"},"relatedVulnerabilities":[{"id":"CVE-2025-12084","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-11-02","epss":0.00799,"percentile":0.56543}],"urls":["https://github.com/python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0","https://github.com/python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4","https://github.com/python/cpython/commit/27648a1818749ef44c420afe6173af6868715437","https://github.com/python/cpython/commit/41f468786762348960486c166833a218a0a436af","https://github.com/python/cpython/commit/57937a8e5e293f0dcba5115f7b7a11b1e0c9a273","https://github.com/python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907","https://github.com/python/cpython/commit/9c9dda6625a2a90d2a06c657eee021d6be19842d","https://github.com/python/cpython/commit/a46c10ec9d4050ab67b8a932e0859a2ea60c3cb8","https://github.com/python/cpython/commit/a696ba8b4d42fd632afc9bc88ad830a2e4cceed8","https://github.com/python/cpython/commit/c97e87593063d84a2bd9fe7068b30eb44de23dc0","https://github.com/python/cpython/commit/ddcd2acd85d891a53e281c773b3093f9db953964","https://github.com/python/cpython/commit/e91c11449cad34bac3ea55ee09ca557691d92b53","https://github.com/python/cpython/issues/142145","https://github.com/python/cpython/pull/142146"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12084","description":"When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents."}]},{"artifact":{"id":"bab8d09d07950909","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.11.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.2","type":"java-archive","version":"2.11.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.hazelcast_hazelcast-3.12.13.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.hazelcast_hazelcast-3.12.13.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.hazelcast_hazelcast-3.12.13.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.11.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"8fba25e88f80966a","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.11.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.2","type":"java-archive","version":"2.11.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.11.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"00a31800f16e4d02","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.12.7:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.12.7","type":"java-archive","version":"2.12.7","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.12.7"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"0817be99e5231885","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.13.4:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4","type":"java-archive","version":"2.13.4","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.13.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"e2fc9ff677ffb6c7","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar:META-INF/lib/jackson-core-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"7a07bc535ccf0b7f6929c4d0f2ab9b294ef7c4a3","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar:META-INF/lib/jackson-core-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"e9be8ec26ef33e8f","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"b0a031fbd375f152","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"e858bb869922cbbc","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/jackson-core-2.15.2.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"a6fe1836469a69b3ff66037c324d75fc66ef137c","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/jackson-core-2.15.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"1279d8cb864648ff","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar:META-INF/lib/jackson-core-2.15.3.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"60d600567c1862840397bf9ff5a92398edc5797b","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar:META-INF/lib/jackson-core-2.15.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"c407f6f2e09e5938","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar:META-INF/lib/jackson-core-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"899e5cf01be55fbf094ad72b2edb0c5df99111ee","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar:META-INF/lib/jackson-core-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"12e2a5381b054e59","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-core-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"899e5cf01be55fbf094ad72b2edb0c5df99111ee","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-core-2.16.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-core-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"e5f24aca4988a119","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-core-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"899e5cf01be55fbf094ad72b2edb0c5df99111ee","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-core-2.16.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-core-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"b618b6546d46c79d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar:META-INF/lib/jackson-core-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"899e5cf01be55fbf094ad72b2edb0c5df99111ee","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar:META-INF/lib/jackson-core-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-02","epss":0.00532,"percentile":0.44982}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.30"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-21932","versionConstraint":"< 1.8.0_482||>= 1.9, < 8.0.482||>= 12, < 17.0.18||>= 18, < 21.0.10||>= 22, < 25.0.2||>= 9, < 11.0.30 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-21932","fix":{"state":"fixed","versions":["1.8.0_482","8.0.482","11.0.30","17.0.18","21.0.10","25.0.2"],"available":[{"date":"2026-01-27","kind":"first-observed","version":"1.8.0_482"},{"date":"2026-01-27","kind":"first-observed","version":"8.0.482"},{"date":"2026-01-27","kind":"first-observed","version":"17.0.18"},{"date":"2026-01-27","kind":"first-observed","version":"21.0.10"},{"date":"2026-01-27","kind":"first-observed","version":"25.0.2"},{"date":"2026-01-27","kind":"first-observed","version":"11.0.30"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21932","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-21932","date":"2026-11-02","epss":0.00525,"percentile":0.4453}],"risk":0.391125,"urls":["https://www.oracle.com/security-alerts/cpujan2026.html","https://access.redhat.com/errata/RHSA-2026:0849","https://access.redhat.com/errata/RHSA-2026:0896","https://access.redhat.com/errata/RHSA-2026:0898","https://access.redhat.com/errata/RHSA-2026:0900","https://access.redhat.com/errata/RHSA-2026:1606","https://access.redhat.com/security/cve/CVE-2026-21932","https://bugzilla.redhat.com/show_bug.cgi?id=2429925","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21932.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21932","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX).  Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and  21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"ba3011af7d8611fa","cpes":["cpe:2.3:a:com.hazelcast:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast:hazelcast:3.12.13:*:*:*:*:*:*:*"],"name":"hazelcast","purl":"pkg:maven/com.hazelcast/hazelcast@3.12.13","type":"java-archive","version":"3.12.13","language":"java","licenses":[],"metadata":{"pomGroupID":"com.hazelcast","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:com.hazelcast:hazelcast","manifestName":"","pomArtifactID":"hazelcast","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xh6m-7cr7-xx66","versionConstraint":"<=4.1.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.hazelcast:hazelcast","version":"3.12.13"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xh6m-7cr7-xx66","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45859","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-45859","date":"2026-11-02","epss":0.00518,"percentile":0.44061}],"risk":0.39109,"urls":["https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66","https://nvd.nist.gov/vuln/detail/CVE-2023-45859","https://github.com/hazelcast/hazelcast/pull/25509"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xh6m-7cr7-xx66","description":"Missing permission checks on Hazelcast client protocol"},"relatedVulnerabilities":[{"id":"CVE-2023-45859","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45859","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-45859","date":"2026-11-02","epss":0.00518,"percentile":0.44061}],"urls":["https://github.com/hazelcast/hazelcast/pull/25509","https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45859","description":"In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster."}]},{"artifact":{"id":"922c00d79fbb52c6","cpes":["cpe:2.3:a:com.hazelcast.osgi.impl.Activator:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast\\,-inc-:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast\\,_inc_:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:com.hazelcast:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:Activator:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:impl:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:osgi:hazelcast:3.12.13:*:*:*:*:*:*:*"],"name":"hazelcast","purl":"pkg:maven/com.hazelcast/hazelcast@3.12.13","type":"java-archive","version":"3.12.13","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.hazelcast","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.hazelcast_hazelcast-3.12.13.jar","manifestName":"","pomArtifactID":"hazelcast","archiveDigests":[{"value":"d3db2f8be00c8a03ddee6a86434e76e6b7fe980d","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.hazelcast_hazelcast-3.12.13.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.hazelcast_hazelcast-3.12.13.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xh6m-7cr7-xx66","versionConstraint":"<=4.1.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.hazelcast:hazelcast","version":"3.12.13"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xh6m-7cr7-xx66","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45859","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-45859","date":"2026-11-02","epss":0.00518,"percentile":0.44061}],"risk":0.39109,"urls":["https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66","https://nvd.nist.gov/vuln/detail/CVE-2023-45859","https://github.com/hazelcast/hazelcast/pull/25509"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xh6m-7cr7-xx66","description":"Missing permission checks on Hazelcast client protocol"},"relatedVulnerabilities":[{"id":"CVE-2023-45859","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45859","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-45859","date":"2026-11-02","epss":0.00518,"percentile":0.44061}],"urls":["https://github.com/hazelcast/hazelcast/pull/25509","https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45859","description":"In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster."}]},{"artifact":{"id":"922c00d79fbb52c6","cpes":["cpe:2.3:a:com.hazelcast.osgi.impl.Activator:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast\\,-inc-:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast\\,_inc_:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:com.hazelcast:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:Activator:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:impl:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:osgi:hazelcast:3.12.13:*:*:*:*:*:*:*"],"name":"hazelcast","purl":"pkg:maven/com.hazelcast/hazelcast@3.12.13","type":"java-archive","version":"3.12.13","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.hazelcast","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.hazelcast_hazelcast-3.12.13.jar","manifestName":"","pomArtifactID":"hazelcast","archiveDigests":[{"value":"d3db2f8be00c8a03ddee6a86434e76e6b7fe980d","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.hazelcast_hazelcast-3.12.13.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.hazelcast_hazelcast-3.12.13.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8h4x-xvjp-vf99","versionConstraint":"<=5.1.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.hazelcast:hazelcast","version":"3.12.13"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-8h4x-xvjp-vf99","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45860","cwe":"CWE-89","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-45860","date":"2026-11-02","epss":0.00544,"percentile":0.45665}],"risk":0.38896,"urls":["https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99","https://nvd.nist.gov/vuln/detail/CVE-2023-45860","https://github.com/hazelcast/hazelcast/pull/25348","https://github.com/hazelcast/hazelcast/commit/98be233e79cf4bc1ff3c7126a9189988bd0e87bd"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8h4x-xvjp-vf99","description":"Hazelcast Platform permission checking in CSV File Source connector"},"relatedVulnerabilities":[{"id":"CVE-2023-45860","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45860","cwe":"CWE-89","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-45860","date":"2026-11-02","epss":0.00544,"percentile":0.45665}],"urls":["https://github.com/hazelcast/hazelcast/pull/25348","https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45860","description":"In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem."}]},{"artifact":{"id":"ba3011af7d8611fa","cpes":["cpe:2.3:a:com.hazelcast:hazelcast:3.12.13:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast:hazelcast:3.12.13:*:*:*:*:*:*:*"],"name":"hazelcast","purl":"pkg:maven/com.hazelcast/hazelcast@3.12.13","type":"java-archive","version":"3.12.13","language":"java","licenses":[],"metadata":{"pomGroupID":"com.hazelcast","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:com.hazelcast:hazelcast","manifestName":"","pomArtifactID":"hazelcast","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8h4x-xvjp-vf99","versionConstraint":"<=5.1.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.hazelcast:hazelcast","version":"3.12.13"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-8h4x-xvjp-vf99","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45860","cwe":"CWE-89","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-45860","date":"2026-11-02","epss":0.00544,"percentile":0.45665}],"risk":0.38896,"urls":["https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99","https://nvd.nist.gov/vuln/detail/CVE-2023-45860","https://github.com/hazelcast/hazelcast/pull/25348","https://github.com/hazelcast/hazelcast/commit/98be233e79cf4bc1ff3c7126a9189988bd0e87bd"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8h4x-xvjp-vf99","description":"Hazelcast Platform permission checking in CSV File Source connector"},"relatedVulnerabilities":[{"id":"CVE-2023-45860","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45860","cwe":"CWE-89","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-45860","date":"2026-11-02","epss":0.00544,"percentile":0.45665}],"urls":["https://github.com/hazelcast/hazelcast/pull/25348","https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45860","description":"In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem."