CGA-JQ28-C2HV-6QXC: akhq
CVSS: UnknownUnknown
Published Date unknownLast modified Date unknown
Status not reported
The data service did not report a status for this record. Only the available sections are shown.Vulnerability summary
CGA-JQ28-C2HV-6QXC is a vulnerability in akhq with no CVSS score yet.
CVSS score
Not scored
010
No CVSS score recordedEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
No timeline events recorded.
Description
No description has been published for this record.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Chainguard136 products
- airbyte-platform-fips-server< 2.0.0-r5
- airbyte-platform-server< 2.0.0-r6
- airbyte-server< 2.0.0-r12
- airbyte-server-fips< 2.0.0-r15
- akhq< 0.28.0-r6
- apache-activemq-6.2< 6.2.9-r1
- apache-activemq-artemis< 2.55.0-r3
- apache-activemq-artemis-fips< 2.55.0-r1
- apache-activemq-fips-5.19< 5.19.10-r1
- apache-activemq-fips-6.2< 6.2.9-r1
- apache-camel-karavan-devmode< 4.18.1-r9
- apache-hop< 2.18.1-r17
- apache-hop-fips< 2.18.1-r11
- apache-jena-fuseki< 6.2.0-r3
- apache-pulsar-4.0< 4.0.13-r1
- apache-pulsar-4.2< 4.2.4-r1
- apache-pulsar-fips-4.0< 4.0.13-r1
- apache-pulsar-fips-4.2< 4.2.4-r1
- apache-tika-2.9< 2.9.4-r19
- apache-tika-3.0< 3.0.0-r30
- apache-tika-3.1< 3.1.0-r37
- apache-tika-3.2< 3.2.3-r17
- apache-tika-fips-2.9< 2.9.4-r11
- apache-tika-fips-3.0< 3.0.0-r12
- apache-tika-fips-3.1< 3.1.0-r14
- apache-tika-fips-3.2< 3.2.3-r12
- apache-tika-fips-3.3< 3.3.2-r3
- celeborn-0.5< 0.5.4-r33
- celeborn-0.6< 0.6.3-r14
- conductor< 3.32.1-r4
- conductor-fips< 3.32.1-r3
- cruise-control-fips-jars< 2.5.146-r3
- cruise-control-jars< 2.5.146-r2
- druid< 37.0.0-r52
- elasticsearch-8.19-iamguarded< 8.19.20-r2
- elasticsearch-9.2-iamguarded< 9.2.8-r13
- elasticsearch-9.3-iamguarded< 9.3.8-r6
- elasticsearch-9.4-iamguarded< 9.4.5-r3
- flink-1.20< 1.20.5-r3
- flink-2.1< 2.1.3-r3
- flink-2.2< 2.2.1-r4
- flink-kubernetes-operator< 1.15.0-r1
- flink-kubernetes-operator-fips< 1.15.0-r1
- geoserver-2.27< 2.27.6-r1
- geoserver-2.27-community< 2.27.6-r1
- geoserver-2.28< 2.28.5-r1
- geoserver-2.28-community< 2.28.5-r1
- geoserver-3.0< 3.0.1-r3
- ghidra< 12.1.3-r0
- hadoop-fips-3.5< 3.5.0-r3
- hono-adapter-mqtt< 2.7.0-r36
- hono-service-auth< 2.7.0-r36
- hono-service-command-router< 2.7.0-r36
- hono-service-device-registry-jdbc< 2.7.0-r36
- infinispan-15.0< 15.0.22-r16
- infinispan-15.1< 15.1.7-r27
- infinispan-15.2< 15.2.6-r25
- infinispan-16.0< 16.0.14-r3
- infinispan-16.1< 16.1.4-r10
- infinispan-16.2< 16.2.2-r2
- kafbat-ui< 1.5.0-r13
- kafbat-ui-fips< 1.5.0-r7
- kafka-4.0< 4.0.2-r11
- kafka-4.1< 4.1.2-r8
- kafka-4.3-openjdk-17< 4.3.1-r8
- kafka-4.3-openjdk-21< 4.3.1-r8
- kafka-4.3-openjdk-25< 4.3.1-r8
- kafka-bridge< 1.1.0-r1
- kafka-bridge-fips< 1.1.0-r1
- kafka-fips-4.1< 4.1.2-r10
- kafka-fips-4.3< 4.3.1-r7
- kayenta-2025.2< 2025.2.4-r7
- kayenta-2025.4< 2025.4.6-r12
- kayenta-2026.0< 2026.0.7-r2
- kayenta-2026.1< 2026.1.2-r3
- kayenta-fips-2025.2< 2025.2.4-r7
- kayenta-fips-2025.4< 2025.4.6-r6
- kayenta-fips-2026.0< 2026.0.5-r1
- kayenta-fips-2026.1< 2026.1.2-r3
- keycloak-config-cli< 6.5.1-r13
- keycloak-config-cli-iamguarded-compat< 6.5.1-r13
- kserve-modelmesh< 0.12.0-r39
- nacos< 3.2.3-r7
- nacos-docker< 3.2.3-r5
- neo4j-2026.06< 2026.06.0-r8
- neo4j-2026.07< 2026.07.1-r1
- neo4j-5.26< 5.26.29-r1
- nuxeo-2023< 2023.45-r11
- opensearch-2< 2.19.6-r8
- opensearch-2-performance-analyzer< 2.19.6-r9
- opensearch-3< 3.8.0-r0
- opensearch-fips-3< 3.8.0-r1
- pinot< 1.5.1-r15
- pinot-fips< 1.5.1-r11
- ranger< 2.9.0-r5
- solr-10< 10.0.0-r10
- solr-10-iamguarded-compat< 10.0.0-r10
- solr-9< 9.10.1-r12
- solr-9-iamguarded-compat< 9.10.1-r12
- solr-fips-10< 10.0.0-r4
- solr-fips-10-iamguarded-compat< 10.0.0-r4
- spark-3.5-scala-2.12< 3.5.9-r3
- spark-3.5-scala-2.13< 3.5.9-r3
