airflow-3.advisories.yaml

schema-version: 2.0.2

package:
  name: airflow-3

advisories:
  - id: CGA-24q3-6wm3-783c
    aliases:
      - CVE-2024-47081
      - GHSA-9hjg-9r4m-mvj7
    events:
      - timestamp: 2025-06-10T07:18:11Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: c277f5fe0c528376
            componentName: requests
            componentVersion: 2.32.3
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/requests-2.32.3.dist-info/METADATA, /opt/airflow/lib/python3.12/site-packages/requests-2.32.3.dist-info/RECORD, /opt/airflow/lib/python3.12/site-packages/requests-2.32.3.dist-info/top_level.txt
            scanner: grype
      - timestamp: 2025-06-10T14:16:58Z
        type: fixed
        data:
          fixed-version: 3.0.1-r1

  - id: CGA-25gf-vhj8-6g6q
    aliases:
      - CVE-2025-69230
      - GHSA-fh55-r93g-j68g
    events:
      - timestamp: 2026-01-06T13:24:19Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 3aa20b23571a7336
            componentName: aiohttp
            componentVersion: 3.13.2
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/aiohttp-3.13.2.dist-info/METADATA
            scanner: grype

  - id: CGA-2p25-23hq-8932
    aliases:
      - CVE-2025-48924
      - GHSA-j288-q9x7-2f5v
    events:
      - timestamp: 2025-07-12T07:14:55Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 70a04db7fbeec8e3
            componentName: commons-lang3
            componentVersion: 3.13.0
            componentType: java-archive
            componentLocation: /opt/airflow/lib/python3.12/site-packages/ray/jars/ray_dist.jar
            scanner: grype
      - timestamp: 2025-07-14T06:26:17Z
        type: pending-upstream-fix
        data:
          note: The org.apache.commons:commons-lang3 is pulled through a transient dependency of a python package named 'ray' version 2.47.1 which is the latest. We will have to wait for 'ray' to push a more recent version of commons-lang3 and airflow to push a new release with the new 'ray' dependency updated.

  - id: CGA-3v8h-9xm6-877g
    aliases:
      - CVE-2025-62593
      - GHSA-q279-jhrf-cc6v
    events:
      - timestamp: 2025-11-27T11:07:59Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: da34b18dd4332e63
            componentName: ray
            componentVersion: 2.47.1
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/ray-2.47.1.dist-info/METADATA
            scanner: grype
      - timestamp: 2025-12-01T13:45:08Z
        type: pending-upstream-fix
        data:
          note: 'This vulnerability affects the Ray Python module. Updating Ray beyond version 2.47 currently violates Airflow’s dependency constraints. To address the issue, the upstream project will need to update its dependencies and version requirements, and upgrade Ray to version 2.52. See upstream issue: https://github.com/apache/airflow/issues/52550'

  - id: CGA-3whp-3mvm-w98q
    aliases:
      - CVE-2025-58065
      - GHSA-765j-9r45-w2q2
    events:
      - timestamp: 2025-10-02T20:37:32Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: f5360da0dd1a26c2
            componentName: flask-appbuilder
            componentVersion: 4.6.3
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/Flask_AppBuilder-4.6.3.dist-info/METADATA
            scanner: grype
      - timestamp: 2025-10-03T22:53:00Z
        type: pending-upstream-fix
        data:
          note: flask-appbuilder is a transitive dependency brought in via apache-airflow-providers-fab's most recent release, v2.4.4. To remediate, v3.0.0 must release and upstream airflow maintainers need to implement compatibility with the new major version where applicable.

