Vulnlog / Vulnlog 0.18.0 (2026-10-09) 21 fixed CVE-2026-103111 (not affected) Out-of-bounds write in PCRE2 JIT matching with an attacker-controlled regular expression. fix: The Alpine base image carries no PCRE2. CVE-2026-11822 (not affected) Memory corruption in the SQLite FTS5 extension when reading a crafted database. fix: The Alpine base image carries no SQLite. CVE-2026-11824 (not affected) Heap buffer overflow in SQLite FTS5 `fts5ChunkIterate()` via crafted page metadata. fix: The Alpine base image carries no SQLite. CVE-2026-13221 (not affected) Perl matches incorrectly when an alternation of more than 65535 fixed strings is compiled into a trie. fix: The Alpine base image carries no Perl. CVE-2026-14456 (not affected) Unbounded memory growth in the OpenSSL QUIC server listener enables a remote denial of service. fix: The Alpine base image ships OpenSSL 3.5.8, which contains the fix. CVE-2026-41992 (not affected) Global buffer overflow in GNU gzip LZH decompression after an LZW file in the same run. fix: The Alpine base image carries no GNU gzip; BusyBox provides gzip instead. CVE-2026-42496 (not affected) Perl Archive::Tar extracts symlinks whose targets point outside the extraction directory. fix: The Alpine base image carries no Perl. CVE-2026-42497 (not affected) Perl Archive::Tar extracts hardlinks to paths outside the extraction directory. fix: The Alpine base image carries no Perl. CVE-2026-48962 (not affected) Perl IO::Compress `File::GlobMapper` evaluates an attacker-controlled output glob as code. fix: The Alpine base image carries no Perl. CVE-2026-53612 (not affected) Time-of-check-time-of-use flaw in util-linux `mount(8)` when it applies post-mount ownership or mode changes. fix: The Alpine base image carries no util-linux; BusyBox provides mount instead. CVE-2026-53613 (not affected) Time-of-check-time-of-use flaw in util-linux `mount(8)` allowing an ancestor directory swap on the target path. fix: The Alpine base image carries no util-linux; BusyBox provides mount instead. CVE-2026-53614 (not affected) SUID `mount(8)` of util-linux trusts `LIBMOUNT_FORCE_MOUNT2`, which permits a `nosuid`/`noexec` bypass. fix: The Alpine base image carries no util-linux; BusyBox provides mount instead. CVE-2026-57432 (not affected) Integer overflow in Perl `pack` and `unpack` templates leads to an out-of-bounds heap read. fix: The Alpine base image carries no Perl. CVE-2026-57433 (not affected) Signed integer overflow in Perl Storable when thawing a crafted `SX_HOOK` record. fix: The Alpine base image carries no Perl. CVE-2026-8376 (not affected) Heap buffer overflow in Perl regex compilation of repeated fixed strings on 32-bit builds. fix: The Alpine base image carries no Perl. CVE-2026-86145 (not affected) Out-of-bounds write in PCRE2 `pcre2_dfa_match()` when it reuses a cached workspace block. fix: The Alpine base image carries no PCRE2. CVE-2026-89157 (not affected) Out-of-bounds write in PCRE2 `pcre2_pattern_convert()` on 32-bit platforms. fix: The Alpine base image carries no PCRE2. CVE-2026-89161 (not affected) Incorrect free in PCRE2 `pcre2_jit_match()` when a copied subject is passed as match context. fix: The Alpine base image carries no PCRE2. CVE-2026-89425 (not affected, also GHSA-7hhh-6rmp-j9qf) jackson-core `UTF8DataInputJsonParser` builds invalid-token error messages without