}]},{"artifact":{"id":"c469f4c848b8146f","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http2-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"cbf1a430ea44dbdedbcde16b185cbb95f28d72c7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http2-4.1.100.Final.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http2-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c2gf-v879-257j","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c2gf-v879-257j","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-11","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48043","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-772","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48043","date":"2026-11-02","epss":0.00753,"percentile":0.55074}],"risk":0.387795,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j","https://nvd.nist.gov/vuln/detail/CVE-2026-48043","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/security/cve/CVE-2026-48043","https://bugzilla.redhat.com/show_bug.cgi?id=2488442","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53806","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:53645","https://github.com/netty/netty/commit/db6138b168699736a6463c367e12ad0a4c36a25e","https://github.com/netty/netty/commit/3d45a1e4e8eb99144f716e54be5ac57e525fa7ca"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c2gf-v879-257j","description":"netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-48043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48043","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-772","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48043","date":"2026-11-02","epss":0.00753,"percentile":0.55074}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-48043","https://bugzilla.redhat.com/show_bug.cgi?id=2488442","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48043","description":"Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"fd269c6f3753e140","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c2gf-v879-257j","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c2gf-v879-257j","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-11","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48043","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-772","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48043","date":"2026-11-02","epss":0.00753,"percentile":0.55074}],"risk":0.387795,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j","https://nvd.nist.gov/vuln/detail/CVE-2026-48043","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/security/cve/CVE-2026-48043","https://bugzilla.redhat.com/show_bug.cgi?id=2488442","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53806","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:53645","https://github.com/netty/netty/commit/db6138b168699736a6463c367e12ad0a4c36a25e","https://github.com/netty/netty/commit/3d45a1e4e8eb99144f716e54be5ac57e525fa7ca"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c2gf-v879-257j","description":"netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-48043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48043","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-772","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48043","date":"2026-11-02","epss":0.00753,"percentile":0.55074}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-48043","https://bugzilla.redhat.com/show_bug.cgi?id=2488442","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48043","description":"Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"27608fdc7273561f","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c2gf-v879-257j","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c2gf-v879-257j","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-11","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48043","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-772","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48043","date":"2026-11-02","epss":0.00753,"percentile":0.55074}],"risk":0.387795,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j","https://nvd.nist.gov/vuln/detail/CVE-2026-48043","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/security/cve/CVE-2026-48043","https://bugzilla.redhat.com/show_bug.cgi?id=2488442","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53806","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:53645","https://github.com/netty/netty/commit/db6138b168699736a6463c367e12ad0a4c36a25e","https://github.com/netty/netty/commit/3d45a1e4e8eb99144f716e54be5ac57e525fa7ca"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c2gf-v879-257j","description":"netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-48043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48043","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-772","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48043","date":"2026-11-02","epss":0.00753,"percentile":0.55074}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-48043","https://bugzilla.redhat.com/show_bug.cgi?id=2488442","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48043","description":"Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"cfda19effa7c6d29","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.3?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.3","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6395","versionConstraint":"< 3.7.3-4ubuntu1.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-6395","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.7"],"available":[{"date":"2025-07-14","kind":"advisory","version":"3.7.3-4ubuntu1.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-6395","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6395","date":"2026-11-02","epss":0.00771,"percentile":0.5566}],"risk":0.3855,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6395"},"relatedVulnerabilities":[{"id":"CVE-2025-6395","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6395","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6395","date":"2026-11-02","epss":0.00771,"percentile":0.5566}],"urls":["https://access.redhat.com/errata/RHSA-2025:16115","https://access.redhat.com/errata/RHSA-2025:16116","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:17348","https://access.redhat.com/errata/RHSA-2025:17361","https://access.redhat.com/errata/RHSA-2025:17415","https://access.redhat.com/errata/RHSA-2025:19088","https://access.redhat.com/errata/RHSA-2025:22529","https://access.redhat.com/security/cve/CVE-2025-6395","https://bugzilla.redhat.com/show_bug.cgi?id=2376755","https://gitlab.com/gnutls/gnutls/-/issues/1718","https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html","http://www.openwall.com/lists/oss-security/2025/07/11/3","https://lists.debian.org/debian-lts-announce/2025/08/msg00005.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6395","description":"A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite()."}]},{"artifact":{"id":"ea0bbc505903fd96","cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@11.0.21%2B9?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk11u.git","type":"binary","version":"11.0.21+9","language":"","licenses":[],"metadata":{"release":{"fullVersion":"11.0.21+9","javaVersion":"11.0.21","semanticVersion":"11.0.21+9","javaRuntimeVersion":"11.0.21+9"}},"locations":[{"path":"/opt/java/openjdk/release","layerID":"sha256:5516fea24b426518547e0ab92607317fe6515b3e47eb02b9dff04ad6958b6920","accessPath":"/opt/java/openjdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"11.0.25"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-21217","versionConstraint":"< 1.8.0_432||>= 1.9, < 8.0.432||>= 12, < 17.0.13||>= 18, < 21.0.5||>= 22, < 23.0.1||>= 9, < 11.0.25 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:11.0.21:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"11.0.21+9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-21217","fix":{"state":"fixed","versions":["1.8.0_432","8.0.432","11.0.25","17.0.13","21.0.5","23.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_432"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.432"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.13"},{"date":"2025-09-04","kind":"first-observed","version":"21.0.5"},{"date":"2025-09-04","kind":"first-observed","version":"23.0.1"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.25"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21217","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-21217","date":"2026-11-02","epss":0.01149,"percentile":0.66877}],"risk":0.38491499999999995,"urls":["https://www.oracle.com/security-alerts/cpuoct2024.html","https://lists.debian.org/debian-lts-announce/2024/10/msg00018.html","https://lists.debian.org/debian-lts-announce/2024/10/msg00020.html","https://openjdk.org/groups/vulnerability/advisories/2024-10-15"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21217","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization).  Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle GraalVM Enterprise Edition: 20.3.15 and  21.3.11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"cfda19effa7c6d29","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.3?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.3","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5260","versionConstraint":"< 3.7.3-4ubuntu1.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-5260","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.9"],"available":[{"date":"2026-05-20","kind":"advisory","version":"3.7.3-4ubuntu1.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-5260","cwe":"CWE-126","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5260","date":"2026-11-02","epss":0.00769,"percentile":0.55599}],"risk":0.3845,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-5260"},"relatedVulnerabilities":[{"id":"CVE-2026-5260","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5260","cwe":"CWE-126","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5260","date":"2026-11-02","epss":0.00769,"percentile":0.55599}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:40762","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:67837","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:77320","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82811","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/errata/RHSA-2026:89197","https://access.redhat.com/errata/RHSA-2026:89232","https://access.redhat.com/errata/RHSA-2026:89333","https://access.redhat.com/errata/RHSA-2026:89651","https://access.redhat.com/security/cve/CVE-2026-5260","https://bugzilla.redhat.com/show_bug.cgi?id=2467450","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5260","description":"A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8194","versionConstraint":"< 3.10.12-1~22.04.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-8194","fix":{"state":"fixed","versions":["3.10.12-1~22.04.11"],"available":[{"date":"2025-08-21","kind":"advisory","version":"3.10.12-1~22.04.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-11-02","epss":0.00761,"percentile":0.55319}],"risk":0.3805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8194"},"relatedVulnerabilities":[{"id":"CVE-2025-8194","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-11-02","epss":0.00761,"percentile":0.55319}],"urls":["https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1","https://github.com/python/cpython/commit/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/commit/7040aa54f14676938970e10c5f74ea93cd56aa38","https://github.com/python/cpython/commit/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/commit/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/commit/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/commit/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227","https://github.com/python/cpython/issues/130577","https://github.com/python/cpython/pull/137027","https://mail.python.org/archives/list/security-announce@python.org/thread/ZULLF3IZ726XP5EY7XJ7YIN3K5MDYR2D/","http://www.openwall.com/lists/oss-security/2025/07/28/1","http://www.openwall.com/lists/oss-security/2025/07/28/2","https://github.com/python/cpython/pull/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/pull/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/pull/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/pull/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/pull/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/pull/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8194","description":"There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. \n\nThis vulnerability can be mitigated by including the following patch after importing the “tarfile” module:  https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1"}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8194","versionConstraint":"< 3.10.12-1~22.04.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-8194","fix":{"state":"fixed","versions":["3.10.12-1~22.04.11"],"available":[{"date":"2025-08-21","kind":"advisory","version":"3.10.12-1~22.04.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-11-02","epss":0.00761,"percentile":0.55319}],"risk":0.3805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8194"},"relatedVulnerabilities":[{"id":"CVE-2025-8194","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-11-02","epss":0.00761,"percentile":0.55319}],"urls":["https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1","https://github.com/python/cpython/commit/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/commit/7040aa54f14676938970e10c5f74ea93cd56aa38","https://github.com/python/cpython/commit/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/commit/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/commit/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/commit/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227","https://github.com/python/cpython/issues/130577","https://github.com/python/cpython/pull/137027","https://mail.python.org/archives/list/security-announce@python.org/thread/ZULLF3IZ726XP5EY7XJ7YIN3K5MDYR2D/","http://www.openwall.com/lists/oss-security/2025/07/28/1","http://www.openwall.com/lists/oss-security/2025/07/28/2","https://github.com/python/cpython/pull/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/pull/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/pull/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/pull/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/pull/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/pull/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8194","description":"There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. \n\nThis vulnerability can be mitigated by including the following patch after importing the “tarfile” module:  https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1"}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-8194","versionConstraint":"< 3.10.12-1~22.04.