  - id: CGA-3xph-4x32-2294
    aliases:
      - CVE-2025-66471
      - GHSA-2xpw-w6gg-jr37
    events:
      - timestamp: 2025-12-06T12:01:58Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: fcbb112b235a13d5
            componentName: urllib3
            componentVersion: 2.5.0
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/urllib3-2.5.0.dist-info/METADATA
            scanner: grype
      - timestamp: 2025-12-10T11:05:08Z
        type: fixed
        data:
          fixed-version: 3.1.3-r3
      - timestamp: 2025-12-10T11:22:41Z
        type: fixed
        data:
          fixed-version: 3.1.4-r0

  - id: CGA-4243-6x76-g636
    aliases:
      - CVE-2025-62611
      - GHSA-r397-ff8c-wv2g
    events:
      - timestamp: 2025-10-24T07:10:02Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: ae2562cf2a5f4e5d
            componentName: aiomysql
            componentVersion: 0.2.0
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/aiomysql-0.2.0.dist-info/METADATA
            scanner: grype
      - timestamp: 2025-10-27T08:36:42Z
        type: fixed
        data:
          fixed-version: 3.1.0-r3

  - id: CGA-5cqm-8cxm-v987
    aliases:
      - CVE-2025-69228
      - GHSA-6jhg-hg63-jvvf
    events:
      - timestamp: 2026-01-06T13:24:18Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 3aa20b23571a7336
            componentName: aiohttp
            componentVersion: 3.13.2
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/aiohttp-3.13.2.dist-info/METADATA
            scanner: grype

  - id: CGA-5f7p-j39v-8j6p
    aliases:
      - CVE-2025-69229
      - GHSA-g84x-mcqj-x9qq
    events:
      - timestamp: 2026-01-06T13:24:20Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 3aa20b23571a7336
            componentName: aiohttp
            componentVersion: 3.13.2
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/aiohttp-3.13.2.dist-info/METADATA
            scanner: grype

  - id: CGA-5x99-mqvf-h8cx
    aliases:
      - CVE-2025-50182
      - GHSA-48p4-8xcf-vxj5
    events:
      - timestamp: 2025-06-19T07:07:54Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 0c7ed2aa51956fc7
            componentName: urllib3
            componentVersion: 2.4.0
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/urllib3-2.4.0.dist-info/METADATA, /opt/airflow/lib/python3.12/site-packages/urllib3-2.4.0.dist-info/RECORD
            scanner: grype
      - timestamp: 2025-06-26T16:02:36Z
        type: fixed
        data:
          fixed-version: 3.0.2-r2

  - id: CGA-8758-m7p7-vf5r
    aliases:
      - CVE-2025-53643
      - GHSA-9548-qrrj-x5pj
    events:
      - timestamp: 2025-07-16T07:11:48Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 6ee394a83731d2a5
            componentName: aiohttp
            componentVersion: 3.12.12
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/ray/_private/runtime_env/agent/thirdparty_files/aiohttp-3.12.12.dist-info/METADATA
            scanner: grype
      - timestamp: 2025-07-17T13:03:51Z
        type: pending-upstream-fix
        data:
          note: The vulnerability in aiohttp is introduced via a transitive dependency from the ray package (v2.47.1, latest). Remediation is pending upstream updates from ray and a subsequent airflow release that includes the updated ray version. In the interim, we have proactively updated aiohttp to v3.12.14 wherever feasible.

  - id: CGA-9277-fvp3-cfqv
    aliases:
      - CVE-2025-62727
      - GHSA-7f5h-v6xp-fcq8
    events:
      - timestamp: 2025-10-29T07:09:48Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 1c442712788428c8
            componentName: starlette
            componentVersion: 0.48.0
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/starlette-0.48.0.dist-info/METADATA
            scanner: grype
      - timestamp: 2025-10-30T09:26:58Z
        type: pending-upstream-fix
        data:
          note: The Starlette vulnerability (CVE-2025-62727) exists in a transitive dependency through FastAPI. Apache Airflow Core 3.1.1 has a hard constraint on fastapi[standard-no-fastapi-cloud-cli]>=0.116.0,<0.118.0, which prevents upgrading to FastAPI 0.118.0+ that supports Starlette 0.49.1 (the patched version). The fix requires upstream Apache Airflow to release a version with relaxed FastAPI constraints.

