Apache Flink 代码注入漏洞

Apache Flink is an open-source distributed stream processing engine developed by the Apache Foundation in the United States. The product is primarily written in Java and Scala languages. Versions of Apache Flink from 1.15.0 to 1.20.x, as well as from 2.0.0 to 2.x, contain a code injection...

Security Bulletin: IBM Operator for Apache Flink is affected by a vulnerability in AssertJ library (CVE-2026-24400)

Summary This security vulnerability in the AssertJ library used within IBM Event Processing could allow an attacker to exploit specially crafted XML input to cause local file disclosure, server-side request forgery SSRF, or denial of service in Java-based components running on the Apache Flink...

ai.chronon:flink_2.12 (>=0.0.62 <=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91), ai.chronon:online_2.11 (>=0.0.25 <=revert-391-thread-0.0.24) +6989 more potentially affected by CVE-2026-33558 via org.apache.kafka:kafka-clients (>=0.11.0.0 <=3.9.1)

org.apache.kafka:kafka-clients MAVEN version =0.11.0.0, =0.0.62, =0.0.25, =0.0.25, =0.0.25, =0.0.86, =0.0.86, =0.0.1, =0.0.1, =thread-pool-0.0.24-dev, =0.0.6, =1.0.6, =1.0.6, =0.0.2, =0.3.0 and more Source cves: CVE-2026-33558 Source advisory: SNYK:JAVA-ORGAPACHEKAFKA-16300072...

GHSA-H383-GMXW-35V2 vulnerabilities

Vulnerabilities for packages: druid, celeborn, spark, kafka, solr, kserve-modelmesh, sonarqube, logstash, akhq, flink...

CVE-2026-34479 vulnerabilities

Vulnerabilities for packages: druid, celeborn, spark, kafka, solr, kserve-modelmesh, sonarqube, logstash, akhq, flink...

CVE-2026-34479 vulnerabilities

Vulnerabilities for packages: akhq, pinot-fips, sonarqube, opensearch, kafka-fips, logstash, commercial-elasticsearch, solr, elasticsearch, elasticsearch-fips, flink, spark, celeborn, druid, kafka, nuxeo, pinot, geoserver, logstash-fips, spark-fips, kserve-modelmesh...

GHSA-H383-GMXW-35V2 vulnerabilities

Vulnerabilities for packages: akhq, pinot-fips, sonarqube, opensearch, kafka-fips, logstash, commercial-elasticsearch, solr, elasticsearch, elasticsearch-fips, flink, spark, celeborn, druid, kafka, nuxeo, pinot, geoserver, logstash-fips, spark-fips, kserve-modelmesh...

CVE-2026-34481 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, spark, neo4j, solr, apache-pulsar, flink...

CVE-2026-34481 vulnerabilities

Vulnerabilities for packages: apache-pulsar, strimzi-kafka-operator, spark, spark-kubernetes-operator-fips, kafka-bridge-fips, apache-pulsar-fips, wso2is, apache-camel-karavan-devmode, camunda-zeebe, neo4j, camunda, spark-fips, spark-kubernetes-operator, solr, kafka-bridge, flink...

GHSA-W35J-PV5H-Q9Q9 vulnerabilities

Vulnerabilities for packages: apache-pulsar, strimzi-kafka-operator, spark, spark-kubernetes-operator-fips, kafka-bridge-fips, apache-pulsar-fips, wso2is, apache-camel-karavan-devmode, camunda-zeebe, neo4j, camunda, spark-fips, spark-kubernetes-operator, solr, kafka-bridge, flink...

GHSA-3PXV-7CMR-FJR4 vulnerabilities

Vulnerabilities for packages: apache-pulsar, akhq, opensearch-fips, spark-kubernetes-operator-fips, pinot-fips, sonarqube, spark-kubernetes-operator, ghidra, opensearch, kafka-fips, kafka-bridge, commercial-elasticsearch, logstash, wso2is, apache-tika-fips, apache-tika, camunda-zeebe,...

CVE-2026-34480 vulnerabilities

Vulnerabilities for packages: apache-pulsar, akhq, opensearch-fips, spark-kubernetes-operator-fips, pinot-fips, sonarqube, spark-kubernetes-operator, ghidra, opensearch, kafka-fips, kafka-bridge, commercial-elasticsearch, logstash, wso2is, apache-tika-fips, apache-tika, camunda-zeebe,...

CVE-2026-34480 vulnerabilities

Vulnerabilities for packages: celeborn, spark, neo4j, opensearch, solr, logstash, apache-tika, druid, strimzi-kafka-operator, kafka, kserve-modelmesh, airflow, apache-pulsar, flink, apache-activemq-artemis, zipkin, sonarqube, wavefront-proxy, infinispan, akhq...

GHSA-3PXV-7CMR-FJR4 vulnerabilities

Vulnerabilities for packages: celeborn, spark, neo4j, opensearch, solr, logstash, apache-tika, druid, strimzi-kafka-operator, kafka, kserve-modelmesh, airflow, apache-pulsar, flink, apache-activemq-artemis, zipkin, sonarqube, wavefront-proxy, infinispan, akhq...

CLEANSTART-2026-ZR74513 Security fixes for CVE-2025-68161 applied in versions: 2.2.0-r0

Security vulnerability affects the flink package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-3052

A vulnerability was found in DataLinkDC dinky up to 1.2.5. The impacted element is the function proxyUba of the file dinky-admin/src/main/java/org/dinky/controller/FlinkProxyController.java of the component Flink Proxy Controller. Performing a manipulation results in server-side request forgery. ...

CVE-2026-3052

A vulnerability was found in DataLinkDC dinky up to 1.2.5. The impacted element is the function proxyUba of the file dinky-admin/src/main/java/org/dinky/controller/FlinkProxyController.java of the component Flink Proxy Controller. Performing a manipulation results in server-side request forgery. ...

CVE-2026-3052 DataLinkDC dinky Flink Proxy Controller FlinkProxyController.java proxyUba server-side request forgery

A vulnerability was found in DataLinkDC dinky up to 1.2.5. The impacted element is the function proxyUba of the file dinky-admin/src/main/java/org/dinky/controller/FlinkProxyController.java of the component Flink Proxy Controller. Performing a manipulation results in server-side request forgery. ...

CVE-2026-3052

DataLinkDC dinky up to 1.2.5 is affected. The vulnerable component is the Flink Proxy Controller (dinky-admin/src/main/java/org/dinky/controller/FlinkProxyController.java) and its proxyUba function. The issue enables server-side request forgery (SSRF) and is exploitable remotely. The exploit has ...

CVE-2026-3052 DataLinkDC dinky Flink Proxy Controller FlinkProxyController.java proxyUba server-side request forgery

A vulnerability was found in DataLinkDC dinky up to 1.2.5. The impacted element is the function proxyUba of the file dinky-admin/src/main/java/org/dinky/controller/FlinkProxyController.java of the component Flink Proxy Controller. Performing a manipulation results in server-side request forgery. ...