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-8194","fix":{"state":"fixed","versions":["3.10.12-1~22.04.11"],"available":[{"date":"2025-08-21","kind":"advisory","version":"3.10.12-1~22.04.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-11-02","epss":0.00761,"percentile":0.55319}],"risk":0.3805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8194"},"relatedVulnerabilities":[{"id":"CVE-2025-8194","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-11-02","epss":0.00761,"percentile":0.55319}],"urls":["https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1","https://github.com/python/cpython/commit/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/commit/7040aa54f14676938970e10c5f74ea93cd56aa38","https://github.com/python/cpython/commit/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/commit/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/commit/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/commit/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227","https://github.com/python/cpython/issues/130577","https://github.com/python/cpython/pull/137027","https://mail.python.org/archives/list/security-announce@python.org/thread/ZULLF3IZ726XP5EY7XJ7YIN3K5MDYR2D/","http://www.openwall.com/lists/oss-security/2025/07/28/1","http://www.openwall.com/lists/oss-security/2025/07/28/2","https://github.com/python/cpython/pull/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/pull/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/pull/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/pull/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/pull/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/pull/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8194","description":"There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. \n\nThis vulnerability can be mitigated by including the following patch after importing the “tarfile” module:  https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1"}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8194","versionConstraint":"< 3.10.12-1~22.04.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-8194","fix":{"state":"fixed","versions":["3.10.12-1~22.04.11"],"available":[{"date":"2025-08-21","kind":"advisory","version":"3.10.12-1~22.04.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-11-02","epss":0.00761,"percentile":0.55319}],"risk":0.3805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8194"},"relatedVulnerabilities":[{"id":"CVE-2025-8194","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-11-02","epss":0.00761,"percentile":0.55319}],"urls":["https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1","https://github.com/python/cpython/commit/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/commit/7040aa54f14676938970e10c5f74ea93cd56aa38","https://github.com/python/cpython/commit/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/commit/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/commit/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/commit/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227","https://github.com/python/cpython/issues/130577","https://github.com/python/cpython/pull/137027","https://mail.python.org/archives/list/security-announce@python.org/thread/ZULLF3IZ726XP5EY7XJ7YIN3K5MDYR2D/","http://www.openwall.com/lists/oss-security/2025/07/28/1","http://www.openwall.com/lists/oss-security/2025/07/28/2","https://github.com/python/cpython/pull/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/pull/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/pull/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/pull/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/pull/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/pull/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8194","description":"There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. \n\nThis vulnerability can be mitigated by including the following patch after importing the “tarfile” module:  https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1"}]},{"artifact":{"id":"bab0f28d5b9840f7","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.12.7.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1","type":"java-archive","version":"2.12.7.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.12.7.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"a6af29070f42c49f","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2","type":"java-archive","version":"2.13.4.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.13.4.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"7e51f2d66453ad51","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar:META-INF/lib/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar:META-INF/lib/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"8b225a368370af7c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"3ad576839e998952","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/jackson-databind-2.15.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"9353b021f10c307c00328f52090de2bdb4b6ff9c","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/jackson-databind-2.15.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"051e7df316b5a531","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"7bbe612d6a8369b0","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"93ac7e2aa6804f54","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar:META-INF/lib/jackson-databind-2.15.3.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"a734bc2c47a9453c4efa772461a3aeb273c010d9","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar:META-INF/lib/jackson-databind-2.15.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"e7a8f6a39fc0ef2d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-databind-2.16.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"a89c3f9fac63d225","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"ed97116d7d90df11","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"55d5220f811f88ce","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-databind-2.16.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-02","epss":0.00717,"percentile":0.53822}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"da11de78b531bf03","cpes":["cpe:2.3:a:libpng16-16:libpng16-16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16-16:libpng16_16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16_16:libpng16-16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16_16:libpng16_16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16:libpng16-16:1.6.37-3build5:*:*:*:*:*:*:*","cpe:2.3:a:libpng16:libpng16_16:1.6.37-3build5:*:*:*:*:*:*:*"],"name":"libpng16-16","purl":"pkg:deb/ubuntu/libpng16-16@1.6.37-3build5?arch=amd64&distro=ubuntu-22.04&upstream=libpng1.6","type":"deb","version":"1.6.37-3build5","language":"","licenses":["Apache-2.0","BSD-3-clause","BSD-like-with-advertising-clause","GPL-2","GPL-2+","expat","libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpng16-16/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libpng16-16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpng16-16:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libpng16-16:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libpng1.6"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.6.37-3ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33636","versionConstraint":"< 1.6.37-3ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libpng1.6","version":"1.6.37-3build5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-33636","fix":{"state":"fixed","versions":["1.6.37-3ubuntu0.5"],"available":[{"date":"2026-05-07","kind":"advisory","version":"1.6.37-3ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-33636","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33636","date":"2026-11-02","epss":0.00751,"percentile":0.55011}],"risk":0.3755,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33636"},"relatedVulnerabilities":[{"id":"CVE-2026-33636","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33636","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33636","date":"2026-11-02","epss":0.00751,"percentile":0.55011}],"urls":["https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869","https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3","https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33636","description":"LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit paletted rows to RGB or RGBA, the Neon loop processes a final partial chunk without verifying that enough input pixels remain. Because the implementation works backward from the end of the row, the final iteration dereferences pointers before the start of the row buffer (OOB read) and writes expanded pixel data to the same underflowed positions (OOB write). This is reachable via normal decoding of attacker-controlled PNG input if Neon is enabled. Version 1.6.56 fixes the issue."}]},{"artifact":{"id":"480239e16ce6ec7f","cpes":["cpe:2.3:a:netty-codec:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec","purl":"pkg:maven/io.netty/netty-codec@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:io.netty:netty-codec","manifestName":"","pomArtifactID":"netty-codec","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.125.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3p8m-j85q-pgmj","versionConstraint":"<4.1.125.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3p8m-j85q-pgmj","fix":{"state":"fixed","versions":["4.1.125.Final"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.1.125.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58057","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-58057","date":"2026-11-02","epss":0.00631,"percentile":0.5023}],"risk":0.3754449999999999,"urls":["https://github.com/netty/netty/security/advisories/GHSA-3p8m-j85q-pgmj","https://github.com/netty/netty/commit/9d804c54ce962408ae6418255a83a13924f7145d","https://nvd.nist.gov/vuln/detail/CVE-2025-58057"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3p8m-j85q-pgmj","description":"Netty's decoders vulnerable to DoS via zip bomb style attack"},"relatedVulnerabilities":[{"id":"CVE-2025-58057","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58057","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-58057","date":"2026-11-02","epss":0.00631,"percentile":0.5023}],"urls":["https://github.com/netty/netty/commit/9d804c54ce962408ae6418255a83a13924f7145d","https://github.com/netty/netty/security/advisories/GHSA-3p8m-j85q-pgmj"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58057","description":"Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression."}]},{"artifact":{"id":"7873ac2db80e7dce","cpes":["cpe:2.3:a:netty-codec:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec","purl":"pkg:maven/io.netty/netty-codec@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:io.netty:netty-codec","manifestName":"","pomArtifactID":"netty-codec","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.125.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3p8m-j85q-pgmj","versionConstraint":"<4.1.125.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3p8m-j85q-pgmj","fix":{"state":"fixed","versions":["4.1.125.Final"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.1.125.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58057","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-58057","date":"2026-11-02","epss":0.00631,"percentile":0.5023}],"risk":0.3754449999999999,"urls":["https://github.com/netty/netty/security/advisories/GHSA-3p8m-j85q-pgmj","https://github.com/netty/netty/commit/9d804c54ce962408ae6418255a83a13924f7145d","https://nvd.nist.gov/vuln/detail/CVE-2025-58057"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3p8m-j85q-pgmj","description":"Netty's decoders vulnerable to DoS via zip bomb style attack"},"relatedVulnerabilities":[{"id":"CVE-2025-58057","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58057","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-58057","date":"2026-11-02","epss":0.00631,"percentile":0.5023}],"urls":["https://github.com/netty/netty/commit/9d804c54ce962408ae6418255a83a13924f7145d","https://github.com/netty/netty/security/advisories/GHSA-3p8m-j85q-pgmj"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58057","description":"Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression."}]},{"artifact":{"id":"10306e8811bffeff","cpes":["cpe:2.3:a:io.netty.codec:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec:codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec","purl":"pkg:maven/io.netty/netty-codec@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec","archiveDigests":[{"value":"9c3c71e7cf3b8ce3bfc9fa52a524b9ca7ddf259c","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-4.1.100.Final.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.125.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3p8m-j85q-pgmj","versionConstraint":"<4.1.125.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3p8m-j85q-pgmj","fix":{"state":"fixed","versions":["4.1.125.Final"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.1.125.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58057","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-58057","date":"2026-11-02","epss":0.00631,"percentile":0.5023}],"risk":0.3754449999999999,"urls":["https://github.com/netty/netty/security/advisories/GHSA-3p8m-j85q-pgmj","https://github.com/netty/netty/commit/9d804c54ce962408ae6418255a83a13924f7145d","https://nvd.nist.gov/vuln/detail/CVE-2025-58057"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3p8m-j85q-pgmj","description":"Netty's decoders vulnerable to DoS via zip bomb style attack"},"relatedVulnerabilities":[{"id":"CVE-2025-58057","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58057","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-58057","date":"2026-11-02","epss":0.00631,"percentile":0.5023}],"urls":["https://github.com/netty/netty/commit/9d804c54ce962408ae6418255a83a13924f7145d","https://github.com/netty/netty/security/advisories/GHSA-3p8m-j85q-pgmj"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58057","description":"Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression."