chainguard/spark-kubernetes-operator

Vulnerabilities (58)

• CVE-2026-59949MedAug 18, 2026
  affected < 0.9.0-r7fixed 0.9.0-r7

  yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFact

• CVE-2026-73508MedAug 13, 2026
  affected < 0.9.0-r6fixed 0.9.0-r6

  Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDo

• CVE-2026-18401MedAug 4, 2026
  affected < 0.9.0-r3fixed 0.9.0-r3

  The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters). An attacker able to submit JSON to an application that uses the async parser API can supply a number token of a

• CVE-2026-10050CriAug 4, 2026
  affected < 1.0.0-r0fixed 1.0.0-r0

  In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If t

• CVE-2026-59898HigJul 29, 2026
  affected < 0.9.0-r6fixed 0.9.0-r6

  Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade

• CVE-2026-59901HigJul 29, 2026
  affected < 0.9.0-r6fixed 0.9.0-r6

  Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently c

• CVE-2026-59900MedJul 29, 2026
  affected < 0.9.0-r6fixed 0.9.0-r6

  Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` heade

• CVE-2026-59899HigJul 29, 2026
  affected < 0.9.0-r6fixed 0.9.0-r6

  Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque` named `acceptEncoding

• CVE-2026-59921MedJul 28, 2026
  affected < 0.9.0-r6fixed 0.9.0-r6

  Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME

• CVE-2026-56746MedJul 21, 2026
  affected < 0.9.0-r6fixed 0.9.0-r6

  Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortC

• CVE-2026-56745HigJul 21, 2026
  affected < 0.9.0-r6fixed 0.9.0-r6

  Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a

• CVE-2026-55833HigJul 21, 2026
  affected < 0.9.0-r6fixed 0.9.0-r6

  Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the

• CVE-2026-55831HigJul 21, 2026
  affected < 0.9.0-r6fixed 0.9.0-r6

  Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting

• CVE-2026-56741HigJul 17, 2026
  affected < 0.9.0-r2fixed 0.9.0-r2

  JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 read

• CVE-2026-56740HigJul 17, 2026
  affected < 0.9.0-r2fixed 0.9.0-r2

  JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in Telne

• CVE-2026-8384MedJul 14, 2026
  affected < 1.0.0-r0fixed 1.0.0-r0

  In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.t

• CVE-2026-6790MedJul 14, 2026
  affected < 1.0.0-r0fixed 1.0.0-r0

  In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest R

• CVE-2026-10051HigJul 14, 2026
  affected < 1.0.0-r0fixed 1.0.0-r0

  In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trai

• CVE-2026-54518MedJun 23, 2026
  affected < 0.9.0-r4fixed 0.9.0-r4

  jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults pr

• CVE-2026-54517MedJun 23, 2026
  affected < 0.9.0-r4fixed 0.9.0-r4

  jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; t