  - id: CGA-953p-8grm-pmhq
    aliases:
      - CVE-2025-68161
      - GHSA-vc5p-v9hr-52mj
    events:
      - timestamp: 2025-12-20T11:24:20Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: f8497d0a0d73988f
            componentName: log4j-core
            componentVersion: 2.17.1
            componentType: java-archive
            componentLocation: /opt/airflow/lib/python3.12/site-packages/ray/jars/ray_dist.jar
            scanner: grype
      - timestamp: 2025-12-26T14:55:35Z
        type: pending-upstream-fix
        data:
          note: The log4j-core dependency is introduced transitively via the Ray Python package. The latest Ray release still depends on the vulnerable log4j-core version 2.17.1 (see https://github.com/ray-project/ray/blob/6dc66d4b7da62e93093b98190c064d50d5c1905f/java/dependencies.bzl#L24). To remediate GHSA-vc5p-v9hr-52mj, Ray maintainers must upgrade log4j-core to a patched version, after which Airflow maintainers will need to consume the updated Ray release.

  - id: CGA-98jr-8mwh-f768
    aliases:
      - CVE-2025-66221
      - GHSA-hgf8-39gv-g3f2
    events:
      - timestamp: 2025-12-02T11:05:33Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 82ff72237fa68917
            componentName: werkzeug
            componentVersion: 2.2.3
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/Werkzeug-2.2.3.dist-info/METADATA
            scanner: grype
      - timestamp: 2025-12-03T07:39:07Z
        type: false-positive-determination
        data:
          type: vulnerable-code-cannot-be-controlled-by-adversary
          note: Vulnerability only affects Windows systems due to exploit being related to Windows-specific device names (CON, AUX, etc.).

  - id: CGA-c288-6whx-wc9h
    aliases:
      - CVE-2025-69277
      - GHSA-mrfv-m5wm-5w6w
    events:
      - timestamp: 2026-01-07T11:07:10Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 23b87ab8d47b75f7
            componentName: pynacl
            componentVersion: 1.6.1
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/pynacl-1.6.1.dist-info/METADATA
            scanner: grype

  - id: CGA-c62x-7p7g-hqvm
    aliases:
      - CVE-2024-49767
      - GHSA-q34m-jh98-gwm2
    events:
      - timestamp: 2025-05-05T11:10:49Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 9557a2c302d19bd2
            componentName: werkzeug
            componentVersion: 2.2.3
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/Werkzeug-2.2.3.dist-info/METADATA, /opt/airflow/lib/python3.12/site-packages/Werkzeug-2.2.3.dist-info/RECORD, /opt/airflow/lib/python3.12/site-packages/Werkzeug-2.2.3.dist-info/top_level.txt
            scanner: grype
      - timestamp: 2025-06-10T14:16:58Z
        type: fixed
        data:
          fixed-version: 3.0.1-r1
      - timestamp: 2025-10-21T21:23:08Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 82ff72237fa68917
            componentName: werkzeug
            componentVersion: 2.2.3
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/Werkzeug-2.2.3.dist-info/METADATA
            scanner: grype
      - timestamp: 2025-10-23T12:06:16Z
        type: pending-upstream-fix
        data:
          note: |-
            We are currently unable to bump the Werkzeug dependency as there are some hard constraints on the connnexion dependency for the FAB auth manager APIs.
            More information can be found in a comment by upstream maintainers here: https://github.com/apache/airflow/pull/51681\#issuecomment-3411116656