}]},{"artifact":{"id":"bab8d09d07950909","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.11.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.2","type":"java-archive","version":"2.11.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.hazelcast_hazelcast-3.12.13.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.hazelcast_hazelcast-3.12.13.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.hazelcast_hazelcast-3.12.13.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7wm-3cxj-wff9","versionConstraint":"<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.11.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r7wm-3cxj-wff9","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"risk":0.3750299999999999,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7wm-3cxj-wff9","description":"jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)"},"relatedVulnerabilities":[{"id":"CVE-2026-68494","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"urls":["https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/advisories/GHSA-72hv-8253-57qq","https://www.cve.org/CVERecord?id=CVE-2026-18401"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68494","description":"The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.\n\nThe earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.\n\nAs a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.\n\nThe equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.\n\nImpact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.\n\nExploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08)."}]},{"artifact":{"id":"8fba25e88f80966a","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.11.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.11.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.2","type":"java-archive","version":"2.11.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7wm-3cxj-wff9","versionConstraint":"<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.11.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r7wm-3cxj-wff9","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"risk":0.3750299999999999,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7wm-3cxj-wff9","description":"jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)"},"relatedVulnerabilities":[{"id":"CVE-2026-68494","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"urls":["https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/advisories/GHSA-72hv-8253-57qq","https://www.cve.org/CVERecord?id=CVE-2026-18401"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68494","description":"The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.\n\nThe earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.\n\nAs a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.\n\nThe equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.\n\nImpact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.\n\nExploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08)."}]},{"artifact":{"id":"00a31800f16e4d02","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.12.7:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.12.7:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.12.7","type":"java-archive","version":"2.12.7","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7wm-3cxj-wff9","versionConstraint":"<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.12.7"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r7wm-3cxj-wff9","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"risk":0.3750299999999999,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7wm-3cxj-wff9","description":"jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)"},"relatedVulnerabilities":[{"id":"CVE-2026-68494","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"urls":["https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/advisories/GHSA-72hv-8253-57qq","https://www.cve.org/CVERecord?id=CVE-2026-18401"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68494","description":"The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.\n\nThe earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.\n\nAs a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.\n\nThe equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.\n\nImpact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.\n\nExploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08)."}]},{"artifact":{"id":"0817be99e5231885","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.13.4:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.13.4:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4","type":"java-archive","version":"2.13.4","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7wm-3cxj-wff9","versionConstraint":"<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.13.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r7wm-3cxj-wff9","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"risk":0.3750299999999999,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7wm-3cxj-wff9","description":"jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)"},"relatedVulnerabilities":[{"id":"CVE-2026-68494","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"urls":["https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/advisories/GHSA-72hv-8253-57qq","https://www.cve.org/CVERecord?id=CVE-2026-18401"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68494","description":"The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.\n\nThe earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.\n\nAs a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.\n\nThe equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.\n\nImpact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.\n\nExploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08)."}]},{"artifact":{"id":"e2fc9ff677ffb6c7","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar:META-INF/lib/jackson-core-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"7a07bc535ccf0b7f6929c4d0f2ab9b294ef7c4a3","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar:META-INF/lib/jackson-core-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7wm-3cxj-wff9","versionConstraint":"<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r7wm-3cxj-wff9","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"risk":0.3750299999999999,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7wm-3cxj-wff9","description":"jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)"},"relatedVulnerabilities":[{"id":"CVE-2026-68494","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"urls":["https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/advisories/GHSA-72hv-8253-57qq","https://www.cve.org/CVERecord?id=CVE-2026-18401"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68494","description":"The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.\n\nThe earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.\n\nAs a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.\n\nThe equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.\n\nImpact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.\n\nExploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08)."}]},{"artifact":{"id":"e9be8ec26ef33e8f","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7wm-3cxj-wff9","versionConstraint":"<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r7wm-3cxj-wff9","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"risk":0.3750299999999999,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7wm-3cxj-wff9","description":"jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)"},"relatedVulnerabilities":[{"id":"CVE-2026-68494","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"urls":["https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/advisories/GHSA-72hv-8253-57qq","https://www.cve.org/CVERecord?id=CVE-2026-18401"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68494","description":"The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.\n\nThe earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.\n\nAs a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.\n\nThe equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.\n\nImpact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.\n\nExploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08)."}]},{"artifact":{"id":"b0a031fbd375f152","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar:com.fasterxml.jackson.core:jackson-core","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7wm-3cxj-wff9","versionConstraint":"<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r7wm-3cxj-wff9","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"risk":0.3750299999999999,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7wm-3cxj-wff9","description":"jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)"},"relatedVulnerabilities":[{"id":"CVE-2026-68494","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"urls":["https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/advisories/GHSA-72hv-8253-57qq","https://www.cve.org/CVERecord?id=CVE-2026-18401"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68494","description":"The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.\n\nThe earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.\n\nAs a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.\n\nThe equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.\n\nImpact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.\n\nExploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08)."}]},{"artifact":{"id":"e858bb869922cbbc","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/jackson-core-2.15.2.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"a6fe1836469a69b3ff66037c324d75fc66ef137c","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/jackson-core-2.15.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7wm-3cxj-wff9","versionConstraint":"<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r7wm-3cxj-wff9","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"risk":0.3750299999999999,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7wm-3cxj-wff9","description":"jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)"},"relatedVulnerabilities":[{"id":"CVE-2026-68494","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"urls":["https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/advisories/GHSA-72hv-8253-57qq","https://www.cve.org/CVERecord?id=CVE-2026-18401"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68494","description":"The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.\n\nThe earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.\n\nAs a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.\n\nThe equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.\n\nImpact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.\n\nExploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08)."}]},{"artifact":{"id":"1279d8cb864648ff","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar:META-INF/lib/jackson-core-2.15.3.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"60d600567c1862840397bf9ff5a92398edc5797b","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar:META-INF/lib/jackson-core-2.15.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7wm-3cxj-wff9","versionConstraint":"<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r7wm-3cxj-wff9","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"risk":0.3750299999999999,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7wm-3cxj-wff9","description":"jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)"},"relatedVulnerabilities":[{"id":"CVE-2026-68494","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"urls":["https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/advisories/GHSA-72hv-8253-57qq","https://www.cve.org/CVERecord?id=CVE-2026-18401"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68494","description":"The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.\n\nThe earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.\n\nAs a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.\n\nThe equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.\n\nImpact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.\n\nExploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08)."}]},{"artifact":{"id":"12e2a5381b054e59","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-core-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"899e5cf01be55fbf094ad72b2edb0c5df99111ee","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-core-2.16.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-core-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7wm-3cxj-wff9","versionConstraint":"<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r7wm-3cxj-wff9","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"risk":0.3750299999999999,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7wm-3cxj-wff9","description":"jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)"},"relatedVulnerabilities":[{"id":"CVE-2026-68494","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"urls":["https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/advisories/GHSA-72hv-8253-57qq","https://www.cve.org/CVERecord?id=CVE-2026-18401"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68494","description":"The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.\n\nThe earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.\n\nAs a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.\n\nThe equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.\n\nImpact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.\n\nExploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08)."}]},{"artifact":{"id":"e5f24aca4988a119","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-core-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"899e5cf01be55fbf094ad72b2edb0c5df99111ee","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-core-2.16.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-core-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7wm-3cxj-wff9","versionConstraint":"<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r7wm-3cxj-wff9","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"risk":0.3750299999999999,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7wm-3cxj-wff9","description":"jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)"},"relatedVulnerabilities":[{"id":"CVE-2026-68494","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"urls":["https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/advisories/GHSA-72hv-8253-57qq","https://www.cve.org/CVERecord?id=CVE-2026-18401"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68494","description":"The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.