chainguard/kafka-bridge-fips

Vulnerabilities (37)

• CVE-2026-47244MedJun 12, 2026
  affected < 1.0.0-r3fixed 1.0.0-r3

  Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTING

• CVE-2026-45674HigJun 12, 2026
  affected < 1.0.0-r3fixed 1.0.0-r3

  Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Fina

• CVE-2026-45673MedJun 12, 2026
  affected < 1.0.0-r3fixed 1.0.0-r3

  Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination r

• CVE-2026-45416HigJun 12, 2026
  affected < 1.0.0-r3fixed 1.0.0-r3

  Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly all

• CVE-2026-44249HigJun 11, 2026
  affected < 1.0.0-r3fixed 1.0.0-r3

  Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid pub

• CVE-2026-40984HigJun 9, 2026
  affected < 1.1.0-r0fixed 1.1.0-r0

  In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through

• CVE-2026-42587HigMay 13, 2026
  affected < 1.0.0-r1fixed 1.0.0-r1

  Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for

• CVE-2026-42579HigMay 13, 2026
  affected < 0.33.1-r11fixed 0.33.1-r11

  Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS respon

• CVE-2026-42578HigMay 13, 2026
  affected < 1.0.0-r1fixed 1.0.0-r1

  Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHea

• CVE-2026-41417MedMay 6, 2026
  affected < 0.33.1-r10fixed 0.33.1-r10

  Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the start-line, but `setUri()` does no

• CVE-2026-34481HigApr 10, 2026
  affected < 1.0.0-r1fixed 1.0.0-r1

  Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohib

• CVE-2026-34480HigApr 10, 2026
  affected < 0.33.1-r9fixed 0.33.1-r9

  Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whene

• CVE-2026-33871HigMar 27, 2026
  affected < 0.33.1-r8fixed 0.33.1-r8

  Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit o

• CVE-2026-33870HigMar 27, 2026
  affected < 0.33.1-r7fixed 0.33.1-r7

  Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final an

• CVE-2026-1002MedJan 15, 2026
  affected < 0.33.1-r8fixed 0.33.1-r8

  The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI. The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Co

• CVE-2025-68161MedDec 18, 2025
  affected < 0.33.1-r2fixed 0.33.1-r2

  The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName co

• CVE-2025-67735MedDec 16, 2025
  affected < 0.33.1-r1fixed 0.33.1-r1

  Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling wh