CGA-WMP8-RWRX-3H9C: akhq
Unknown
Published Date unknownLast modified Date unknown
Status not reported
The data service did not report a status for this record. Only the available sections are shown.Vulnerability summary
CGA-WMP8-RWRX-3H9C is a vulnerability in akhq with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
No timeline events recorded.
Description
No description has been published for this record.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in the CISA KEV catalog.
Not in the ENISA CNW catalog.
Not in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Chainguard200 products
- akhq< 0.26.0-r4
- apache-activemq-artemis< 2.42.0-r8
- apache-activemq-artemis-compat< 2.42.0-r8
- apache-hop< 2.16.0-r0
- apache-hop-fips< 2.16.0-r0
- apache-nifi< 2.5.0-r6
- apache-nifi-compat< 2.5.0-r6
- apache-nifi-toolkit< 2.5.0-r6
- apache-pulsar< 4.0.6-r2
- apache-pulsar-compat< 4.0.6-r2
- apicurio-registry< 3.0.13-r1
- apicurio-registry-nginx-config< 3.0.13-r1
- apicurio-registry-ui< 3.0.13-r1
- camunda-zeebe-8.6< 8.6.27-r1
- camunda-zeebe-8.6-compat< 8.6.27-r1
- camunda-zeebe-8.7< 8.7.12-r2
- camunda-zeebe-8.7-compat< 8.7.12-r2
- cassandra-5.0< 5.0.5-r5
- cassandra-5.0-compat< 5.0.5-r5
- cassandra-5.0-entrypoint-compat< 5.0.5-r5
- cassandra-5.0-iamguarded-compat< 5.0.5-r5
- cassandra-fips-5.0< 5.0.3-r10
- cassandra-fips-5.0-compat< 5.0.3-r10
- cassandra-reaper< 3.8.0-r11
- celeborn-0.6< 0.6.3-r7
- cloudwatch-exporter< 0.16.0-r7
- cqlsh-5.0< 5.0.5-r5
- cqlsh-fips-5.0< 5.0.3-r10
- docker-selenium< 4.35.0.20250828-r0
- docker-selenium-base< 4.35.0.20250828-r0
- docker-selenium-compat< 4.35.0.20250828-r0
- docker-selenium-distributor< 4.35.0.20250828-r0
- docker-selenium-event-bus< 4.35.0.20250828-r0
- docker-selenium-hub< 4.35.0.20250828-r0
- docker-selenium-node-base< 4.35.0.20250828-r0
- docker-selenium-node-chromium< 4.35.0.20250828-r0
- docker-selenium-node-docker< 4.35.0.20250828-r0
- docker-selenium-node-firefox< 4.35.0.20250828-r0
- docker-selenium-router< 4.35.0.20250828-r0
- docker-selenium-session-queue< 4.35.0.20250828-r0
- docker-selenium-sessions< 4.35.0.20250828-r0
- docker-selenium-standalone< 4.35.0.20250828-r0
- docker-selenium-standalone-chrome< 4.35.0.20250828-r0
- docker-selenium-standalone-chromium< 4.35.0.20250828-r0
- docker-selenium-standalone-docker< 4.35.0.20250828-r0
- docker-selenium-standalone-firefox< 4.35.0.20250828-r0
- docker-selenium-supervisor-config< 4.35.0.20250828-r0
- druid< 34.0.0-r3
- druid-compat< 34.0.0-r3
- elasticsearch-7< 7.17.29-r4
- elasticsearch-7-iamguarded< 7.17.29-r4
- elasticsearch-8.17< 8.17.10-r13
- elasticsearch-8.17-config< 8.17.10-r13
- elasticsearch-8.18< 8.18.6-r13
- elasticsearch-8.18-config< 8.18.6-r13
- elasticsearch-8.18-iamguarded< 8.18.6-r13
- elasticsearch-8.19< 8.19.3-r0
- elasticsearch-8.19-config< 8.19.3-r0
- elasticsearch-8.19-iamguarded< 8.19.3-r0
- elasticsearch-9.0< 9.0.7-r0
- elasticsearch-9.0-config< 9.0.7-r0
- elasticsearch-9.0-iamguarded< 9.0.7-r0
- elasticsearch-9.1< 9.1.3-r1
- elasticsearch-9.1-config< 9.1.3-r1
- elasticsearch-9.1-iamguarded< 9.1.3-r1
- elasticsearch-fips-8.19< 8.19.3-r0
- elasticsearch-fips-8.19-config< 8.19.3-r0
- elasticsearch-fips-9.0< 9.0.8-r0
- elasticsearch-fips-9.0-bitnami< 9.0.8-r0
- elasticsearch-fips-9.0-config< 9.0.8-r0
- elasticsearch-fips-9.1< 9.1.3-r1
- elasticsearch-fips-9.1-config< 9.1.3-r1
- flyway< 11.11.2-r1
- grpc-java-fips-1.56.0-m2< 1.56.0-r6
- hadoop-fips-3.3.6< 3.3.6-r6
- infinispan-15.0< 15.0.21-r0
- infinispan-15.0-compat< 15.0.21-r0
- infinispan-15.0-images< 15.0.21-r0