\n\nThe earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.\n\nAs a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.\n\nThe equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.\n\nImpact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.\n\nExploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08)."}]},{"artifact":{"id":"b618b6546d46c79d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar:META-INF/lib/jackson-core-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"899e5cf01be55fbf094ad72b2edb0c5df99111ee","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar:META-INF/lib/jackson-core-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7wm-3cxj-wff9","versionConstraint":"<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r7wm-3cxj-wff9","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"risk":0.3750299999999999,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7wm-3cxj-wff9","description":"jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)"},"relatedVulnerabilities":[{"id":"CVE-2026-68494","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"urls":["https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/advisories/GHSA-72hv-8253-57qq","https://www.cve.org/CVERecord?id=CVE-2026-18401"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68494","description":"The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.\n\nThe earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.\n\nAs a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.\n\nThe equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.\n\nImpact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.\n\nExploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08)."}]},{"artifact":{"id":"c407f6f2e09e5938","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar:META-INF/lib/jackson-core-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"899e5cf01be55fbf094ad72b2edb0c5df99111ee","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar:META-INF/lib/jackson-core-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7wm-3cxj-wff9","versionConstraint":"<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r7wm-3cxj-wff9","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"risk":0.3750299999999999,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7wm-3cxj-wff9","description":"jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)"},"relatedVulnerabilities":[{"id":"CVE-2026-68494","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-11-02","epss":0.00463,"percentile":0.40147}],"urls":["https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/advisories/GHSA-72hv-8253-57qq","https://www.cve.org/CVERecord?id=CVE-2026-18401"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68494","description":"The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.\n\nThe earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.\n\nAs a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.\n\nThe equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.\n\nImpact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.\n\nExploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08)."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11940","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-11940","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-02","epss":0.0075,"percentile":0.54968}],"risk":0.375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11940"},"relatedVulnerabilities":[{"id":"CVE-2026-11940","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-02","epss":0.0075,"percentile":0.54968}],"urls":["https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5","https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f","https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df","https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde","https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c","https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9","https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877","https://github.com/python/cpython/issues/151558","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11940","description":"tarfile.extractall() with the 'data' or 'tar'\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.  \nThe extraction fallback validated the symlink at it's archived location \nbut recreated it at the hardlink's shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.  \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11940","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-11940","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-02","epss":0.0075,"percentile":0.54968}],"risk":0.375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11940"},"relatedVulnerabilities":[{"id":"CVE-2026-11940","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-02","epss":0.0075,"percentile":0.54968}],"urls":["https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5","https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f","https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df","https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde","https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c","https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9","https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877","https://github.com/python/cpython/issues/151558","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11940","description":"tarfile.extractall() with the 'data' or 'tar'\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.  \nThe extraction fallback validated the symlink at it's archived location \nbut recreated it at the hardlink's shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.  \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-11940","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-11940","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-02","epss":0.0075,"percentile":0.54968}],"risk":0.375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11940"},"relatedVulnerabilities":[{"id":"CVE-2026-11940","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-02","epss":0.0075,"percentile":0.54968}],"urls":["https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5","https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f","https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df","https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde","https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c","https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9","https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877","https://github.com/python/cpython/issues/151558","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11940","description":"tarfile.extractall() with the 'data' or 'tar'\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.  \nThe extraction fallback validated the symlink at it's archived location \nbut recreated it at the hardlink's shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.  \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11940","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-11940","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-02","epss":0.0075,"percentile":0.54968}],"risk":0.375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11940"},"relatedVulnerabilities":[{"id":"CVE-2026-11940","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-02","epss":0.0075,"percentile":0.54968}],"urls":["https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5","https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f","https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df","https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde","https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c","https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9","https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877","https://github.com/python/cpython/issues/151558","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11940","description":"tarfile.extractall() with the 'data' or 'tar'\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.  \nThe extraction fallback validated the symlink at it's archived location \nbut recreated it at the hardlink's shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.  \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."}]},{"artifact":{"id":"fb7895faf09fd4e5","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.19.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.2-2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-37370","versionConstraint":"< 1.19.2-2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-37370","fix":{"state":"fixed","versions":["1.19.2-2ubuntu0.4"],"available":[{"date":"2024-08-08","kind":"advisory","version":"1.19.2-2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-37370","cwe":"CWE-345","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37370","date":"2026-11-02","epss":0.00748,"percentile":0.54912}],"risk":0.374,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-37370"},"relatedVulnerabilities":[{"id":"CVE-2024-37370","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-37370","cwe":"CWE-345","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37370","date":"2026-11-02","epss":0.00748,"percentile":0.54912}],"urls":["https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef","https://web.mit.edu/kerberos/www/advisories/","https://security.netapp.com/advisory/ntap-20241108-0007/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-37370","description":"In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application."}]},{"artifact":{"id":"33db6cef15da892e","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.19.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.2-2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-37370","versionConstraint":"< 1.19.2-2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-37370","fix":{"state":"fixed","versions":["1.19.2-2ubuntu0.4"],"available":[{"date":"2024-08-08","kind":"advisory","version":"1.19.2-2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-37370","cwe":"CWE-345","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37370","date":"2026-11-02","epss":0.00748,"percentile":0.54912}],"risk":0.374,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-37370"},"relatedVulnerabilities":[{"id":"CVE-2024-37370","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-37370","cwe":"CWE-345","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37370","date":"2026-11-02","epss":0.00748,"percentile":0.54912}],"urls":["https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef","https://web.mit.edu/kerberos/www/advisories/","https://security.netapp.com/advisory/ntap-20241108-0007/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-37370","description":"In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application."}]},{"artifact":{"id":"8baf93711e927f68","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.19.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.2-2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-37370","versionConstraint":"< 1.19.2-2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-37370","fix":{"state":"fixed","versions":["1.19.2-2ubuntu0.4"],"available":[{"date":"2024-08-08","kind":"advisory","version":"1.19.2-2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-37370","cwe":"CWE-345","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37370","date":"2026-11-02","epss":0.00748,"percentile":0.54912}],"risk":0.374,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-37370"},"relatedVulnerabilities":[{"id":"CVE-2024-37370","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-37370","cwe":"CWE-345","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37370","date":"2026-11-02","epss":0.00748,"percentile":0.54912}],"urls":["https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef","https://web.mit.edu/kerberos/www/advisories/","https://security.netapp.com/advisory/ntap-20241108-0007/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-37370","description":"In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application."}]},{"artifact":{"id":"6e90bedd237fee0a","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.19.2-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.19.2-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.2-2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-37370","versionConstraint":"< 1.19.2-2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-37370","fix":{"state":"fixed","versions":["1.19.2-2ubuntu0.4"],"available":[{"date":"2024-08-08","kind":"advisory","version":"1.19.2-2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-37370","cwe":"CWE-345","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37370","date":"2026-11-02","epss":0.00748,"percentile":0.54912}],"risk":0.374,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-37370"},"relatedVulnerabilities":[{"id":"CVE-2024-37370","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-37370","cwe":"CWE-345","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-37370","date":"2026-11-02","epss":0.00748,"percentile":0.54912}],"urls":["https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef","https://web.mit.edu/kerberos/www/advisories/","https://security.netapp.com/advisory/ntap-20241108-0007/","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-37370","description":"In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application."}]},{"artifact":{"id":"a8f1f07e02daddd2","cpes":["cpe:2.3:a:org.springframework:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring_webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring_webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-webmvc:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_webmvc:5.3.30:*:*:*:*:*:*:*"],"name":"spring-webmvc","purl":"pkg:maven/org.springframework/spring-webmvc@5.3.30","type":"java-archive","version":"5.3.30","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-webmvc-5.3.30.jar","manifestName":"","pomArtifactID":"spring-webmvc","archiveDigests":[{"value":"67ad9ebc6189c91942a52328f58d824cd3171fd9","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-webmvc-5.3.30.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-webmvc-5.3.30.