CGA-WQHW-VH22-JWGM: airflow-3
CVSS: UnknownUnknown
Published Date unknownLast modified Date unknown
Status not reported
The data service did not report a status for this record. Only the available sections are shown.Vulnerability summary
CGA-WQHW-VH22-JWGM is a vulnerability in airflow-3 with no CVSS score yet.
CVSS score
Not scored
010
No CVSS score recordedEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
No timeline events recorded.
Description
No description has been published for this record.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Chainguard129 products
- airflow-3< 3.2.1-r1
- akhq< 0.27.0-r2
- apache-activemq-5.19< 5.19.6-r2
- apache-activemq-6.1< 6.1.8-r3
- apache-activemq-6.2< 6.2.4-r1
- apache-activemq-artemis< 2.53.0-r5
- apache-activemq-fips-5.19< 5.19.6-r2
- apache-activemq-fips-6.1< 6.1.8-r3
- apache-activemq-fips-6.2< 6.2.4-r1
- apache-camel-karavan-devmode< 4.14.2-r8
- apache-hop< 2.17.0-r8
- apache-hop-fips< 2.17.0-r8
- apache-jena-fuseki< 6.0.0-r5
- apache-pulsar-4.0< 4.0.9-r11
- apache-pulsar-4.2< 4.2.1-r0
- apache-pulsar-fips-4.0< 4.0.9-r11
- apache-pulsar-fips-4.2< 4.2.1-r0
- apache-tika-2.9< 2.9.4-r12
- apache-tika-3.0< 3.0.0-r24
- apache-tika-3.1< 3.1.0-r30
- apache-tika-3.2< 3.2.3-r9
- apache-tika-fips-2.9< 2.9.4-r6
- apache-tika-fips-3.0< 3.0.0-r7
- apache-tika-fips-3.1< 3.1.0-r8
- apache-tika-fips-3.2< 3.2.3-r5
- apache-tika-fips-3.3< 3.3.0-r3
- camunda-8.8< 8.8.22-r0
- camunda-8.9< 8.9.1-r0
- camunda-zeebe-8.6< 8.6.39-r0
- camunda-zeebe-8.7< 8.7.27-r0
- camunda-zeebe-8.8< 8.8.22-r0
- camunda-zeebe-8.9< 8.9.1-r0
- celeborn-0.5< 0.5.4-r21
- celeborn-0.6< 0.6.2-r13
- commercial-elasticsearch-8.19< 8.19.16-r0
- commercial-elasticsearch-9.3< 9.3.5-r0
- commercial-elasticsearch-9.4< 9.4.2-r0
- druid< 36.0.0-r13
- elasticsearch-8.19< 8.19.14-r3
- elasticsearch-8.19-iamguarded< 8.19.14-r3
- elasticsearch-9.1< 9.1.10-r5
- elasticsearch-9.1-iamguarded< 9.1.10-r5
- elasticsearch-9.2< 9.2.8-r3
- elasticsearch-9.2-iamguarded< 9.2.8-r3
- elasticsearch-9.3< 9.3.4-r1
- elasticsearch-9.3-iamguarded< 9.3.4-r1
- elasticsearch-9.4< 9.4.1-r0
- elasticsearch-9.4-iamguarded< 9.4.1-r0
- elasticsearch-fips-8.19< 8.19.14-r1
- elasticsearch-fips-9.1< 9.1.10-r12
- elasticsearch-fips-9.2< 9.2.8-r1
- elasticsearch-fips-9.3< 9.3.4-r1
- elasticsearch-fips-9.4< 9.4.1-r0
- flink-1.19< 1.19.3-r4
- flink-1.20< 1.20.3-r4
- flink-2.0< 2.0.1-r6
- flink-2.1< 2.1.1-r3
- flink-2.2< 2.2.0-r5
- geoserver-2.27< 2.27.5-r6
- geoserver-2.27-community< 2.27.5-r6
- geoserver-2.28< 2.28.3-r4
- geoserver-2.28-community< 2.28.3-r4
- ghidra< 12.0.4-r1
- hadoop-fips-3.5< 3.5.0-r3
- infinispan-15.0< 15.0.22-r5
- infinispan-15.1< 15.1.7-r13
- infinispan-15.2< 15.2.6-r13
- infinispan-16.0< 16.0.9-r2
- infinispan-16.1< 16.1.3-r1
- kafka-4.0< 4.0.2-r2
- kafka-4.1< 4.1.2-r2
- kafka-4.2< 4.2.0-r5
- kafka-bridge< 0.33.1-r14
- kafka-bridge-fips< 0.33.1-r9
- kafka-fips-4.1< 4.1.2-r2
- kafka-fips-4.2< 4.2.1-r0
- kserve-modelmesh< 0.12.0-r31
- lmcache-cuda-12.8< 0.5.4-r0
- logstash-8.19< 8.19.14-r3
- logstash-8.19-iamguarded-compat< 8.19.14-r3
- logstash-8.19-with-output-opensearch< 8.19.14-r3
- logstash-9.0< 9.0.8-r20
- logstash-9.0-iamguarded-compat< 9.0.8-r20
- logstash-9.0-with-output-opensearch< 9.0.8-r20
- logstash-9.1< 9.1.10-r6
- logstash-9.1-bitnami-compat< 9.1.10-r6
- logstash-9.1-iamguarded-compat< 9.1.10-r6
- logstash-9.1-with-output-opensearch< 9.1.10-r6
- logstash-9.2< 9.2.8-r2
- logstash-9.2-iamguarded-compat< 9.2.8-r2
- logstash-9.2-with-output-opensearch< 9.2.8-r2
- logstash-9.3< 9.3.3-r2
- logstash-9.3-iamguarded-compat< 9.3.3-r2
- logstash-9.3-with-output-opensearch< 9.3.3-r2
- neo4j-2026.05< 2026.05.0-r1
- neo4j-5.26< 5.26.23-r3
- nuxeo-2023< 2023.40-r3
- opensearch-2< 2.19.4-r14
- opensearch-2-performance-analyzer< 2.19.6-r0
- opensearch-3< 3.6.0-r0
- opensearch-fips-3< 3.5.0-r5
- pinot< 1.5.0-r0
- pinot-fips< 1.4.0-r6
- solr-10< 10.0.0-r1
- solr-9< 9.10.1-r2
- sonarqube< 26.7.0.124771-r0
- spark-3.5-scala-2.12< 3.5.9-r2
- spark-3.5-scala-2.13< 3.5.9-r2