  - id: CGA-gcv3-m4w5-hfr2
    aliases:
      - CVE-2024-34069
      - GHSA-2g68-c3qc-8985
    events:
      - timestamp: 2025-05-05T11:10:46Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 9557a2c302d19bd2
            componentName: werkzeug
            componentVersion: 2.2.3
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/Werkzeug-2.2.3.dist-info/METADATA, /opt/airflow/lib/python3.12/site-packages/Werkzeug-2.2.3.dist-info/RECORD, /opt/airflow/lib/python3.12/site-packages/Werkzeug-2.2.3.dist-info/top_level.txt
            scanner: grype
      - timestamp: 2025-06-10T14:16:59Z
        type: fixed
        data:
          fixed-version: 3.0.1-r1
      - timestamp: 2025-10-21T21:23:05Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 82ff72237fa68917
            componentName: werkzeug
            componentVersion: 2.2.3
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/Werkzeug-2.2.3.dist-info/METADATA
            scanner: grype
      - timestamp: 2025-10-23T12:06:16Z
        type: pending-upstream-fix
        data:
          note: |-
            We are currently unable to bump the Werkzeug dependency as there are some hard constraints on the connnexion dependency for the FAB auth manager APIs.
            More information can be found in a comment by upstream maintainers here: https://github.com/apache/airflow/pull/51681\#issuecomment-3411116656

  - id: CGA-gx9p-ww82-5jv2
    aliases:
      - CVE-2025-57804
      - GHSA-847f-9342-265h
    events:
      - timestamp: 2025-08-29T11:06:11Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: f15d09b8f5e9001b
            componentName: h2
            componentVersion: 4.2.0
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/h2-4.2.0.dist-info/METADATA
            scanner: grype
      - timestamp: 2025-08-29T22:35:31Z
        type: fixed
        data:
          fixed-version: 3.0.6-r0

  - id: CGA-j823-fw36-2q8w
    aliases:
      - CVE-2025-54121
      - GHSA-2c2j-9gv5-cj73
    events:
      - timestamp: 2025-07-22T07:12:26Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 3302a960d868c72d
            componentName: starlette
            componentVersion: 0.47.1
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/starlette-0.47.1.dist-info/METADATA
            scanner: grype
      - timestamp: 2025-07-23T09:03:16Z
        type: fixed
        data:
          fixed-version: 3.0.3-r3

  - id: CGA-jxv8-92hj-656v
    aliases:
      - CVE-2025-69224
      - GHSA-69f9-5gxw-wvc2
    events:
      - timestamp: 2026-01-06T13:24:17Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 3aa20b23571a7336
            componentName: aiohttp
            componentVersion: 3.13.2
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/aiohttp-3.13.2.dist-info/METADATA
            scanner: grype

  - id: CGA-m2pm-xjr4-c43x
    aliases:
      - CVE-2025-68480
      - GHSA-428g-f7cq-pgp5
    events:
      - timestamp: 2025-12-23T11:06:25Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 2a62af960c2b8921
            componentName: marshmallow
            componentVersion: 3.26.1
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/marshmallow-3.26.1.dist-info/METADATA
            scanner: grype
      - timestamp: 2026-01-02T16:06:30Z
        type: fixed
        data:
          fixed-version: 3.1.5-r1

  - id: CGA-m86h-f7wf-pgr8
    aliases:
      - CVE-2025-68146
      - GHSA-w853-jp5j-5j7f
    events:
      - timestamp: 2025-12-17T14:53:41Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 11835f7fff5985ac
            componentName: filelock
            componentVersion: 3.20.0
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/filelock-3.20.0.dist-info/METADATA
            scanner: grype
      - timestamp: 2025-12-18T22:08:47Z
        type: fixed
        data:
          fixed-version: 3.1.5-r0

  - id: CGA-mp5q-852h-84vc
    aliases:
      - GHSA-pph8-gcv7-4qj5
    events:
      - timestamp: 2025-09-02T14:15:39Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: fca0894fc45f585b
            componentName: pyo3
            componentVersion: 0.22.6
            componentType: rust-crate
            componentLocation: /opt/airflow/lib/python3.12/site-packages/fastuuid/fastuuid.cpython-312-aarch64-linux-gnu.so
            scanner: grype
      - timestamp: 2025-09-03T07:50:40Z
        type: pending-upstream-fix
        data:
          note: This vulnerability is brought via a transitive dependency of fastuuid 0.12.0 which currently has the vulnerable pyo3 version. fastuuid needs to do a new release with an updated version of pyo3 and airflow upstream has to do a release with a newer version of fastuuid that will pull in the updated fastuuid dependency.

