Open Source Vulnerabilities

spark-sc213-jdk17-py312

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

sonarqube

Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure

spark-sc213-jdk17-py312

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

sonarqube

Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker

spark-sc213-jdk17-py312

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197)

spark-sc213-jdk17-py312

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

sonarqube

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33)

sonarqube

Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature

spark-sc213-jdk17-py312

jackson-databind's deserializer for java

sonarqube

Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153)

sonarqube

Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)

spark-sc213-jdk17-py312

non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)

sonarqube

flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier

sonarqube

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230)

sonarqube

flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input

sonarqube

flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input

sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)

sonarqube

flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www

sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

sonarqube

native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, with...

sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

sonarqube

Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122)

sonarqube

Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586)

sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

sonarqube

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)

sonarqube, spark-sc213-jdk17-py312

JLine is a Java library for handling console input

sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)

trino, sonarqube, spark-sc213-jdk17-py312

Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

trino, sonarqube, spark-sc213-jdk17-py312

TypeDeserializerBase

sonarqube, spark-sc213-jdk17-py312

UTF8DataInputJsonParser

sonarqube, spark-sc213-jdk17-py312

NumberInput

sonarqube

yawkat LZ4 Java provides LZ4 compression for Java

sonarqube

yawkat LZ4 Java provides LZ4 compression for Java

sonarqube

yawkat LZ4 Java provides LZ4 compression for Java

sonarqube

yawkat LZ4 Java provides LZ4 compression for Java

sonarqube, sonarqube

Security fix for CVE-2026-93879 applied in: sonarqube 26.7.0.124771-r11, sonarqube 26.8.0.126808-r6

sonarqube

yawkat LZ4 Java provides LZ4 compression for Java

sonarqube

In Eclipse Parsson published Maven Central artifacts before version 1

sonarqube, sonarqube

Path-traversal vulnerability in QOS

sonarqube, sonarqube

OGNL is an Object Graph Navigation Library for Java

sonarqube, sonarqube

pgjdbc, the PostgreSQL JDBC Driver, versions 42

sonarqube

json-smart through 2

sonarqube, sonarqube

pgjdbc, the PostgreSQL JDBC Driver, versions 42

sonarqube, sonarqube

Authentication bypass in sshd-core in Apache MINA SSHD versions 2

sonarqube, sonarqube

Apache MINA SSHD is a Java library for client-side and server-side SSH

wso2mi, wso2mi, wso2mi

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat