Saltar al contenido
QuenchWorks

VEXfloci

floci

1 declaración, emitidas el .Cada una es un hallazgo del escáner que no es explotable en esta imagen, y el motivo.

ImagenOpenVEX JSON

@id https://quench-works.com/vex/floci/2026-11-09

  1. CVE-2026-12975

    no afectado · código vulnerable ausente
    • apicurio-registry-schema-util-common 2.6.13.Final

    Measured 2026-11-09 on the published floci:2.4.0 image (crane export of usr/share/floci/quarkus-app; the 2.1.0, 2.3.0 and 2.4.0 lines resolve the same apicurio 2.6.13.Final). CVE-2026-12975 (GHSA-7g64-f2hm-vjxp) is an XXE/SSRF in ContentTypeUtil.isParsableXml(), which builds a SAXParserFactory without secure processing. The image ships six apicurio 2.6.13.Final jars in lib/main, and none contains a ContentTypeUtil class (every class in every jar was listed). A byte scan of every class in apicurio-registry-schema-util-common-2.6.13.Final.jar found no SAXParserFactory or isParsableXml reference; the jar holds content handles, reference finders and compatibility-rule types only. The vulnerable method is not in the image. The advisory's fixed versions are on the 3.2 and 3.3 lines, which the Quarkus build does not use. Revisit when Floci moves to apicurio 3.