  - id: CGA-p8cf-8xpv-jwpq
    aliases:
      - CVE-2025-5279
      - GHSA-r244-wg5g-6w2r
    events:
      - timestamp: 2025-05-29T07:09:44Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 7eeae783442b4316
            componentName: redshift-connector
            componentVersion: 2.1.6
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/redshift_connector-2.1.6.dist-info/METADATA, /opt/airflow/lib/python3.12/site-packages/redshift_connector-2.1.6.dist-info/RECORD, /opt/airflow/lib/python3.12/site-packages/redshift_connector-2.1.6.dist-info/top_level.txt
            scanner: grype
      - timestamp: 2025-06-10T14:17:00Z
        type: fixed
        data:
          fixed-version: 3.0.1-r1

  - id: CGA-p9f2-vvqc-fxf9
    aliases:
      - CVE-2025-32962
      - GHSA-99pm-ch96-ccp2
    events:
      - timestamp: 2025-05-17T07:06:32Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: a6c66e575e2a3890
            componentName: flask-appbuilder
            componentVersion: 4.5.3
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/Flask_AppBuilder-4.5.3.dist-info/METADATA, /opt/airflow/lib/python3.12/site-packages/Flask_AppBuilder-4.5.3.dist-info/RECORD, /opt/airflow/lib/python3.12/site-packages/Flask_AppBuilder-4.5.3.dist-info/top_level.txt
            scanner: grype
      - timestamp: 2025-06-10T14:17:00Z
        type: fixed
        data:
          fixed-version: 3.0.1-r1

  - id: CGA-p9q7-2f52-g93c
    aliases:
      - CVE-2023-46136
      - GHSA-hrfv-mqp8-q5rw
    events:
      - timestamp: 2025-05-05T11:10:48Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 9557a2c302d19bd2
            componentName: werkzeug
            componentVersion: 2.2.3
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/Werkzeug-2.2.3.dist-info/METADATA, /opt/airflow/lib/python3.12/site-packages/Werkzeug-2.2.3.dist-info/RECORD, /opt/airflow/lib/python3.12/site-packages/Werkzeug-2.2.3.dist-info/top_level.txt
            scanner: grype
      - timestamp: 2025-06-10T14:17:01Z
        type: fixed
        data:
          fixed-version: 3.0.1-r1
      - timestamp: 2025-10-21T21:23:07Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 82ff72237fa68917
            componentName: werkzeug
            componentVersion: 2.2.3
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/Werkzeug-2.2.3.dist-info/METADATA
            scanner: grype
      - timestamp: 2025-10-23T12:06:16Z
        type: pending-upstream-fix
        data:
          note: |-
            We are currently unable to bump the Werkzeug dependency as there are some hard constraints on the connnexion dependency for the FAB auth manager APIs.
            More information can be found in a comment by upstream maintainers here: https://github.com/apache/airflow/pull/51681\#issuecomment-3411116656

  - id: CGA-pcx4-jwph-2g77
    aliases:
      - CVE-2025-47278
      - GHSA-4grg-w6v8-c28g
    events:
      - timestamp: 2025-05-14T07:11:28Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 810bd773b489a0a2
            componentName: flask
            componentVersion: 3.1.0
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/flask-3.1.0.dist-info/METADATA, /opt/airflow/lib/python3.12/site-packages/flask-3.1.0.dist-info/RECORD
            scanner: grype
      - timestamp: 2025-06-10T14:17:01Z
        type: fixed
        data:
          fixed-version: 3.0.1-r1

  - id: CGA-qcmw-2jr2-h5r5
    aliases:
      - CVE-2025-50181
      - GHSA-pq67-6m6q-mj2v
    events:
      - timestamp: 2025-06-19T07:07:54Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 0c7ed2aa51956fc7
            componentName: urllib3
            componentVersion: 2.4.0
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/urllib3-2.4.0.dist-info/METADATA, /opt/airflow/lib/python3.12/site-packages/urllib3-2.4.0.dist-info/RECORD
            scanner: grype
      - timestamp: 2025-06-26T16:02:37Z
        type: fixed
        data:
          fixed-version: 3.0.2-r2

