Security Bulletin: Maximo AI Service uses client-java-21.0.0.jar which is vulnerable to CVE-2026-15687.

Summary Maximo AI Service uses client-java-21.0.0.jar which is vulnerable to CVE-2026-15687. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-15687 DESCRIPTION: A security issue was discovered in the Kubernetes Java client librar...

com.linecorp.centraldogma:centraldogma-client-java-armeria-xds (>=0.69.0, <=0.85.0) potentially affected by CVE-2026-11751 via com.linecorp.armeria:armeria-xds (>=1.30.0, <=1.40.0)

com.linecorp.armeria:armeria-xds MAVEN version =1.30.0, =0.69.0, =0.85.0 Source cves: CVE-2026-11751 Source advisory: SNYK:JAVA-COMLINECORPARMERIA-18958665...

com.linecorp.centraldogma:centraldogma-client-java-armeria-xds (>=0.69.0, <=0.85.0) potentially affected by CVE-2026-11751 via com.linecorp.armeria:armeria-xds (>=1.30.0, <=1.40.0)

com.linecorp.armeria:armeria-xds MAVEN version =1.30.0, =0.69.0, =0.85.0 Source cves: CVE-2026-11751 Source advisory: MEND:CVE-2026-11751...

com.linecorp.centraldogma:centraldogma-client-java-armeria-xds (>=0.81.0, <=0.83.0) potentially affected by CVE-2026-11752 via com.linecorp.armeria:armeria-xds (>=1.37.0, <=1.39.0)

com.linecorp.armeria:armeria-xds MAVEN version =1.37.0, =0.81.0, =0.83.0 Source cves: CVE-2026-11752 Source advisory: SNYK:JAVA-COMLINECORPARMERIA-17391817...

com.linecorp.centraldogma:centraldogma-client-java-armeria-xds (>=0.69.0, <=0.83.0) potentially affected by CVE-2026-11752 via com.linecorp.armeria:armeria-xds (>=1.30.0, <=1.39.0)

com.linecorp.armeria:armeria-xds MAVEN version =1.30.0, =0.69.0, =0.83.0 Source cves: CVE-2026-11752 Source advisory: MEND:CVE-2026-11752...

com.linecorp.centraldogma:centraldogma-client-java-armeria-xds (>=0.69.0, <=0.83.0) potentially affected by CVE-2026-11752 via com.linecorp.armeria:armeria-xds (>=1.30.0, <=1.39.0)

com.linecorp.armeria:armeria-xds MAVEN version =1.30.0, =0.69.0, =0.83.0 Source cves: CVE-2026-11752 Source advisory: GHSA-HGW6-8C77-V4GQ...

com.linecorp.centraldogma:centraldogma-client-java-armeria-xds (>=0.69.0, <=0.83.0) potentially affected by CVE-2026-11752 via com.linecorp.armeria:armeria-xds (>=1.30.0, <=1.39.0)

com.linecorp.armeria:armeria-xds MAVEN version =1.30.0, =0.69.0, =0.83.0 Source cves: CVE-2026-11752 Source advisory: OSV:GHSA-HGW6-8C77-V4GQ...

net.snowflake:snowflake-jdbc-thin (4.0.0) potentially affected by CVE-2025-14763 via software.amazon.encryption.s3:amazon-s3-encryption-client-java (3.4.0)

software.amazon.encryption.s3:amazon-s3-encryption-client-java MAVEN version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on software.amazon.encryption.s3:amazon-s3-encryption-client-java and may be impacted: - net.snowflake:snowflake-jdbc-thin...

org.apache.nifi:nifi-aws-abstract-processors (>=2.7.0, <=2.7.2), org.apache.nifi:nifi-aws-kinesis-nar (>=2.7.0, <=2.7.2) +4 more potentially affected by CVE-2025-14763 via software.amazon.encryption.s3:amazon-s3-encryption-client-java (3.5.0)

software.amazon.encryption.s3:amazon-s3-encryption-client-java MAVEN version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on software.amazon.encryption.s3:amazon-s3-encryption-client-java and may be impacted: -...

org.apache.hadoop:hadoop-aws (3.4.2) potentially affected by CVE-2025-14763 via software.amazon.encryption.s3:amazon-s3-encryption-client-java (3.1.1)

software.amazon.encryption.s3:amazon-s3-encryption-client-java MAVEN version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on software.amazon.encryption.s3:amazon-s3-encryption-client-java and may be impacted: - org.apache.hadoop:hadoop-aws 3.4.2...

net.snowflake:snowflake-jdbc-thin (4.0.0), org.apache.hadoop:hadoop-aws (3.4.2) +6 more potentially affected by CVE-2025-14763 via software.amazon.encryption.s3:amazon-s3-encryption-client-java (>=3.1.1, <=3.5.0)

software.amazon.encryption.s3:amazon-s3-encryption-client-java MAVEN version =3.1.1, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.2 Source cves: CVE-2025-14763 Source advisory: SNYK:JAVA-SOFTWAREAMAZONENCRYPTIONS3-14465279...

net.snowflake:snowflake-jdbc-thin (4.0.0), org.apache.hadoop:hadoop-aws (3.4.2) +6 more potentially affected by CVE-2025-14763 via software.amazon.encryption.s3:amazon-s3-encryption-client-java (>=3.1.1, <=3.5.0)

software.amazon.encryption.s3:amazon-s3-encryption-client-java MAVEN version =3.1.1, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.2 Source cves: CVE-2025-14763 Source advisory: MEND:CVE-2025-14763...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : mqtt-client vulnerability (USN-6685-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6685-1 advisory. It was discovered that mqtt-client incorrectly handled memory while parsing malformed MQTT frames. An attacker could possibly use this iss...

be.wegenenverkeer:atomium-client-akka_2.10 (0.7.0), be.wegenenverkeer:atomium-client-akka_2.11 (0.7.0) +82 more potentially affected by CVE-2021-37137 via io.netty:netty (3.9.5.final)

io.netty:netty MAVEN version 3.9.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty and may be impacted: - be.wegenenverkeer:atomium-client-akka2.10 0.7.0 - be.wegenenverkeer:atomium-client-akka2.11 0.7.0 -...

Directory Traversal

kubernetes client-java is vulnerable to directory traversal. Lack of validation in the copyDirectoryFromPod allows arbitrary writes to files outside of the current directory through a malicious archive...