- spark-4.0-scala-2.13< 4.0.2-r11
- spark-4.1-scala-2.13< 4.1.1-r15
- spark-fips-3.5-scala-2.12< 3.5.8-r6
- spark-fips-3.5-scala-2.13< 3.5.8-r6
- spark-fips-4.1-scala-2.13< 4.1.1-r13
- spark-kubernetes-operator< 0.8.0-r1
- spark-kubernetes-operator-fips< 0.8.0-r1
- strimzi-kafka-operator-cluster-operator< 0.51.0-r22
- strimzi-kafka-operator-kafka-agent< 0.51.0-r22
- strimzi-kafka-operator-kafka-init< 0.51.0-r22
- strimzi-kafka-operator-kafka-thirdparty-libs< 0.51.0-r22
- strimzi-kafka-operator-kafka-thirdparty-libs-cc< 0.51.0-r22
- strimzi-kafka-operator-topic-operator< 0.51.0-r22
- strimzi-kafka-operator-tracing-agent< 0.51.0-r22
- strimzi-kafka-operator-user-operator< 0.51.0-r22
- strimzi-kafka-operator-v1-api-conversion< 0.51.0-r22
- tritonserver-backend-vllm-cuda-13.0< 25.11-r7
- wavefront-proxy< 13.9-r12
- wso2is< 7.3.0-r0
- zaproxy< 2.17.0-r12
- zipkin< 3.6.1-r4
Wolfi36 products
- airflow-3< 3.2.1-r1
- akhq< 0.27.0-r2
- apache-activemq-artemis< 2.53.0-r5
- apache-pulsar-4.2< 4.2.1-r0
- apache-tika-3.1< 3.1.0-r30
- apache-tika-3.2< 3.2.3-r9
- celeborn-0.6< 0.6.2-r13
- druid< 36.0.0-r13
- flink-2.1< 2.1.1-r3
- flink-2.2< 2.2.0-r5
- infinispan-16.0< 16.0.9-r2
- infinispan-16.1< 16.1.3-r1
- kafka-4.1< 4.1.2-r2
- kafka-4.2< 4.2.0-r5
- kserve-modelmesh< 0.12.0-r31
- logstash-9.3< 9.3.3-r2
- logstash-9.3-iamguarded-compat< 9.3.3-r2
- logstash-9.3-with-output-opensearch< 9.3.3-r2
- neo4j-2026.05< 2026.05.0-r1
- opensearch-2< 2.19.4-r14
- opensearch-3< 3.6.0-r0
- solr-10< 10.0.0-r1
- sonarqube< 26.7.0.124771-r0
- spark-4.0-scala-2.13< 4.0.2-r11
- spark-4.1-scala-2.13< 4.1.1-r15
- strimzi-kafka-operator-cluster-operator< 0.51.0-r22
- strimzi-kafka-operator-kafka-agent< 0.51.0-r22
- strimzi-kafka-operator-kafka-init< 0.51.0-r22
- strimzi-kafka-operator-kafka-thirdparty-libs< 0.51.0-r22
- strimzi-kafka-operator-kafka-thirdparty-libs-cc< 0.51.0-r22
- strimzi-kafka-operator-topic-operator< 0.51.0-r22
- strimzi-kafka-operator-tracing-agent< 0.51.0-r22
- strimzi-kafka-operator-user-operator< 0.51.0-r22
- strimzi-kafka-operator-v1-api-conversion< 0.51.0-r22
- wavefront-proxy< 13.9-r12
- zipkin< 3.6.1-r4
2 vendors · 165 products
References
0 linksNo references have been published for this record.
Related vulnerabilities
CVE-2016-1000027chainguardapache-activemq-5.19+2633.18%Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.CVE-2025-54121chainguardairflow-3+490.61%Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47.1 and below, when parsing a multi-part form with large files (greater than the default max spool size) starlette will block the main thread to roll the file over to disk. This blocks the event thread which means the application can't accept new connections. The UploadFile code has a minor bug where instead of just checking for self._in_memory, the logic should also check if the additional bytes will cause a rollover. The vulnerability is fixed in version 0.47.2.CVE-2025-41242chainguardapache-activemq-5.19+392.13%Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.
An application can be vulnerable when all the following are true:
* the application is deployed as a WAR or with an embedded Servlet container
* the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization
* the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title with Spring resource handling
We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.CVE-2025-41249chainguardapache-activemq-5.19+870.46%The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions.
Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature.
You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces.
This CVE is published in conjunction with CVE-2025-41248 https://spring.io/security/cve-2025-41248 .CVE-2025-55163chainguardakhq+2661.10%Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.CVE-2025-62611aio-libsaiomysql+150.39%aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary files from the client by sending a LOAD_LOCAL instruction packet. This issue has been patched in version 0.3.0.