  - id: CGA-qxp2-f668-938w
    aliases:
      - CVE-2023-48022
      - GHSA-6wgj-66m2-xxp2
    events:
      - timestamp: 2025-10-02T07:07:57Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: ba2d1ca7236c4da6
            componentName: ray
            componentVersion: 2.49.0
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/ray-2.49.0.dist-info/METADATA
            scanner: grype
      - timestamp: 2025-10-03T09:31:48Z
        type: false-positive-determination
        data:
          type: vulnerability-record-analysis-contested
          note: The vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment.

  - id: CGA-qxq5-2gmc-hrf7
    aliases:
      - CVE-2025-69223
      - GHSA-6mq8-rvhq-8wgg
    events:
      - timestamp: 2026-01-06T13:24:19Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 3aa20b23571a7336
            componentName: aiohttp
            componentVersion: 3.13.2
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/aiohttp-3.13.2.dist-info/METADATA
            scanner: grype

  - id: CGA-rffr-3gww-cc9j
    aliases:
      - CVE-2024-49766
      - GHSA-f9vj-2wh5-fj8j
    events:
      - timestamp: 2025-05-05T11:10:47Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 9557a2c302d19bd2
            componentName: werkzeug
            componentVersion: 2.2.3
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/Werkzeug-2.2.3.dist-info/METADATA, /opt/airflow/lib/python3.12/site-packages/Werkzeug-2.2.3.dist-info/RECORD, /opt/airflow/lib/python3.12/site-packages/Werkzeug-2.2.3.dist-info/top_level.txt
            scanner: grype
      - timestamp: 2025-06-10T14:17:02Z
        type: fixed
        data:
          fixed-version: 3.0.1-r1
      - timestamp: 2025-10-21T21:23:06Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 82ff72237fa68917
            componentName: werkzeug
            componentVersion: 2.2.3
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/Werkzeug-2.2.3.dist-info/METADATA
            scanner: grype
      - timestamp: 2025-10-23T12:06:16Z
        type: pending-upstream-fix
        data:
          note: |-
            We are currently unable to bump the Werkzeug dependency as there are some hard constraints on the connnexion dependency for the FAB auth manager APIs.
            More information can be found in a comment by upstream maintainers here: https://github.com/apache/airflow/pull/51681\#issuecomment-3411116656

  - id: CGA-rh6r-pgx2-378c
    aliases:
      - CVE-2025-34351
      - GHSA-gx77-xgc2-4888
    events:
      - timestamp: 2025-12-02T11:05:32Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: da34b18dd4332e63
            componentName: ray
            componentVersion: 2.47.1
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/ray-2.47.1.dist-info/METADATA
            scanner: grype
      - timestamp: 2025-12-03T07:34:01Z
        type: pending-upstream-fix
        data:
          note: 'This vulnerability affects the Ray Python module. Updating Ray beyond version 2.47 currently violates Airflow’s dependency constraints. To address the issue, the upstream project will need to update its dependencies and version requirements, and upgrade Ray to version 2.52. See upstream issue: https://github.com/apache/airflow/issues/52550'
      - timestamp: 2025-12-17T13:45:01Z
        type: false-positive-determination
        data:
          type: vulnerability-record-analysis-contested
          note: NVD notes that this CVE has been rejected as a result of upstream contesting the findings (https://nvd.nist.gov/vuln/detail/CVE-2025-34351). They also note that it's considered a duplicate of CVE-2023-48022 which was also disputed

  - id: CGA-rw79-7pm4-6wf7
    aliases:
      - CVE-2025-8869
      - GHSA-4xh5-x5gv-qwph
    events:
      - timestamp: 2025-09-25T07:16:54Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: b7b75d3e759382ff
            componentName: pip
            componentVersion: 25.0.1
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/virtualenv/seed/wheels/embed/pip-25.0.1-py3-none-any.whl
            scanner: grype
      - timestamp: 2025-10-02T19:42:38Z
        type: pending-upstream-fix
        data:
          note: This is a vendored version of pip shipped by virtualenv, and is pulled in by transitive dependencies. Upstream will need to refresh their dependency versions to move to a newer version.