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.3.42"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w3c8-7r8f-9jp8","versionConstraint":">=5.3.0,<5.3.42 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-webmvc","version":"5.3.30"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-w3c8-7r8f-9jp8","fix":{"state":"fixed","versions":["5.3.42"],"available":[{"date":"2025-01-11","kind":"first-observed","version":"5.3.42"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38828","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-38828","date":"2026-11-02","epss":0.00724,"percentile":0.54047}],"risk":0.37285999999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-38828","https://spring.io/security/cve-2024-38828","https://security.netapp.com/advisory/ntap-20250509-0009"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w3c8-7r8f-9jp8","description":"Spring MVC controller vulnerable to a DoS attack"},"relatedVulnerabilities":[{"id":"CVE-2024-38828","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38828","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-38828","date":"2026-11-02","epss":0.00724,"percentile":0.54047}],"urls":["https://spring.io/security/cve-2024-38828","https://security.netapp.com/advisory/ntap-20250509-0009/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-38828","description":"Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack."}]},{"artifact":{"id":"10306e8811bffeff","cpes":["cpe:2.3:a:io.netty.codec:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec:codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec","purl":"pkg:maven/io.netty/netty-codec@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec","archiveDigests":[{"value":"9c3c71e7cf3b8ce3bfc9fa52a524b9ca7ddf259c","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-4.1.100.Final.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-558v-64gr-wgg4","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-558v-64gr-wgg4","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-11-02","epss":0.0046,"percentile":0.39859}],"risk":0.3726,"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-558v-64gr-wgg4","description":"Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang"},"relatedVulnerabilities":[{"id":"CVE-2026-59901","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-11-02","epss":0.0046,"percentile":0.39859}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59901","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"480239e16ce6ec7f","cpes":["cpe:2.3:a:netty-codec:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec","purl":"pkg:maven/io.netty/netty-codec@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:io.netty:netty-codec","manifestName":"","pomArtifactID":"netty-codec","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-558v-64gr-wgg4","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-558v-64gr-wgg4","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-11-02","epss":0.0046,"percentile":0.39859}],"risk":0.3726,"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-558v-64gr-wgg4","description":"Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang"},"relatedVulnerabilities":[{"id":"CVE-2026-59901","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-11-02","epss":0.0046,"percentile":0.39859}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59901","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"7873ac2db80e7dce","cpes":["cpe:2.3:a:netty-codec:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec","purl":"pkg:maven/io.netty/netty-codec@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:io.netty:netty-codec","manifestName":"","pomArtifactID":"netty-codec","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-558v-64gr-wgg4","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-558v-64gr-wgg4","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-11-02","epss":0.0046,"percentile":0.39859}],"risk":0.3726,"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-558v-64gr-wgg4","description":"Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang"},"relatedVulnerabilities":[{"id":"CVE-2026-59901","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-11-02","epss":0.0046,"percentile":0.39859}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59901","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"af534de498eed696","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.4.7-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.4.7-1ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=expat","type":"deb","version":"2.4.7-1ubuntu0.2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.7-1ubuntu0.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66046","versionConstraint":"< 2.4.7-1ubuntu0.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"expat","version":"2.4.7-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-66046","fix":{"state":"fixed","versions":["2.4.7-1ubuntu0.9"],"available":[{"date":"2026-09-24","kind":"advisory","version":"2.4.7-1ubuntu0.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-66046","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66046","date":"2026-11-02","epss":0.00742,"percentile":0.54683}],"risk":0.371,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66046"},"relatedVulnerabilities":[{"id":"CVE-2026-66046","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66046","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66046","date":"2026-11-02","epss":0.00742,"percentile":0.54683}],"urls":["https://github.com/libexpat/libexpat/pull/1321","https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66046","description":"Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options."}]},{"artifact":{"id":"f9e961d53cf996e8","cpes":["cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:io.netty:netty-handler","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c653-97m9-rcg9","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c653-97m9-rcg9","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-16","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-50010","date":"2026-11-02","epss":0.00491,"percentile":0.42202}],"risk":0.36825,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9","https://nvd.nist.gov/vuln/detail/CVE-2026-50010","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c653-97m9-rcg9","description":"Netty: Wrapping plain trust manager silently disables hostname verification"},"relatedVulnerabilities":[{"id":"CVE-2026-50010","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-50010","date":"2026-11-02","epss":0.00491,"percentile":0.42202}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-50010","https://bugzilla.redhat.com/show_bug.cgi?id=2488429","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50010.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50010","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm=\"HTTPS\" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"72a1968e6efdfa5e","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-handler-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"4c0acdb8bb73647ebb3847ac2d503d53d72c02b4","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-handler-4.1.100.Final.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-handler-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c653-97m9-rcg9","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c653-97m9-rcg9","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-16","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-50010","date":"2026-11-02","epss":0.00491,"percentile":0.42202}],"risk":0.36825,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9","https://nvd.nist.gov/vuln/detail/CVE-2026-50010","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c653-97m9-rcg9","description":"Netty: Wrapping plain trust manager silently disables hostname verification"},"relatedVulnerabilities":[{"id":"CVE-2026-50010","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-50010","date":"2026-11-02","epss":0.00491,"percentile":0.42202}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-50010","https://bugzilla.redhat.com/show_bug.cgi?id=2488429","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50010.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50010","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm=\"HTTPS\" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"ebd7a017631da953","cpes":["cpe:2.3:a:netty-handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:io.netty:netty-handler","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c653-97m9-rcg9","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c653-97m9-rcg9","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-16","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-50010","date":"2026-11-02","epss":0.00491,"percentile":0.42202}],"risk":0.36825,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9","https://nvd.nist.gov/vuln/detail/CVE-2026-50010","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c653-97m9-rcg9","description":"Netty: Wrapping plain trust manager silently disables hostname verification"},"relatedVulnerabilities":[{"id":"CVE-2026-50010","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-50010","date":"2026-11-02","epss":0.00491,"percentile":0.42202}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-50010","https://bugzilla.redhat.com/show_bug.cgi?id=2488429","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50010.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50010","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm=\"HTTPS\" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-02","epss":0.00734,"percentile":0.54411}],"risk":0.367,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17084"},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-02","epss":0.00734,"percentile":0.54411}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-02","epss":0.00734,"percentile":0.54411}],"risk":0.367,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17084"},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-02","epss":0.00734,"percentile":0.54411}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-02","epss":0.00734,"percentile":0.54411}],"risk":0.367,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17084"},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-02","epss":0.00734,"percentile":0.54411}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-02","epss":0.00734,"percentile":0.54411}],"risk":0.367,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17084"},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-02","epss":0.00734,"percentile":0.54411}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"bab0f28d5b9840f7","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.12.7.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1","type":"java-archive","version":"2.12.7.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.14.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3wrr-7qpf-2prh","versionConstraint":">=2.10.0,<=2.13.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.12.7.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3wrr-7qpf-2prh","fix":{"state":"fixed","versions":["2.14.0"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.14.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50193","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-50193","date":"2026-11-02","epss":0.00616,"percentile":0.49532}],"risk":0.36651999999999996,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh","https://github.com/FasterXML/jackson-databind/issues/3447","https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c","https://nvd.nist.gov/vuln/detail/CVE-2026-50193"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3wrr-7qpf-2prh","description":"jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()"},"relatedVulnerabilities":[{"id":"CVE-2026-50193","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50193","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-50193","date":"2026-11-02","epss":0.00616,"percentile":0.49532}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c","https://github.com/FasterXML/jackson-databind/issues/3447","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50193","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0."}]},{"artifact":{"id":"a6af29070f42c49f","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2","type":"java-archive","version":"2.13.4.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.14.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3wrr-7qpf-2prh","versionConstraint":">=2.10.0,<=2.13.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.13.4.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3wrr-7qpf-2prh","fix":{"state":"fixed","versions":["2.14.0"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.14.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50193","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-50193","date":"2026-11-02","epss":0.00616,"percentile":0.49532}],"risk":0.36651999999999996,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh","https://github.com/FasterXML/jackson-databind/issues/3447","https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c","https://nvd.nist.gov/vuln/detail/CVE-2026-50193"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3wrr-7qpf-2prh","description":"jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()"},"relatedVulnerabilities":[{"id":"CVE-2026-50193","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50193","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-50193","date":"2026-11-02","epss":0.00616,"percentile":0.49532}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c","https://github.com/FasterXML/jackson-databind/issues/3447","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50193","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0."}]},{"artifact":{"id":"bab0f28d5b9840f7","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.12.7.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1","type":"java-archive","version":"2.12.7.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.12.7.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"a6af29070f42c49f","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2","type":"java-archive","version":"2.13.4.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.13.4.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"7e51f2d66453ad51","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar:META-INF/lib/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar:META-INF/lib/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"8b225a368370af7c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"051e7df316b5a531","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"7bbe612d6a8369b0","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"3ad576839e998952","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/jackson-databind-2.15.