- infinispan-15.1< 15.1.7-r2
- infinispan-15.1-compat< 15.1.7-r2
- infinispan-15.1-images< 15.1.7-r2
- infinispan-15.2< 15.2.6-r0
- infinispan-15.2-compat< 15.2.6-r0
- infinispan-15.2-images< 15.2.6-r0
- kafka_exporter-strimzi-compat< 0.47.0-r7
- kafka-3.7< 3.7.2-r46
- kafka-3.8< 3.8.1-r46
- kafka-3.9< 3.9.1-r5
- kafka-strimzi-compat< 0.47.0-r7
- keycloak-26.2< 26.2.5-r2
- keycloak-26.2-compat< 26.2.5-r2
- keycloak-26.2-iamguarded-compat< 26.2.5-r2
- keycloak-26.3< 26.3.3-r5
- keycloak-26.3-compat< 26.3.3-r5
- keycloak-26.3-iamguarded-compat< 26.3.3-r5
- keycloak-fips-26.2-iamguarded-fips< 26.2.5-r3
- keycloak-fips-26.3< 26.3.3-r4
- keycloak-fips-26.3-iamguarded-fips< 26.3.3-r4
- keycloak-fips-26.3-operator< 26.3.3-r4
- keycloak-fips-26.3-operator-compat< 26.3.3-r4
- knative-kafka-broker-1.17-dispatcher-loom< 1.17.3-r9
- knative-kafka-broker-1.17-receiver-loom< 1.17.3-r9
- kserve-modelmesh< 0.12.0-r16
- kserve-modelmesh-compat< 0.12.0-r16
- localstack< 4.14.0-r11
- logstash-8.17-compat< 8.17.10-r1
- logstash-8.17-env2yaml< 8.17.10-r1
- logstash-8.18< 8.18.6-r1
- logstash-8.18-compat< 8.18.6-r1
- logstash-8.18-env2yaml< 8.18.6-r1
- logstash-8.18-iamguarded-compat< 8.18.6-r1
- logstash-8.18-with-output-opensearch< 8.18.6-r1
- logstash-8.19< 8.19.3-r1
- logstash-8.19-compat< 8.19.3-r1
- logstash-8.19-env2yaml< 8.19.3-r1
- logstash-8.19-iamguarded-compat< 8.19.3-r1
- logstash-8.19-with-output-opensearch< 8.19.3-r1
- logstash-9.0< 9.0.6-r1
- logstash-9.0-compat< 9.0.6-r1
- logstash-9.0-env2yaml< 9.0.6-r1
- logstash-9.0-iamguarded-compat< 9.0.6-r1
- logstash-9.0-with-output-opensearch< 9.0.6-r1
- logstash-9.1< 9.1.3-r2
- logstash-9.1-bitnami-compat< 9.1.3-r2
- logstash-9.1-compat< 9.1.3-r2
- logstash-9.1-env2yaml< 9.1.3-r2
- logstash-9.1-iamguarded-compat< 9.1.3-r2
- logstash-9.1-with-output-opensearch< 9.1.3-r2
- logstash-input-beats< 6.9.4-r0
- logstash-input-http< 3.10.3-r0
- logstash-input-tcp< 6.4.7-r0
- management-api-for-apache-cassandra-4.0< 0.1.107-r1
- management-api-for-apache-cassandra-4.0-compat< 0.1.107-r1
- management-api-for-apache-cassandra-4.1< 0.1.107-r1
- management-api-for-apache-cassandra-4.1-compat< 0.1.107-r1
- management-api-for-apache-cassandra-5.0< 0.1.107-r2
- management-api-for-apache-cassandra-5.0-compat< 0.1.107-r2
- neo4j-2025.06< 2025.06.2-r5
- neo4j-2025.06-browser< 2025.06.2-r5
- neo4j-2025.06-docker-publish< 2025.06.2-r5
- neo4j-2025.07< 2025.07.1-r3
- neo4j-2025.07-browser< 2025.07.1-r3
- neo4j-2025.07-docker-publish< 2025.07.1-r3
- neo4j-4.4< 4.4.45-r1
- neo4j-4.4-docker-publish< 4.4.45-r1
- neo4j-5.26< 5.26.12-r0
- neo4j-5.26-docker-publish< 5.26.12-r0
- opensearch-2< 2.19.4-r0
- opensearch-2-ml-commons< 2.19.4-r0
- opensearch-2-performance-analyzer< 2.19.4-r0
- opensearch-2-repository-s3< 2.19.4-r0
- opensearch-2-security< 2.19.4-r0
- opensearch-2-security-analytics< 2.19.4-r0
- opensearch-2-transport-nio< 2.19.4-r0
- prometheus-jmx-exporter-strimzi-compat< 0.47.0-r7
- seata-server< 2.7.0-r2
- selenium-server< 4.41.0-r0
- solr< 9.9.0-r2
- solr-oci-compat< 9.9.0-r2
- sonarqube< 25.12.0.117093-r1
- spark-3.5< 3.5.6-r7
- spark-3.5-scala-2.12< 3.5.6-r7
- spark-3.5-scala-2.12-compat< 3.5.6-r7
- spark-3.5-scala-2.12-iamguarded-compat< 3.5.6-r7
- spark-3.5-scala-2.13< 3.5.6-r7
- spark-3.5-scala-2.13-compat< 3.5.6-r7
- spark-4.0< 4.0.0-r4
- spark-4.0-scala-2.13< 4.0.0-r4
- spark-4.0-scala-2.13-compat< 4.0.0-r4
- spark-fips-3.5< 3.5.4-r15
- spark-fips-3.5-scala-2.12< 3.5.4-r15
- spark-fips-3.5-scala-2.12-compat< 3.5.4-r15
- spark-fips-3.5-scala-2.13< 3.5.4-r15
