Skip to content
OpenAdvisories

Package · Wolfi

opensearch-3-repository-gcs

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • High 8.2
    CVE-2026-102554

    Denial of Service via Eager Array Allocation During Deserialization in Guava

    Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashS…

    Google Guava druid thingsboard-tb-node Debian Ubuntu Azure Linux Wolfi Maven
  • High 7.5
    CVE-2026-89425

    jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

    UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser impleme…

    FasterXML jackson-core druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-89407

    jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS

    NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PAT…

    FasterXML jackson-core druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 5.9
    CVE-2025-12194

    Bouncy Castle Vulnerable to Uncontrolled Resource Consumption

    Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-lts8on on All (API modules) allows Excessive Alloc…

    Legion of the Bouncy Castle Bouncy Castle for Java LTS Bouncy Castle for Java FIPS bouncycastle Debian Wolfi Maven
  • Medium 6.1
    CVE-2025-22227

    CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client

    In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.

    VMware Reactor Netty druid thingsboard-tb-node Wolfi Maven
  • High 7.5
    CVE-2025-27817 Public exploit Scanner template EPSS 70%

    Apache Kafka Client: Arbitrary file read and SSRF vulnerability

    A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and …

    Apache Software Foundation Apache Kafka Client druid thingsboard-tb-node Wolfi Maven