- spark-4.0-scala-2.13< 4.0.4-r2
- spark-4.1-scala-2.13< 4.1.3-r3
- spark-4.2-scala-2.13< 4.2.0-r5
- spark-fips-3.5-scala-2.12< 3.5.8-r8
- spark-fips-3.5-scala-2.13< 3.5.8-r8
- spark-fips-4.1-scala-2.13< 4.1.2-r8
- spark-fips-4.2-scala-2.13< 4.2.0-r4
- spdx-tools-java< 2.0.7-r5
- strimzi-kafka-operator-cluster-operator< 1.1.0-r7
- strimzi-kafka-operator-fips-cluster-operator< 1.1.0-r7
- strimzi-kafka-operator-fips-kafka-agent< 1.1.0-r7
- strimzi-kafka-operator-fips-kafka-init< 1.1.0-r7
- strimzi-kafka-operator-fips-kafka-thirdparty-libs-cc< 1.1.0-r5
- strimzi-kafka-operator-fips-topic-operator< 1.1.0-r7
- strimzi-kafka-operator-fips-tracing-agent< 1.1.0-r7
- strimzi-kafka-operator-fips-user-operator< 1.1.0-r7
- strimzi-kafka-operator-kafka-agent< 1.1.0-r7
- strimzi-kafka-operator-kafka-init< 1.1.0-r7
- strimzi-kafka-operator-kafka-thirdparty-libs-cc< 1.1.0-r7
- strimzi-kafka-operator-topic-operator< 1.1.0-r7
- strimzi-kafka-operator-tracing-agent< 1.1.0-r7
- strimzi-kafka-operator-user-operator< 1.1.0-r7
- thingsboard-tb-mqtt-transport< 4.3.1.3-r20
- thingsboard-tb-node< 4.3.1.3-r20
- traccar< 6.14.5-r8
- traccar-fips< 6.14.5-r8
- wavefront-proxy< 13.9-r26
- wazuh-indexer< 4.14.7-r2
- wazuh-indexer-plugin-performance-analyzer< 4.14.7-r2
- wildfly-openjdk-17< 41.0.0-r3
- wildfly-openjdk-21< 41.0.0-r3
- zaproxy< 2.17.0-r12
- zipkin< 3.6.1-r20
Wolfi38 products
- akhq< 0.28.0-r6
- apache-activemq-artemis< 2.55.0-r3
- apache-pulsar-4.2< 4.2.4-r1
- apache-tika-3.1< 3.1.0-r37
- apache-tika-3.2< 3.2.3-r17
- celeborn-0.6< 0.6.3-r14
- druid< 37.0.0-r52
- flink-2.1< 2.1.3-r3
- flink-2.2< 2.2.1-r4
- infinispan-16.0< 16.0.14-r3
- infinispan-16.1< 16.1.4-r10
- infinispan-16.2< 16.2.2-r2
- kafka-4.1< 4.1.2-r8
- keycloak-config-cli< 6.5.1-r13
- keycloak-config-cli-iamguarded-compat< 6.5.1-r13
- kserve-modelmesh< 0.12.0-r39
- neo4j-2026.06< 2026.06.0-r8
- neo4j-2026.07< 2026.07.1-r1
- opensearch-2< 2.19.6-r8
- opensearch-3< 3.8.0-r0
- solr-10< 10.0.0-r10
- solr-10-iamguarded-compat< 10.0.0-r10
- spark-4.0-scala-2.13< 4.0.4-r2
- spark-4.1-scala-2.13< 4.1.3-r3
- spdx-tools-java< 2.0.7-r5
- strimzi-kafka-operator-cluster-operator< 1.1.0-r7
- strimzi-kafka-operator-kafka-agent< 1.1.0-r7
- strimzi-kafka-operator-kafka-init< 1.1.0-r7
- strimzi-kafka-operator-kafka-thirdparty-libs-cc< 1.1.0-r7
- strimzi-kafka-operator-topic-operator< 1.1.0-r7
- strimzi-kafka-operator-tracing-agent< 1.1.0-r7
- strimzi-kafka-operator-user-operator< 1.1.0-r7
- thingsboard-tb-mqtt-transport< 4.3.1.3-r20
- thingsboard-tb-node< 4.3.1.3-r20
- wavefront-proxy< 13.9-r26
- wildfly-openjdk-17< 41.0.0-r3
- wildfly-openjdk-21< 41.0.0-r3
- zipkin< 3.6.1-r20
2 vendors · 174 products
References
0 linksNo references have been published for this record.
Related vulnerabilities
CVE-2026-54428apache software foundationapache httpcomponents core+1460.87%Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.CVE-2026-54516chainguardairbyte-server+3910.45%jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.CVE-2026-54512chainguardairbyte-server+6621.00%jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.CVE-2026-54515chainguardairbyte-server+7240.44%jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.CVE-2026-54518chainguardairbyte-server+3910.35%jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults prop.visibleInView(activeView). The normal property-based creator path gates creator properties on the active view, but this unwrapped-creator replay path bypasses that check, so a constructor parameter annotated with both @JsonView(AdminView.class) and @JsonUnwrapped is populated from attacker JSON even when a more restrictive view is active. This vulnerability is fixed in 2.21.4 and 3.1.4.CVE-2026-54291chainguardairbyte-server+760.24%pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.