wolfi/zipkin-slim

Vulnerabilities (37)

• CVE-2026-42577HigMay 13, 2026
  affected < 3.6.1-r6fixed 3.6.1-r6

  Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transport fails to detect and close TCP connections that receive a RST after being half-closed, leading to stale channels that are never cleaned up and, in some

• CVE-2026-41417MedMay 6, 2026
  affected < 3.6.1-r6fixed 3.6.1-r6

  Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the start-line, but `setUri()` does no

• CVE-2026-40973HigApr 28, 2026
  affected < 3.6.1-r7fixed 3.6.1-r7

  A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session

• CVE-2026-5598HigApr 15, 2026
  affected < 3.6.1-r12fixed 3.6.1-r12

  Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.

• CVE-2026-0636MedApr 15, 2026
  affected < 3.6.1-r12fixed 3.6.1-r12

  Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper. This issue affects BC-JAVA: from

• CVE-2026-33871Mar 27, 2026
  affected < 3.6.1-r1fixed 3.6.1-r1

  Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit o

• CVE-2026-33870Mar 27, 2026
  affected < 3.6.1-r1fixed 3.6.1-r1

  Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final an

• CVE-2025-68161Dec 18, 2025
  affected < 3.5.1-r10fixed 3.5.1-r10

  The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName co

• CVE-2025-67735Dec 16, 2025
  affected < 3.5.1-r9fixed 3.5.1-r9

  Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling wh

• CVE-2025-66566HigDec 5, 2025
  affected < 3.5.1-r14fixed 3.5.1-r14

  yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the

• CVE-2025-41249HigSep 16, 2025
  affected < 3.5.1-r6fixed 3.5.1-r6

  The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions. Your application m

• CVE-2025-58057Sep 3, 2025
  affected < 3.5.1-r5fixed 3.5.1-r5

  Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with s

• CVE-2025-58056Sep 3, 2025
  affected < 3.5.1-r5fixed 3.5.1-r5

  Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a ch

• CVE-2025-8916MedAug 13, 2025
  affected < 3.5.1-r7fixed 3.5.1-r7

  Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API m

• CVE-2025-48924Jul 11, 2025
  affected < 3.5.1-r8fixed 3.5.1-r8

  Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can throw StackOverflowErr

• CVE-2025-27817Jun 10, 2025
  affected < 3.5.1-r2fixed 3.5.1-r2

  A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwk

• CVE-2025-27533May 7, 2025
  affected < 3.5.1-r1fixed 3.5.1-r1

  Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by dep