VYPR

apk package

chainguard/kafbat-ui-fips

pkg:apk/chainguard/kafbat-ui-fips

Vulnerabilities (70)

  • CVE-2026-50020MedJun 12, 2026
    affected < 1.5.0-r6fixed 1.5.0-r6

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before reading the first request-line, `HttpObjectDecoder` skips every byte for which `Character.isISOControl(b)` is `true` (0x00–0x1F and 0

  • CVE-2026-50010HigJun 12, 2026
    affected < 1.5.0-r6fixed 1.5.0-r6

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrappe

  • CVE-2026-48043MedJun 12, 2026
    affected < 1.5.0-r6fixed 1.5.0-r6

    Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedCh

  • CVE-2026-47691HigJun 12, 2026
    affected < 1.5.0-r6fixed 1.5.0-r6

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an a

  • CVE-2026-47244MedJun 12, 2026
    affected < 1.5.0-r6fixed 1.5.0-r6

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTING

  • CVE-2026-45673MedJun 12, 2026
    affected < 1.5.0-r6fixed 1.5.0-r6

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination r

  • CVE-2026-45536MedJun 12, 2026
    affected < 1.5.0-r6fixed 1.5.0-r6

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to `char control[CMSG_SPACE(sizeof(int))]` (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCM_

  • CVE-2026-45416HigJun 12, 2026
    affected < 1.5.0-r6fixed 1.5.0-r6

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly all

  • CVE-2026-44249HigJun 11, 2026
    affected < 1.5.0-r6fixed 1.5.0-r6

    Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid pub

  • CVE-2026-47838MedJun 10, 2026
    affected < 1.5.0-r4fixed 1.5.0-r4

    SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. Affected versions: Sp

  • CVE-2026-41853MedJun 9, 2026
    affected < 1.5.0-r6fixed 1.5.0-r6

    Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

  • CVE-2026-41852LowJun 9, 2026
    affected < 1.5.0-r6fixed 1.5.0-r6

    A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic. Affected versions: Spring Framework 7.0.0

  • CVE-2026-41851MedJun 9, 2026
    affected < 1.5.0-r6fixed 1.5.0-r6

    Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 thro

  • CVE-2026-41850HigJun 9, 2026
    affected < 1.5.0-r6fixed 1.5.0-r6

    Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading to appli

  • CVE-2026-41848LowJun 9, 2026
    affected < 1.5.0-r6fixed 1.5.0-r6

    Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: match(String pattern, String path), matchStart(Stri

  • CVE-2026-41844MedJun 9, 2026
    affected < 1.5.0-r6fixed 1.5.0-r6

    A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix. Affected versions: Spring Framew

  • CVE-2026-41843MedJun 9, 2026
    affected < 1.5.0-r6fixed 1.5.0-r6

    Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

  • CVE-2026-41842HigJun 9, 2026
    affected < 1.5.0-r6fixed 1.5.0-r6

    Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

  • CVE-2026-41841MedJun 9, 2026
    affected < 1.5.0-r6fixed 1.5.0-r6

    Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

  • CVE-2026-41840MedJun 9, 2026
    affected < 1.5.0-r6fixed 1.5.0-r6

    Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.