the `maxErrorTokenLength` limit. fix: Updated Jackson 3 from 3.2.2 to 3.2.3. ref: https://github.com/vulnlog/vulnlog/pull/297 CVE-2026-91776 (not affected, also GHSA-wv8q-qhhj-9h54) jackson-databind caches a deserializer per unknown `@JsonTypeInfo` type ID, so new IDs grow memory without bound. fix: Updated Jackson 3 from 3.2.2 to 3.2.3. ref: https://github.com/vulnlog/vulnlog/pull/297 CVE-2026-91777 (not affected, also GHSA-cxp5-3px4-pw24) jackson-databind resolves `@JsonIdentityInfo` forward references in quadratic time, which exhausts CPU. fix: Updated Jackson 3 from 3.2.2 to 3.2.3. ref: https://github.com/vulnlog/vulnlog/pull/297 0.17.0 (2026-08-24) 12 fixed: 4 low CVE-2024-12798 (low, also SNYK-JAVA-CHQOSLOGBACK-8539867, SNYK-JAVA-CHQOSLOGBACK-8539866) Improper neutralization of special elements vulnerability in Logback fix: Security scans now cover release artifacts only, where ktlint's logback is not present. ref: https://github.com/vulnlog/vulnlog/pull/253 CVE-2024-12801 (low, also SNYK-JAVA-CHQOSLOGBACK-8539865) Server-side request forgery (SSRF) vulnerability in Logback fix: Security scans now cover release artifacts only, where ktlint's logback is not present. ref: https://github.com/vulnlog/vulnlog/pull/253 CVE-2025-11226 (low, also SNYK-JAVA-CHQOSLOGBACK-13169722) External initialization of trusted variables or data stores vulnerability in Logback fix: Security scans now cover release artifacts only, where ktlint's logback is not present. ref: https://github.com/vulnlog/vulnlog/pull/253 CVE-2026-1225 (low, also SNYK-JAVA-CHQOSLOGBACK-15062482) External initialization of trusted variables or data stores vulnerability in Logback fix: Security scans now cover release artifacts only, where ktlint's logback is not present. ref: https://github.com/vulnlog/vulnlog/pull/253 CVE-2026-19032 (not affected, also GHSA-wjgm-6hv5-3cvf) jackson-databind resolves a `java.nio.file.Path` through any installed `FileSystemProvider` without a scheme allowlist. fix: Updated Jackson 3 from 3.2.0 to 3.2.2. ref: https://github.com/vulnlog/vulnlog/pull/264 CVE-2026-68497 (not affected, also GHSA-q4xh-88c3-wmh7) jackson-databind parses unbounded numbers when deserializing `javax.xml.datatype` `Duration` and `XMLGregorianCalendar` values, which exhausts CPU. fix: Updated Jackson 3 from 3.2.0 to 3.2.2. ref: https://github.com/vulnlog/vulnlog/pull/264 CVE-2026-77310 (not affected, also GHSA-vvgp-rfg2-7rr6) jackson-databind still resolves DNS eagerly when deserializing `InetAddress`, an incomplete fix for CVE-2026-54514. fix: Updated Jackson 3 from 3.2.0 to 3.2.2. ref: https://github.com/vulnlog/vulnlog/pull/264 CVE-2026-83557 (not affected, also GHSA-gx83-3vf8-gh7j) jackson-databind's default polymorphic type validator misses `Comparable` among its unsafe base types. fix: Updated Jackson 3 from 3.2.0 to 3.2.2. ref: https://github.com/vulnlog/vulnlog/pull/264 CVE-2026-89407 (not affected, also GHSA-p6pp-m3f8-5c89) jackson-core `NumberInput.looksLikeValidNumber()` backtracks in quadratic time on long digit strings. fix: Updated Jackson 3 from 3.2.0 to 3.2.2. ref: https://github.com/vulnlog/vulnlog/pull/264 SNYK-JAVA-CHQOSLOGBACK-17675439 (not affected) Expression injection vulnerability in Ktlints logback-core dependency. fix: Security scans now cover release artifacts only, where ktlint's logback is not