kafka_exporter-strimzi-compat

8 results · Clear filters · Feed

• Medium 6.3
  CVE-2025-68161

  Apache Log4j Core: Missing TLS hostname verification in Socket appender

  The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-att…

  Apache Software Foundation Apache Log4j Core airflow-3 celeborn-0.6 Debian Ubuntu Wolfi Maven
  Dec 18, 2025
• Medium 6.3
  CVE-2025-11965

  Vert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden Directories

  In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails to restrict access to hidden directories, allowing unauthorized users to retrieve files within them (e.g. '.git/config').

  Eclipse Foundation Vert.x keycloak-26.4-iamguarded-compat strimzi-kafka-operator-kafka-thirdparty-libs-cc Wolfi Maven
  Oct 22, 2025
• Medium 4.3
  CVE-2025-58457

  Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands

  Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions. This issue affects Apache ZooKeeper: from 3.9.0 before 3.9.4. Users are recommended to upgrade to version 3.9.4, whic…

  Apache Software Foundation Apache ZooKeeper thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Sep 24, 2025
• Medium 6.9
  CVE-2025-58057

  Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack

  Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below,…

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Sep 3, 2025
• Medium 5.3
  CVE-2024-56128

  Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption

  Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism (SCRAM) did not fully adhere to the requirements of RFC 5802 [1…

  Apache Software Foundation Apache Kafka strimzi-kafka-operator-kafka-thirdparty-libs-cc strimzi-kafka-operator-kafka-agent Wolfi Maven
  Dec 18, 2024
• Medium 6.5
  CVE-2024-31141

  Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider

  Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these…

  Apache Software Foundation Apache Kafka Clients druid thingsboard-tb-node Wolfi Maven
  Nov 19, 2024
• Medium 5.9
  CVE-2024-8184

  Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks

  There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and e…

  Eclipse Foundation Jetty druid tez Debian Ubuntu Wolfi Maven
  Oct 14, 2024
• Medium 4.3
  CVE-2024-47554

  Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

  Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before …

  Apache Software Foundation Apache Commons IO druid kserve-storage-controller Debian Ubuntu Azure Linux Wolfi Maven
  Oct 3, 2024