chainguard/wso2is

Vulnerabilities (24)

• CVE-2026-5598HigApr 15, 2026
  affected < 7.3.0-r0fixed 7.3.0-r0

  Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.80.1, from 1.82 before 1.

• CVE-2026-5588MedApr 15, 2026
  affected < 7.3.0-r0fixed 7.3.0-r0

  Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modul

• CVE-2026-0636MedApr 15, 2026
  affected < 7.3.0-r0fixed 7.3.0-r0

  Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper. This issue affects BC-JAVA: from

• CVE-2026-2332HigApr 14, 2026
  affected < 7.3.0-r0fixed 7.3.0-r0

  In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty term

• CVE-2026-34481HigApr 10, 2026
  affected < 7.3.0-r0fixed 7.3.0-r0

  Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohib

• CVE-2026-34480HigApr 10, 2026
  affected < 7.3.0-r0fixed 7.3.0-r0

  Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whene

• CVE-2026-34477MedApr 10, 2026
  affected < 7.3.0-r0fixed 7.3.0-r0

  The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName

• CVE-2025-67030HigMar 25, 2026
  affected < 7.3.0-r0fixed 7.3.0-r0

  Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

• CVE-2026-24308Mar 7, 2026
  affected < 7.3.0-r0fixed 7.3.0-r0

  Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering p

• CVE-2026-24281Mar 7, 2026
  affected < 7.3.0-r0fixed 7.3.0-r0

  Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note

• CVE-2025-11143Mar 5, 2026
  affected < 7.3.0-r0fixed 7.3.0-r0

  The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the UR

• CVE-2026-25526Feb 4, 2026
  affected < 7.3.0-r0fixed 7.3.0-r0

  JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file acce

• CVE-2025-68161Dec 18, 2025
  affected < 7.3.0-r0fixed 7.3.0-r0

  The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName co

• CVE-2025-12383Nov 18, 2025
  affected < 7.2.0-r0fixed 7.2.0-r0

  In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but

• CVE-2025-1396Sep 26, 2025
  affected < 7.2.0-r0fixed 7.2.0-r0

  A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration, the system returns a distinct "User does not exist" error message to the login form, regardless of the validate_username setting. This behavior allo

• CVE-2025-58457Sep 24, 2025
  affected < 7.2.0-r0fixed 7.2.0-r0

  Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions. This issue affects Apache ZooKeeper: from 3.9.0 before 3.9.4. Users are recommended to upgrade to version 3.9.4, which fixes the issue.

• CVE-2025-59340Sep 17, 2025
  affected < 7.2.0-r0fixed 7.2.0-r0

  jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory().constructFromCanonical(), it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input

• CVE-2025-48795Jul 15, 2025
  affected < 7.3.0-r0fixed 7.3.0-r0

  Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was introduced which means that the entire temporary file is read into memory and then logged. An attacker might be able to exploit this to cause a denial of service attack by causing

• CVE-2025-49128MedJun 6, 2025
  affected < 7.1.0-r2fixed 7.1.0-r2

  Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and prior to version 2.13.0, a flaw in jackson-core's `JsonLocation._appendSourceDesc` method allows up to 500 bytes of unint

• CVE-2025-48734May 28, 2025
  affected < 7.2.0-r0fixed 7.2.0-r0

  Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was no