VEX / floci-full

floci-full

1 statement, issued 2026-11-09.Each one is a scanner finding that is not exploitable in this image, and why.

@id https://quench-works.com/vex/floci-full/2026-11-09

1. CVE-2026-12975

   not affected · vulnerable code not present
   • apicurio-registry-schema-util-common 2.6.13.Final

   Measured 2026-11-09 on the published floci-full:2.4.0 image (crane export of usr/share/floci/quarkus-app; the 2.3.0 and 2.4.0 lines resolve the same apicurio 2.6.13.Final). CVE-2026-12975 (GHSA-7g64-f2hm-vjxp) is an XXE/SSRF in ContentTypeUtil.isParsableXml(), which builds a SAXParserFactory without secure processing. The image ships six apicurio 2.6.13.Final jars in lib/main, and none contains a ContentTypeUtil class (every class in every jar was listed). A byte scan of every class in apicurio-registry-schema-util-common-2.6.13.Final.jar found no SAXParserFactory or isParsableXml reference; the jar holds content handles, reference finders and compatibility-rule types only. The vulnerable method is not in the image. The advisory's fixed versions are on the 3.2 and 3.3 lines, which the Quarkus build does not use. Revisit when Floci moves to apicurio 3.