present. ref: https://github.com/vulnlog/vulnlog/pull/253 SNYK-JAVA-CHQOSLOGBACK-17675449 (not affected) Deserialization of untrusted data vulnerability in `HardenedObjectInputStream` of `logback-core`. fix: Security scans now cover release artifacts only, where ktlint's logback is not present. ref: https://github.com/vulnlog/vulnlog/pull/253 SNYK-JAVA-CHQOSLOGBACK-17675450 (not affected) Deserialization of untrusted data vulnerability in `HardenedObjectInputStream` of `logback-classic`. fix: Security scans now cover release artifacts only, where ktlint's logback is not present. ref: https://github.com/vulnlog/vulnlog/pull/253 0.15.1 (2026-06-29) 7 fixed SNYK-JAVA-TOOLSJACKSONCORE-17434789 (not affected, also CVE-2026-54514, GHSA-hgj6-7826-r7m5) Server-side request forgery (SSRF) vulnerability in Jacksons `JDKFromStringDeserializer`. ref: https://github.com/vulnlog/vulnlog/pull/183 SNYK-JAVA-TOOLSJACKSONCORE-17440306 (not affected, also CVE-2026-54517, GHSA-5hh8-q8hv-fr38) Incorrect authorization in Jackson's `BeanDeserializer._deserializeUsingPropertyBased` method. ref: https://github.com/vulnlog/vulnlog/pull/183 SNYK-JAVA-TOOLSJACKSONCORE-17440359 (not affected, also CVE-2026-54518, GHSA-rcqc-6cw3-h962) Incorrect authorization in jackson's `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` method. ref: https://github.com/vulnlog/vulnlog/pull/183 SNYK-JAVA-TOOLSJACKSONCORE-17440365 (not affected, also CVE-2026-54513, GHSA-rmj7-2vxq-3g9f) Incomplete list of disallowed inputs in Jacksons `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` methods. ref: https://github.com/vulnlog/vulnlog/pull/183 SNYK-JAVA-TOOLSJACKSONCORE-17440597 (not affected, also CVE-2026-54512, GHSA-j3rv-43j4-c7qm) Deserialization of untrusted data in Jacksons `DatabindContext._resolveAndValidateGeneric()` method. ref: https://github.com/vulnlog/vulnlog/pull/183 SNYK-JAVA-TOOLSJACKSONCORE-17457396 (not affected, also CVE-2026-54516, GHSA-9fxm-vc8v-hj55) Improperly controlled modification of dynamically-determined object attributes in Jackson's `POJOPropertiesCollector._renameProperties()` and `BeanDeserializerFactory.addBeanProps()` methods. ref: https://github.com/vulnlog/vulnlog/pull/183 SNYK-JAVA-TOOLSJACKSONCORE-17457696 (not affected, also CVE-2026-54515, GHSA-5jmj-h7xm-6q6v) Improperly controlled modification of dynamically-determined object attributes in Jackson's `BeanDeserializerBase.createContextual()` method. ref: https://github.com/vulnlog/vulnlog/pull/183 0.12.0 (2026-04-19) 4 fixed: 3 low CVE-2020-29582 (low, also SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744) Information exposure vulnerability in Kotlin stdlib fix: Update ktlint to 14.2.0 also updates kotlin-stdlib to 2.1.0 CVE-2023-6378 (low, also SNYK-JAVA-CHQOSLOGBACK-6094942, SNYK-JAVA-CHQOSLOGBACK-6094943) Denial of service (DoS) vulnerability in logback fix: Update ktlint to 14.2.0 also updates logback to 1.3.14 CVE-2023-6481 (low, also SNYK-JAVA-CHQOSLOGBACK-6097492, SNYK-JAVA-CHQOSLOGBACK-6097493) Uncontrolled resource consumption (resource exhaustion) vulnerability in logback fix: Update ktlint to 14.2.0 also updates logback to 1.3.14 SNYK-JAVA-TOOLSJACKSONCORE-15907550 (not affected, also GHSA-2m67-wjpj-xhg9) Allocation of resources without limits or throttling vulnerability in Jackson ref: https://github.com/vulnlog/vulnlog/pull/82