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"9353b021f10c307c00328f52090de2bdb4b6ff9c","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/jackson-databind-2.15.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"93ac7e2aa6804f54","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar:META-INF/lib/jackson-databind-2.15.3.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"a734bc2c47a9453c4efa772461a3aeb273c010d9","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar:META-INF/lib/jackson-databind-2.15.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"e7a8f6a39fc0ef2d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-databind-2.16.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"55d5220f811f88ce","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-databind-2.16.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"ed97116d7d90df11","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"a89c3f9fac63d225","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-02","epss":0.00487,"percentile":0.41917}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"bab0f28d5b9840f7","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.12.7.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.12.7.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1","type":"java-archive","version":"2.12.7.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.12.7.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"a6af29070f42c49f","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.13.4.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.13.4.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2","type":"java-archive","version":"2.13.4.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.analytics.analytics-client-8.3.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.13.4.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"7e51f2d66453ad51","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar:META-INF/lib/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.gatekeeper.gatekeeper-plugin-18.7.56.jar:META-INF/lib/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"8b225a368370af7c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2","type":"java-archive","version":"2.14.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.applinks.applinks-plugin-9.1.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"7bbe612d6a8369b0","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"051e7df316b5a531","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/net.sf.ehcache_ehcache-2.11.0.5.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"3ad576839e998952","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2","type":"java-archive","version":"2.15.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/jackson-databind-2.15.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"9353b021f10c307c00328f52090de2bdb4b6ff9c","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.migration.migration-agent-3.9.2.jar:lib/jackson-databind-2.15.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"93ac7e2aa6804f54","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.15.3:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.15.3:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3","type":"java-archive","version":"2.15.3","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar:META-INF/lib/jackson-databind-2.15.3.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"a734bc2c47a9453c4efa772461a3aeb273c010d9","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.business.insights.confluence-plugin-2.4.3.jar:META-INF/lib/jackson-databind-2.15.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"55d5220f811f88ce","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-databind-2.16.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/com.fasterxml.jackson.core_jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"e7a8f6a39fc0ef2d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-databind-2.16.0.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"ed97116d7d90df11","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-graphql-module-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"a89c3f9fac63d225","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.16.0:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.16.0:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0","type":"java-archive","version":"2.16.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"3a6b7f8ff7b30d518bbd65678e9c30cd881f19a7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.plugins.confluence-opensearch-8.7.2.jar:META-INF/lib/jackson-databind-2.16.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.16.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-02","epss":0.00487,"percentile":0.41916}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"cfda19effa7c6d29","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.3?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.3","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42015","versionConstraint":"< 3.7.3-4ubuntu1.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-42015","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.9"],"available":[{"date":"2026-05-20","kind":"advisory","version":"3.7.3-4ubuntu1.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-42015","cwe":"CWE-193","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-42015","date":"2026-11-02","epss":0.00727,"percentile":0.54166}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42015"},"relatedVulnerabilities":[{"id":"CVE-2026-42015","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42015","cwe":"CWE-193","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-42015","date":"2026-11-02","epss":0.00727,"percentile":0.54166}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:43575","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-42015","https://bugzilla.redhat.com/show_bug.cgi?id=2467678","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-11"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42015","description":"A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the internal array of a PKCS#12 bag when appending to a bag that already contains 32 elements. This memory corruption could lead to a denial of service (DoS) or potentially other unspecified impacts."}]},{"artifact":{"id":"41fd2c72127de89f","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"992623e7d8f2d96e41faf1687bb963f5433e3517","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/lib/io.netty_netty-codec-http-4.1.100.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4f6-jm68-57ww","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4f6-jm68-57ww","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-11-02","epss":0.00609,"percentile":0.49175}],"risk":0.362355,"urls":["https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4f6-jm68-57ww","description":"Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service"},"relatedVulnerabilities":[{"id":"CVE-2026-59899","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-11-02","epss":0.00609,"percentile":0.49175}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59899","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"b400511196d0cd9e","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/confluence/WEB-INF/packages/synchrony-standalone.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4f6-jm68-57ww","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4f6-jm68-57ww","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-11-02","epss":0.00609,"percentile":0.49175}],"risk":0.362355,"urls":["https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4f6-jm68-57ww","description":"Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service"},"relatedVulnerabilities":[{"id":"CVE-2026-59899","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-11-02","epss":0.00609,"percentile":0.49175}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59899","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"0ae96c8bb001b7ff","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.100.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.100.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.100.Final","type":"java-archive","version":"4.1.100.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/bin/atlassian-secrets-cli.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4f6-jm68-57ww","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.100.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4f6-jm68-57ww","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-11-02","epss":0.00609,"percentile":0.49175}],"risk":0.362355,"urls":["https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4f6-jm68-57ww","description":"Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service"},"relatedVulnerabilities":[{"id":"CVE-2026-59899","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-11-02","epss":0.00609,"percentile":0.49175}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59899","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"cfda19effa7c6d29","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.3?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.3","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:8e87ff28f1b5ff2d5131999ccfa1e674cb252631c50683f5ee43fad59cbea8e1","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-4ubuntu1.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-28834","versionConstraint":"< 3.7.3-4ubuntu1.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-28834","fix":{"state":"fixed","versions":["3.7.3-4ubuntu1.5"],"available":[{"date":"2024-04-15","kind":"advisory","version":"3.7.3-4ubuntu1.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-28834","cwe":"CWE-327","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-28834","date":"2026-11-02","epss":0.00724,"percentile":0.54057}],"risk":0.362,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28834"},"relatedVulnerabilities":[{"id":"CVE-2024-28834","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28834","cwe":"CWE-327","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-28834","date":"2026-11-02","epss":0.00724,"percentile":0.54057}],"urls":["https://access.redhat.com/errata/RHSA-2024:1784","https://access.redhat.com/errata/RHSA-2024:1879","https://access.redhat.com/errata/RHSA-2024:1997","https://access.redhat.com/errata/RHSA-2024:2044","https://access.redhat.com/errata/RHSA-2024:2570","https://access.redhat.com/errata/RHSA-2024:2889","https://access.redhat.com/security/cve/CVE-2024-28834","https://bugzilla.redhat.com/show_bug.cgi?id=2269228","https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html","https://minerva.crocs.fi.muni.cz/","http://www.openwall.com/lists/oss-security/2024/03/22/1","http://www.openwall.com/lists/oss-security/2024/03/22/2","https://lists.debian.org/debian-lts-announce/2024/09/msg00019.html","https://people.redhat.com/~hkario/marvin/","https://security.netapp.com/advisory/ntap-20240524-0004/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28834","description":"A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel."}]},{"artifact":{"id":"7f5afd36e2a50847","cpes":["cpe:2.3:a:curl:curl:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.24"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6253","versionConstraint":"< 7.81.0-1ubuntu1.24 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-6253","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.24"],"available":[{"date":"2026-05-04","kind":"advisory","version":"7.81.0-1ubuntu1.24"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-11-02","epss":0.00719,"percentile":0.53912}],"risk":0.3595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6253"},"relatedVulnerabilities":[{"id":"CVE-2026-6253","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-11-02","epss":0.00719,"percentile":0.53912}],"urls":["https://curl.se/docs/CVE-2026-6253.html","https://curl.se/docs/CVE-2026-6253.json","https://hackerone.com/reports/3669637","http://www.openwall.com/lists/oss-security/2026/04/29/11"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6253","description":"curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy"}]},{"artifact":{"id":"eebde1772607afd6","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.81.0-1ubuntu1.15:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.81.0-1ubuntu1.15?arch=amd64&distro=ubuntu-22.04&upstream=curl","type":"deb","version":"7.81.0-1ubuntu1.15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:f7ec018ed0afe6cb08d3f2ac93bdfaf9b7f23d1ba6ee1048f79e8cdc2c002d30","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.81.0-1ubuntu1.24"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6253","versionConstraint":"< 7.81.0-1ubuntu1.24 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"curl","version":"7.81.0-1ubuntu1.