Skip to content
OpenAdvisories

Package · Wolfi

kafka-4.1

40 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.3
    CVE-2026-106451 Public exploit

    yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

    yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream op…

    yawkat lz4-java druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 8.1
    CVE-2026-54512 Public exploit

    jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymor…

    FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.4
    CVE-2026-2332 Public exploit

    HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

    In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.htm…

    Eclipse Foundation Eclipse Jetty druid trino Debian Ubuntu Wolfi Maven