- spark-fips-3.5-scala-2.13-compat< 3.5.4-r15
- strimzi-kafka-operator< 0.47.0-r7
- strimzi-kafka-operator-cluster-operator< 0.47.0-r7
- strimzi-kafka-operator-kafka-agent< 0.47.0-r7
- strimzi-kafka-operator-kafka-base< 0.47.0-r7
- strimzi-kafka-operator-kafka-init< 0.47.0-r7
- strimzi-kafka-operator-kafka-thirdparty-libs< 0.47.0-r7
- strimzi-kafka-operator-kafka-thirdparty-libs-cc< 0.47.0-r7
- strimzi-kafka-operator-topic-operator< 0.47.0-r7
- strimzi-kafka-operator-tracing-agent< 0.47.0-r7
- strimzi-kafka-operator-user-operator< 0.47.0-r7
- tez< 0.10.5-r16
- thingsboard< 4.2-r3
- thingsboard-tb-js-executor< 4.2-r3
- thingsboard-tb-mqtt-transport< 4.2-r3
- thingsboard-tb-node< 4.2-r3
- thingsboard-tb-web-ui< 4.2-r3
- trino< 476-r7
- trino-config< 476-r7
- trino-oci-entrypoint< 476-r7
- trino-plugin-ai-functions< 476-r7
- trino-plugin-bigquery< 476-r7
- trino-plugin-blackhole< 476-r7
- trino-plugin-cassandra< 476-r7
- trino-plugin-clickhouse< 476-r7
- trino-plugin-delta-lake< 476-r7
- trino-plugin-druid< 476-r7
1 vendor · 200 products · Showing 200 of 424
References
0 linksNo references have been published for this record.
Related vulnerabilities
PrioritiseCVE-2026-102554google · guava +481 moreDenial of Service via Eager Array Allocation During Deserialization in GuavaAllocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.CVSS8.2HighEPSS0.35%RoutineCVE-2026-106453yawkat · lz4-java +220 moreyawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryErroryawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size to request up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided destination buffer are not affected because the caller controls the destination size. This issue is fixed in version 1.11.2.CVSS5.3MediumEPSS0.37%RoutineCVE-2026-106452yawkat · lz4-java +220 moreyawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream headeryawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks when compression is not smaller than the original block, but vulnerable readers accept non-canonical oversized compressed blocks. This issue is fixed in version 1.11.2.CVSS5.3MediumEPSS0.45%RoutineCVE-2026-106451yawkat · lz4-java +225 moreyawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local useryawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without exclusive creation, allowing another local user with access to the same shared temporary directory to create or replace the library file before System.load() uses it. Successful exploitation depends on shared-directory permissions, host protections, and winning the race, and can execute native code as the victim; hardened systems may instead cause library loading to fail and fall back to Java implementations. Configurations using a system library, a private java.io.tmpdir, or Java-only implementations are not affected. This issue is fixed in version 1.11.4.CVSS7.3HighEPSS0.11%RoutineCVE-2026-106450yawkat · lz4-java +225 moreyawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputsyawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many minimal empty frames to trigger roughly 8 MiB of allocation for every 11 input bytes. The stream produces no decompressed output while consuming CPU and garbage-collection time, so decompressed-size limits do not mitigate the issue; readSingleFrame mode is not affected. This issue is fixed in version 1.11.4.CVSS5.3MediumEPSS0.45%RoutineCVE-2026-106449yawkat · lz4-java +225 moreyawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowErroryawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4.CVSS3.7LowEPSS0.42%