Fuse (Redhat) - vulnerabilities (CVEs)

29 CVEs, 0 in the last 30 days, 19 known versions, newest CVE from 2026-06-10. Vendor: Redhat.

CVEs of Fuse

CVE-2026-41731 - CVSS 8.1 (high), 2026-06-10: JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting…
CVE-2026-28369 - CVSS 9.1 (critical), 2026-03-27: A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the…
CVE-2026-28368 - CVSS 9.1 (critical), 2026-03-27: A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by…
CVE-2026-28367 - CVSS 9.1 (critical), 2026-03-27: A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request…
CVE-2025-57849 - CVSS 6.4 (medium), 2026-03-13: A container privilege escalation flaw was found in certain Fuse images. This issue stems from the /etc/passwd file being created with group-writable…
CVE-2025-12543 - CVSS 9.6 (critical), 2026-01-07: A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly…
CVE-2025-9784 - CVSS 7.5 (high), 2025-09-02: A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to…
CVE-2024-1635 - CVSS 7.5 (high), 2024-02-19: A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and…
CVE-2023-1108 - CVSS 7.5 (high), 2023-09-14: A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the…
CVE-2021-4178 - CVSS 6.7 (medium), 2022-08-24: A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML…
CVE-2021-3690 - CVSS 7.5 (high), 2022-08-23: A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a…
CVE-2021-3597 - CVSS 5.9 (medium), 2022-05-24: A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest…
CVE-2020-10688 - CVSS 6.1 (medium), 2021-05-27: A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding…
CVE-2020-25689 - CVSS 6.5 (medium), 2020-11-02: A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections…
CVE-2019-14900 - CVSS 6.5 (medium), 2020-07-06: A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit…
CVE-2020-10719 - CVSS 6.5 (medium), 2020-05-26: A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an…
CVE-2019-10174 - CVSS 8.8 (high), 2019-11-25: A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke…
CVE-2019-14860 - CVSS 7.4 (high), 2019-11-08: It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to…
CVE-2019-10219 - CVSS 6.5 (medium), 2019-11-08: A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious…
CVE-2019-0201 - CVSS 5.9 (medium), 2019-05-23: An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when…
CVE-2019-0204 - CVSS 7.8 (high), 2019-03-25: A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in…
CVE-2018-1258 - CVSS 8.8 (high), 2018-05-11: Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An…
CVE-2018-1270 - CVSS 9.8 (critical), 2018-04-06: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over…
CVE-2018-1199 - CVSS 5.3 (medium), 2018-03-16: Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before…
CVE-2017-12617 - CVSS 8.1 (high), 2017-10-04: When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the…
CVE-2017-7957 - CVSS 7.5 (high), 2017-04-29: XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during…
CVE-2017-5645 - CVSS 9.8 (critical), 2017-04-17: In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially…
CVE-2016-4437 - CVSS 9.8 (critical), 2016-06-07: Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or…
CVE-2015-1427 - CVSS 9.8 (critical), 2015-02-17: The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and…