VYPR

apk package

wolfi/confluent-kafka

pkg:apk/wolfi/confluent-kafka

Vulnerabilities (28)

  • CVE-2026-59949MedAug 18, 2026
    affected < 8.4.0.406-r0fixed 8.4.0.406-r0

    yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFact

  • CVE-2026-10050CriAug 4, 2026
    affected < 8.4.0.397-r0fixed 8.4.0.397-r0

    In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If t

  • CVE-2026-56741HigJul 17, 2026
    affected < 8.4.0.269-r1fixed 8.4.0.269-r1

    JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 read

  • CVE-2026-56740HigJul 17, 2026
    affected < 8.4.0.269-r1fixed 8.4.0.269-r1

    JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in Telne

  • CVE-2026-59889MedJul 14, 2026
    affected < 8.4.0.406-r0fixed 8.4.0.406-r0

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and call

  • CVE-2026-8384MedJul 14, 2026
    affected < 8.4.0.397-r0fixed 8.4.0.397-r0

    In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.t

  • CVE-2026-6790MedJul 14, 2026
    affected < 8.4.0.397-r0fixed 8.4.0.397-r0

    In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest R

  • CVE-2026-10051HigJul 14, 2026
    affected < 8.4.0.397-r0fixed 8.4.0.397-r0

    In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trai

  • CVE-2026-54518MedJun 23, 2026
    affected < 8.4.0.253-r2fixed 8.4.0.253-r2

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults pr

  • CVE-2026-54517MedJun 23, 2026
    affected < 8.4.0.253-r2fixed 8.4.0.253-r2

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; t

  • CVE-2026-54516MedJun 23, 2026
    affected < 8.4.0.253-r2fixed 8.4.0.253-r2

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the

  • CVE-2026-54515MedJun 23, 2026
    affected < 8.4.0.406-r0fixed 8.4.0.406-r0

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameIn

  • CVE-2026-54514MedJun 23, 2026
    affected < 8.4.0.253-r2fixed 8.4.0.253-r2

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS

  • CVE-2026-54513HigJun 23, 2026
    affected < 8.4.0.253-r2fixed 8.4.0.253-r2

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(),

  • CVE-2026-54512HigJun 23, 2026
    affected < 8.4.0.253-r2fixed 8.4.0.253-r2

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization.

  • CVE-2025-67030HigMar 25, 2026
    affected < 8.4.0.11-r0fixed 8.4.0.11-r0

    Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

  • CVE-2026-1605HigMar 5, 2026
    affected < 8.3.0.375-r0fixed 8.3.0.375-r0

    In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Inflater is allocated

  • CVE-2025-11143LowMar 5, 2026
    affected < 8.3.0.375-r0fixed 8.3.0.375-r0

    The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the UR

  • CVE-2025-68161MedDec 18, 2025
    affected < 8.3.0.99-r0fixed 8.3.0.99-r0

    The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName co

  • CVE-2025-48924MedJul 11, 2025
    affected < 8.2.0.25-r0fixed 8.2.0.25-r0

    Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can throw StackOverflowErr

Page 1 of 2