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-6253","fix":{"state":"fixed","versions":["7.81.0-1ubuntu1.24"],"available":[{"date":"2026-05-04","kind":"advisory","version":"7.81.0-1ubuntu1.24"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-11-02","epss":0.00719,"percentile":0.53912}],"risk":0.3595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6253"},"relatedVulnerabilities":[{"id":"CVE-2026-6253","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-11-02","epss":0.00719,"percentile":0.53912}],"urls":["https://curl.se/docs/CVE-2026-6253.html","https://curl.se/docs/CVE-2026-6253.json","https://hackerone.com/reports/3669637","http://www.openwall.com/lists/oss-security/2026/04/29/11"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6253","description":"curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy"}]},{"artifact":{"id":"595039104d10a8b1","cpes":["cpe:2.3:a:springsource-spring-framework:springsource_spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring_framework:springsource_spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:springsource_spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring:springsource_spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring:springsource_spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:springsource_spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-framework:springsource_spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_framework:springsource_spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring-framework:spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring_framework:spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:springsource_spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springsource:springsource_spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-core:springsource_spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_core:springsource_spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring-framework:spring-core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring-framework:spring_core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring_framework:spring-core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring_framework:spring_core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:springsource_spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring:spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring:spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:vmware:springsource_spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-framework:spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_framework:spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring-core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring:spring-core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring:spring_core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring:spring-core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring:spring_core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springsource:spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:spring-core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:spring_core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-core:spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-framework:spring-core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-framework:spring_core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_core:spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_framework:spring-core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_framework:spring_core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springsource:spring-core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:springsource:spring_core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-core:spring-core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring-core:spring_core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_core:spring-core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring_core:spring_core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_framework:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring-core:5.3.30:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_core:5.3.30:*:*:*:*:*:*:*"],"name":"spring-core","purl":"pkg:maven/org.springframework/spring-core@5.3.30","type":"java-archive","version":"5.3.30","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-core-5.3.30.jar","manifestName":"","pomArtifactID":"spring-core","archiveDigests":[{"value":"cd2b09bf9bdb45c3cf2b771317b6dd0d6b2f6a25","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-core-5.3.30.jar","layerID":"sha256:6982f76abc370a3ed7c9f10b14eae22ebe8dc475fbab4baa4b3ddd43350779b0","accessPath":"/opt/atlassian/confluence/synchrony-proxy/WEB-INF/lib/spring-core-5.3.30.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jmp9-x22r-554x","versionConstraint":">=5.3.0,<=5.3.44 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-core","version":"5.3.30"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jmp9-x22r-554x","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-41249","cwe":"CWE-285","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-41249","date":"2026-11-02","epss":0.00478,"percentile":0.4125}],"risk":0.35850000000000004,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-41249","https://spring.io/security/cve-2025-41249","https://github.com/spring-projects/spring-framework/issues/35342","https://github.com/spring-projects/spring-framework/commit/6d710d482a6785b069e35022e81758953afc21ff","https://github.com/spring-projects/spring-framework/releases/tag/v6.2.11"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jmp9-x22r-554x","description":"Spring Framework annotation detection mechanism may result in improper authorization"},"relatedVulnerabilities":[{"id":"CVE-2025-41249","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-41249","cwe":"CWE-285","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-41249","date":"2026-11-02","epss":0.00478,"percentile":0.4125}],"urls":["https://spring.io/security/cve-2025-41249"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-41249","description":"The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions.\n\nYour application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature.\n\nYou are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces.\n\nThis CVE is published in conjunction with  CVE-2025-41248 https://spring.io/security/cve-2025-41248 ."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4224","versionConstraint":"< 3.10.12-1~22.04.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-4224","fix":{"state":"fixed","versions":["3.10.12-1~22.04.16"],"available":[{"date":"2026-07-06","kind":"advisory","version":"3.10.12-1~22.04.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-4224","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4224","date":"2026-11-02","epss":0.00717,"percentile":0.53837}],"risk":0.3585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4224"},"relatedVulnerabilities":[{"id":"CVE-2026-4224","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4224","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4224","date":"2026-11-02","epss":0.00717,"percentile":0.53837}],"urls":["https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a","https://github.com/python/cpython/commit/24ce88b285f56ee11626cf5e472af3cd8cc7c621","https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785","https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914fee","https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3","https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768","https://github.com/python/cpython/issues/145986","https://github.com/python/cpython/pull/145987","https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/","http://www.openwall.com/lists/oss-security/2026/03/16/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4224","description":"When an Expat parser with a registered ElementDeclHandler parses an inline\ndocument type definition containing a deeply nested content model a C stack\noverflow occurs."}]},{"artifact":{"id":"4d142cb37a3c62b7","cpes":["cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-stdlib","purl":"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4224","versionConstraint":"< 3.10.12-1~22.04.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-4224","fix":{"state":"fixed","versions":["3.10.12-1~22.04.16"],"available":[{"date":"2026-07-06","kind":"advisory","version":"3.10.12-1~22.04.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-4224","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4224","date":"2026-11-02","epss":0.00717,"percentile":0.53837}],"risk":0.3585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4224"},"relatedVulnerabilities":[{"id":"CVE-2026-4224","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4224","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4224","date":"2026-11-02","epss":0.00717,"percentile":0.53837}],"urls":["https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a","https://github.com/python/cpython/commit/24ce88b285f56ee11626cf5e472af3cd8cc7c621","https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785","https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914fee","https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3","https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768","https://github.com/python/cpython/issues/145986","https://github.com/python/cpython/pull/145987","https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/","http://www.openwall.com/lists/oss-security/2026/03/16/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4224","description":"When an Expat parser with a registered ElementDeclHandler parses an inline\ndocument type definition containing a deeply nested content model a C stack\noverflow occurs."}]},{"artifact":{"id":"516175afa5d35097","cpes":["cpe:2.3:a:python3.10:python3.10:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10","purl":"pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.list"},{"path":"/var/lib/dpkg/info/python3.10.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.postinst"},{"path":"/var/lib/dpkg/info/python3.10.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.16"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4224","versionConstraint":"< 3.10.12-1~22.04.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-4224","fix":{"state":"fixed","versions":["3.10.12-1~22.04.16"],"available":[{"date":"2026-07-06","kind":"advisory","version":"3.10.12-1~22.04.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-4224","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4224","date":"2026-11-02","epss":0.00717,"percentile":0.53837}],"risk":0.3585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4224"},"relatedVulnerabilities":[{"id":"CVE-2026-4224","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4224","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4224","date":"2026-11-02","epss":0.00717,"percentile":0.53837}],"urls":["https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a","https://github.com/python/cpython/commit/24ce88b285f56ee11626cf5e472af3cd8cc7c621","https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785","https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914fee","https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3","https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768","https://github.com/python/cpython/issues/145986","https://github.com/python/cpython/pull/145987","https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/","http://www.openwall.com/lists/oss-security/2026/03/16/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4224","description":"When an Expat parser with a registered ElementDeclHandler parses an inline\ndocument type definition containing a deeply nested content model a C stack\noverflow occurs."}]},{"artifact":{"id":"a00635cbaa35c870","cpes":["cpe:2.3:a:python3.10-minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10-minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10_minimal:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.10:python3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"python3.10-minimal","purl":"pkg:deb/ubuntu/python3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/python3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.10-minimal.list","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.list"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.postrm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.10-minimal.preinst","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.10-minimal.prerm","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/python3.10-minimal.prerm"}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.12-1~22.04.16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4224","versionConstraint":"< 3.10.12-1~22.04.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-4224","fix":{"state":"fixed","versions":["3.10.12-1~22.04.16"],"available":[{"date":"2026-07-06","kind":"advisory","version":"3.10.12-1~22.04.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-4224","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4224","date":"2026-11-02","epss":0.00717,"percentile":0.53837}],"risk":0.3585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4224"},"relatedVulnerabilities":[{"id":"CVE-2026-4224","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4224","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4224","date":"2026-11-02","epss":0.00717,"percentile":0.53837}],"urls":["https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a","https://github.com/python/cpython/commit/24ce88b285f56ee11626cf5e472af3cd8cc7c621","https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785","https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914fee","https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3","https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768","https://github.com/python/cpython/issues/145986","https://github.com/python/cpython/pull/145987","https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/","http://www.openwall.com/lists/oss-security/2026/03/16/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4224","description":"When an Expat parser with a registered ElementDeclHandler parses an inline\ndocument type definition containing a deeply nested content model a C stack\noverflow occurs."}]},{"artifact":{"id":"34d30d985658c605","cpes":["cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libpython3.10-minimal","purl":"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=python3.10","type":"deb","version":"3.10.12-1~22.04.3","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.10-minimal/copyright","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/usr/share/doc/libpython3.10-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","layerID":"sha256:bfbd709077a133344f12ed4c32e1f21c23513baf9f6d646495e2d08ada57c8cb","accessPath":"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11972","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"python3.10","version":"3.10.12-1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-11972","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-02","epss":0.00715,"percentile":0.53757}],"risk":0.3575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11972"},"relatedVulnerabilities":[{"id":"CVE-2026-11972","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-02","epss":0.00715,"percentile":0.53757}],"urls":["https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9","https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365","https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21","https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec","https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192","https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896","https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438","https://github.com/python/cpython/issues/151981","https://github.com/python/cpython/pull/151982","https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","description":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."}]}],"grade":"F","score":"0.00","as_of":"2026-11-04T07:07:49.527Z","grype_db_version":"2026-11-03T06:20:47.000Z"}