CVE-2025-71008

OneFlow v0.9.0 is vulnerable to a segmentation violation within the oneflow._oneflow_internal.autograd.Function.FunctionCtx.mark_non_differentiable component. This flaw, which can be triggered via specially crafted input , allows an attacker to cause a Denial of Service (DoS) by crashing the proc...

city.smartb.cccev:api-commons-jvm (>=0.14.0, <=0.15.0), city.smartb.cccev:cccev-certification-api (>=0.15.0-rc2, <=0.15.0) +397 more potentially affected by CVE-2024-22271 via org.springframework.cloud:spring-cloud-function-context (>=4.0.0, <=4.0.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.0.0, =0.14.0, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0 and more Source cves...

city.smartb.cccev:api-commons-jvm (>=0.14.0, <=0.15.0), city.smartb.cccev:cccev-certification-api (>=0.15.0-rc2, <=0.15.0) +397 more potentially affected by CVE-2024-22271 via org.springframework.cloud:spring-cloud-function-context (>=4.0.0, <=4.0.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.0.0, =0.14.0, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0 and more Source cves...

ch.sbb:spring-cloud-stream-binder-solace (>=4.0.0, <=4.0.1), cn.herodotus.engine:message-kafka-spring-boot-starter (>=3.2.0.0, <=3.3.0.2) +441 more potentially affected by CVE-2024-22271 via org.springframework.cloud:spring-cloud-function-context (>=4.1.0, <=4.1.1)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.1.0, =4.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =2023.0.0.0-rc1, =2023.0.0.0-rc1, =5.8.0, =5.8.0, =5.8.0, =5.13...

ch.sbb:spring-cloud-stream-binder-solace (>=4.0.0, <=4.0.1), cn.herodotus.engine:message-kafka-spring-boot-starter (>=3.2.0.0, <=3.3.0.2) +441 more potentially affected by CVE-2024-22271 via org.springframework.cloud:spring-cloud-function-context (>=4.1.0, <=4.1.1)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.1.0, =4.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =2023.0.0.0-rc1, =2023.0.0.0-rc1, =5.8.0, =5.8.0, =5.8.0, =5.13...

ch.sbb:spring-cloud-stream-binder-solace (>=4.0.0, <=4.0.1), cn.herodotus.engine:message-kafka-spring-boot-starter (>=3.2.0.0, <=3.3.0.2) +441 more potentially affected by CVE-2024-22271 via org.springframework.cloud:spring-cloud-function-context (>=4.1.0, <=4.1.1)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.1.0, =4.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =2023.0.0.0-rc1, =2023.0.0.0-rc1, =5.8.0, =5.8.0, =5.8.0, =5.13...

Denial Of Service (DoS)

spring-cloud-function-context is denial of service. An attacker who directly interacts with framework can send malicious payload to the lookup function, triggering a caching issue in Function Catalog component of the framework and crashing the application...

com.fnproject.fn:fn-spring-cloud-function (>=1.0.70, <=1.0.109), org.springframework.cloud:spring-cloud-function-adapter-aws (1.0.0.release) +7 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (1.0.0.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: - com.fnproject.fn:fn-spring-cloud-function...

ai.hyacinth.framework:core-service-bus-support (>=0.5.2, <=0.5.21), cn.springcloud.gray:spring-cloud-gray-plugin-event-stream (>=c.0.0.1, <=c.0.0.5) +375 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (2.0.2.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 2.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: -...

com.fnproject.fn:fn-spring-cloud-function (>=1.0.110, <=1.0.146), com.github.roneetshaw:fn-spring-cloud-function (>=0.0.22, <=2.0.21) +26 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (2.1.1.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: - com.fnproject.fn:fn-spring-cloud-function...

city.smartb.f2:f2-spring-boot-starter-function (>=0.2.2, <=0.6.0), city.smartb.f2:f2-spring-boot-starter-function-http (>=0.2.2, <=0.6.0) +338 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (>=3.2.0, <=3.2.2)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.0, =0.2.2, =0.2.2, =0.2.2, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.6.0 and more Source cves: CVE-2022-22963 Source advisory: OSV:GHSA-6V73-FGF6-W5J7...

city.smartb.f2:f2-spring-boot-starter-function (>=0.2.2, <=0.6.0), city.smartb.f2:f2-spring-boot-starter-function-http (>=0.2.2, <=0.6.0) +338 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (>=3.2.0, <=3.2.2)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.0, =0.2.2, =0.2.2, =0.2.2, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.6.0 and more Source cves: CVE-2022-22963 Source advisory: GHSA-6V73-FGF6-W5J7...

ai.hyacinth.framework:core-service-bus-support (0.5.24), cc.vihackerframework:vihacker-kafka-starter (>=1.0.4.r, <=1.0.6.r) +504 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (>=3.0.0.release, <=3.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.0.0.release, =1.0.4.r, =1.0.6.r - ch.voulgarakis:spring-cloud-stream-binder-jms 1.0.0.release - city.smartb.f2:f2-spring-boot-starter-function 0.1.0 - city.smartb.f2:f2-spring-boot-starter-function-http 0.1.0 -...

org.springframework.cloud:spring-cloud-function-adapter-aws (1.0.1.release), org.springframework.cloud:spring-cloud-function-adapter-azure (1.0.1.release) +6 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (1.0.1.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: -...

com.solace.spring.cloud:spring-cloud-starter-stream-solace (>=1.2.0, <=1.2.1), com.solace.spring.cloud:spring-cloud-stream-binder-solace (>=1.2.0, <=1.2.1) +43 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (2.1.0.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 2.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: -...

ai.hyacinth.framework:core-service-bus-support (0.5.24), cc.vihackerframework:vihacker-kafka-starter (>=1.0.4.r, <=1.0.6.r) +504 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (>=3.0.0.release, <=3.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.0.0.release, =1.0.4.r, =1.0.6.r - ch.voulgarakis:spring-cloud-stream-binder-jms 1.0.0.release - city.smartb.f2:f2-spring-boot-starter-function 0.1.0 - city.smartb.f2:f2-spring-boot-starter-function-http 0.1.0 -...

org.springframework.cloud:spring-cloud-function-adapter-aws (1.0.2.release), org.springframework.cloud:spring-cloud-function-adapter-azure (1.0.2.release) +6 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (1.0.2.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: -...

com.alipay.sofa:sofa-boot-autoconfigure (>=3.16.2, <=3.25.0), com.alipay.sofa:tracer-sofa-boot-starter (>=3.1.0, <=3.1.2) +378 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (2.0.0.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 2.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: - com.alipay.sofa:sofa-boot-autoconfigure...

ai.hyacinth.framework:core-service-bus-support (0.5.0), com.alibaba.cloud:spring-cloud-starter-bus-rocketmq (>=2.1.0.release, <=2.1.4.release) +138 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (2.0.1.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 2.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: -...

city.smartb.f2:f2-spring-boot-starter-function (>=0.2.2, <=0.6.0), city.smartb.f2:f2-spring-boot-starter-function-http (>=0.2.2, <=0.6.0) +338 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (>=3.2.0, <=3.2.2)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.0, =0.2.2, =0.2.2, =0.2.2, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.6.0 and more Source cves: CVE-2022-22963 Source advisory: MEND:CVE-2022-22963...