153 matches found
Important: Red Hat Security Advisory: Apicurio Registry (container images) release and security update [ 3.3.3 GA ]
An update to the images for Red Hat build of Apicurio Registry is now available from the Red Hat Container Catalog. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of...
CVE-2026-68494 vulnerabilities
Vulnerabilities for packages: strimzi-kafka-operator, keycloak-config-cli, keycloak, spdx-tools-java, akhq, flyway, cass-config-builder, sonarqube, logstash, wildfly, infinispan, apache-nifi-registry, scala, dependency-track, apicurio-registry, spark, tez, gradle, apache-tika, apache-nifi,...
GHSA-642R-3GJ9-2PJ5 vulnerabilities
Vulnerabilities for packages: strimzi-kafka-operator, keycloak-config-cli, keycloak, spdx-tools-java, akhq, flyway, cass-config-builder, sonarqube, logstash, wildfly, infinispan, apache-nifi-registry, scala, dependency-track, apicurio-registry, spark, tez, gradle, apache-tika, apache-nifi,...
CLEANSTART-2026-BE42282 Security fix for CVE-2024-57699 applied in: apicurio-registry 3.1.7-r6
Security vulnerability affects the apicurio-registry package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-AL62330 Security fix for CVE-2025-11966 applied in: apicurio-registry 3.1.7-r6, incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, keycloak 26.4.7-r5, keycloak 26.5.7-r4, kogito-apps 10.1.0-r0
CVE-2025-11966 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-WF23391 Security fix for CVE-2025-11965 applied in: apicurio-registry 3.1.7-r6, incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, keycloak 26.4.7-r5, keycloak 26.5.7-r4, kogito-apps 10.1.0-r0
CVE-2025-11965 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-IW64102 Security fix for GHSA-m494-w24q-6f7w applied in: apicurio-registry 3.1.7-r6
Security vulnerability affects the apicurio-registry package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-100801
Security vulnerability affects the apicurio-registry package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-100150
Security vulnerability affects the apicurio-registry package. This issue is resolved in later releases. See references for vulnerability details...
com.squareup.wire:wire-grpc-client (4.9.1), com.squareup.wire:wire-schema (4.9.1) +8 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.9.1)
com.squareup.wire:wire-runtime MAVEN version 4.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.1 - com.squareup.wire:wire-schema 4.9.1 -...
com.squareup.wire:wire-grpc-client (4.9.11), com.squareup.wire:wire-schema (4.9.11) +4 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.9.11)
com.squareup.wire:wire-runtime MAVEN version 4.9.11 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.11 - com.squareup.wire:wire-schema 4.9.11 -...
com.squareup.wire:wire-grpc-client (4.5.5), com.squareup.wire:wire-schema (4.5.5) +3 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.5.5)
com.squareup.wire:wire-runtime MAVEN version 4.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.5.5 - com.squareup.wire:wire-schema 4.5.5 -...
No title provided
A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission or unauthenticated when the registry runs with default...
No title provided
A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import...
No title provided
A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURESECUREPROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloa...
Important: Red Hat Security Advisory: Apicurio Registry (container images) release and security update [ 3.3.1 GA ]
An update to the images for Red Hat build of Apicurio Registry is now available from the Red Hat Container Catalog. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of...
GHSA-V3JC-474W-2WM6 vulnerabilities
Vulnerabilities for packages: cassandra-reaper, wavefront-proxy, flyway, kserve-modelmesh, nrjmx, thingsboard, sonarqube, opensearch, zipkin, logstash, apicurio-registry, cloudwatch-exporter, druid, akhq...
CVE-2026-54428 vulnerabilities
Vulnerabilities for packages: cassandra-reaper, wavefront-proxy, flyway, kserve-modelmesh, nrjmx, thingsboard, sonarqube, opensearch, zipkin, logstash, apicurio-registry, cloudwatch-exporter, druid, akhq...