Skip to content
OpenAdvisories

Package · Wolfi

tez

123 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2026-85721 Public exploit

    AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service

    The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentD…

    AsyncHttpClient async-http-client druid tez Debian Ubuntu Wolfi Maven
  • High 8.1
    CVE-2026-54512 Public exploit

    jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymor…

    FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 8.7
    CVE-2026-45674 Public exploit

    Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.4
    CVE-2026-2332 Public exploit

    HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

    In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.htm…

    Eclipse Foundation Eclipse Jetty druid trino Debian Ubuntu Wolfi Maven
  • High 8.2
    CVE-2025-55163 Public exploit

    Netty MadeYouReset HTTP/2 DDoS Vulnerability

    Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames …

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 8.7
    CVE-2025-52999 Public exploit

    jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data

    jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a Stackov…

    FasterXML jackson-core druid tez Debian Ubuntu Wolfi Maven
  • High 8.8
    CVE-2025-48734 Public exploit

    Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

    Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this…

    Apache Software Foundation Apache Commons BeanUtils 2.x Apache Commons BeanUtils 1.x druid Debian Ubuntu Azure Linux Wolfi Maven