chainguard/strimzi-kafka-operator-user-operator

Vulnerabilities (71)

• CVE-2026-59949MedAug 18, 2026
  affected < 1.1.0-r4fixed 1.1.0-r4

  yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFact

• CVE-2026-73508MedAug 13, 2026
  affected < 1.1.0-r4fixed 1.1.0-r4

  Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDo

• CVE-2026-59898HigJul 29, 2026
  affected < 1.1.0-r4fixed 1.1.0-r4

  Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade

• CVE-2026-59901HigJul 29, 2026
  affected < 1.1.0-r4fixed 1.1.0-r4

  Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently c

• CVE-2026-59900MedJul 29, 2026
  affected < 1.1.0-r4fixed 1.1.0-r4

  Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` heade

• CVE-2026-59899HigJul 29, 2026
  affected < 1.1.0-r4fixed 1.1.0-r4

  Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque` named `acceptEncoding

• CVE-2026-59921MedJul 28, 2026
  affected < 1.1.0-r4fixed 1.1.0-r4

  Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME

• CVE-2026-56816HigJul 21, 2026
  affected < 1.1.0-r3fixed 1.1.0-r3

  Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFrame` trusts `payLoadLe

• CVE-2026-56746MedJul 21, 2026
  affected < 1.1.0-r4fixed 1.1.0-r4

  Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortC

• CVE-2026-56745HigJul 21, 2026
  affected < 1.1.0-r4fixed 1.1.0-r4

  Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a

• CVE-2026-55833HigJul 21, 2026
  affected < 1.1.0-r4fixed 1.1.0-r4

  Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the

• CVE-2026-55831HigJul 21, 2026
  affected < 1.1.0-r4fixed 1.1.0-r4

  Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting

• CVE-2026-59889MedJul 14, 2026
  affected < 1.1.0-r4fixed 1.1.0-r4

  jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and call

• CVE-2026-8384MedJul 14, 2026
  affected < 1.1.0-r4fixed 1.1.0-r4

  In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.t

• CVE-2026-6790MedJul 14, 2026
  affected < 1.1.0-r4fixed 1.1.0-r4

  In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest R

• CVE-2026-10051HigJul 14, 2026
  affected < 1.1.0-r4fixed 1.1.0-r4

  In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trai

• CVE-2026-49844MedJul 10, 2026
  affected < 1.1.0-r7fixed 1.1.0-r7

  Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover

• CVE-2026-54518MedJun 23, 2026
  affected < 1.0.1-r2fixed 1.0.1-r2

  jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults pr

• CVE-2026-54517MedJun 23, 2026
  affected < 1.0.1-r2fixed 1.0.1-r2

  jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; t

• CVE-2026-54516MedJun 23, 2026
  affected < 1.0.1-r2fixed 1.0.1-r2

  jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the