Skip to content
OpenAdvisories

Package · Wolfi

spark-4.0

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Medium 6.3
    CVE-2025-68161

    Apache Log4j Core: Missing TLS hostname verification in Socket appender

    The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-att…

    Apache Software Foundation Apache Log4j Core airflow-3 celeborn-0.6 Debian Ubuntu Wolfi Maven
  • Critical 9.4
    CVE-2025-12383

    Race Condition allows Bypass of Trust Restrictions

    In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under norma…

    Eclipse Foundation Jersey celeborn-0.6 neo4j-2025.10 Wolfi Maven
  • Medium 4.3
    CVE-2025-58457

    Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands

    Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions. This issue affects Apache ZooKeeper: from 3.9.0 before 3.9.4. Users are recommended to upgrade to version 3.9.4, whic…

    Apache Software Foundation Apache ZooKeeper thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • Medium 6.9
    CVE-2025-58057

    Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack

    Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below,…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 8.2
    CVE-2025-55163 Public exploit

    Netty MadeYouReset HTTP/2 DDoS Vulnerability

    Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames …

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven