chainguard/trino-plugin-singlestore

Vulnerabilities (77)

• CVE-2026-54517medJun 23, 2026
  affected < 482-r0fixed 482-r0

  ## Summary In `BeanDeserializer._deserializeUsingPropertyBased`, the active-view (`@JsonView`) filter was applied only to creator properties; the regular property-buffering branch performed no `prop.visibleInView(activeView)` check. A change making `SetterlessProperty.isMerging()

• CVE-2026-54516medJun 23, 2026
  affected < 482-r0fixed 482-r0

  ## Summary `POJOPropertiesCollector._renameProperties()` allows a property with `@JsonProperty("renamed")` on the getter and `@JsonIgnore` on the setter to be renamed rather than dropped. With `MapperFeature.INFER_PROPERTY_MUTATORS` enabled (default), the private backing field is

• CVE-2026-54515medJun 23, 2026
  affected < 482-r0fixed 482-r0

  ## Summary In `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by `_handleByNameInclusion()`, producing a `contextual` deserializer whose `BeanPropertyMap` has the ignored properties removed. The subsequent per-property case-i

• CVE-2026-54514medJun 23, 2026
  affected < 482-r0fixed 482-r0

  ## Summary `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an `InetSocketAdd

• CVE-2026-54513higJun 23, 2026
  affected < 482-r0fixed 482-r0

  ## Summary `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` allowlists any array type based only on `clazz.isArray()`, without validating the array's component (element) type against the configured allowlist. A PTV built with `allowIfSubTypeIsArray()` plus an expli

• CVE-2026-54512higJun 23, 2026
  affected < 482-r0fixed 482-r0

  `jackson-databind`'s `PolymorphicTypeValidator` (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains `<`), `DatabindContext._resolveAndVal

• CVE-2026-54518medJun 23, 2026
  affected < 482-r0fixed 482-r0

  ## Summary `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` replays buffered JSON into creator parameters but never consults `prop.visibleInView(activeView)`. The normal property-based creator path gates creator properties on the active view, but this unwrapped-crea

• CVE-2026-1225LowJan 22, 2026
  affected < 479-r3fixed 479-r3

  ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file. The instanti

• CVE-2025-67735Dec 16, 2025
  affected < 479-r1fixed 479-r1

  Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling wh

• CVE-2025-67721Dec 12, 2025
  affected < 478-r4fixed 478-r4

  Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffe

• CVE-2025-59419MedOct 15, 2025
  affected < 477-r2fixed 477-r2

  Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return (\r) and Line Feed (\n) char

• CVE-2025-59250Oct 14, 2025
  affected < 478-r2fixed 478-r2

  Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.

• CVE-2025-11226MedOct 1, 2025
  affected < 477-r4fixed 477-r4

  ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment varia

• CVE-2025-58457Sep 24, 2025
  affected < 476-r9fixed 476-r9

  Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions. This issue affects Apache ZooKeeper: from 3.9.0 before 3.9.4. Users are recommended to upgrade to version 3.9.4, which fixes the issue.

• CVE-2025-58057Sep 3, 2025
  affected < 476-r7fixed 476-r7

  Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with s

• CVE-2025-58056Sep 3, 2025
  affected < 476-r8fixed 476-r8

  Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a ch

• CVE-2025-5115Aug 20, 2025
  affected < 476-r6fixed 476-r6

  In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing th

• CVE-2025-55163Aug 13, 2025
  affected < 476-r5fixed 476-r5

  Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the

• CVE-2025-47907Aug 7, 2025
  affected < 476-r4fixed 476-r4

  Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the ex

• CVE-2025-48734May 28, 2025
  affected < 475-r6fixed 475-r6

  Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was no