  - id: CGA-v657-g4qg-9wm6
    aliases:
      - CVE-2024-23342
      - GHSA-wj6h-64fc-37mp
    events:
      - timestamp: 2025-07-31T07:30:58Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: f142caf1df7191e5
            componentName: ecdsa
            componentVersion: 0.19.1
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/ecdsa-0.19.1.dist-info/METADATA
            scanner: grype
      - timestamp: 2025-08-04T17:37:14Z
        type: fix-not-planned
        data:
          note: The python-ecdsa library is vulnerable to a Minerva timing attack on the P-256 curve through the ecdsa.SigningKey.sign_digest() API. The vulnerability affects ECDSA signatures, key generation, and ECDH operations, potentially allowing attackers to leak internal nonces and discover private keys through timing analysis. The upstream python-ecdsa project explicitly considers side-channel attacks out of scope and has stated there is no planned fix for this vulnerability.

  - id: CGA-v6fh-p5pp-cr34
    aliases:
      - CVE-2025-69225
      - GHSA-mqqc-3gqh-h2x8
    events:
      - timestamp: 2026-01-06T13:24:21Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 3aa20b23571a7336
            componentName: aiohttp
            componentVersion: 3.13.2
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/aiohttp-3.13.2.dist-info/METADATA
            scanner: grype

  - id: CGA-vrv7-wrwp-rjc3
    aliases:
      - CVE-2025-69227
      - GHSA-jj3x-wxrx-4x23
    events:
      - timestamp: 2026-01-06T13:24:20Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 3aa20b23571a7336
            componentName: aiohttp
            componentVersion: 3.13.2
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/aiohttp-3.13.2.dist-info/METADATA
            scanner: grype

  - id: CGA-vx33-8fv6-fpfg
    aliases:
      - CVE-2025-66418
      - GHSA-gm62-xv2j-4w53
    events:
      - timestamp: 2025-12-06T12:01:59Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: fcbb112b235a13d5
            componentName: urllib3
            componentVersion: 2.5.0
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/urllib3-2.5.0.dist-info/METADATA
            scanner: grype
      - timestamp: 2025-12-10T11:05:10Z
        type: fixed
        data:
          fixed-version: 3.1.3-r3
      - timestamp: 2025-12-10T11:22:41Z
        type: fixed
        data:
          fixed-version: 3.1.4-r0

  - id: CGA-vx49-fm46-cjjp
    aliases:
      - CVE-2025-47287
      - GHSA-7cx3-6m66-7c5m
    events:
      - timestamp: 2025-05-17T07:06:31Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 40fd0bb2436291c5
            componentName: tornado
            componentVersion: 6.4.2
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/tornado-6.4.2.dist-info/METADATA, /opt/airflow/lib/python3.12/site-packages/tornado-6.4.2.dist-info/RECORD, /opt/airflow/lib/python3.12/site-packages/tornado-6.4.2.dist-info/top_level.txt
            scanner: grype
      - timestamp: 2025-06-10T14:17:02Z
        type: fixed
        data:
          fixed-version: 3.0.1-r1

  - id: CGA-w38r-wr7c-g82f
    aliases:
      - CVE-2025-69226
      - GHSA-54jq-c3m8-4m76
    events:
      - timestamp: 2026-01-06T13:24:17Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 3aa20b23571a7336
            componentName: aiohttp
            componentVersion: 3.13.2
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/aiohttp-3.13.2.dist-info/METADATA
            scanner: grype

  - id: CGA-xqf6-7pmq-h43m
    aliases:
      - CVE-2025-50213
      - GHSA-9r64-3wmc-x8m8
    events:
      - timestamp: 2025-06-28T08:13:23Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: airflow-3
            componentID: 49b6479e5058993f
            componentName: apache-airflow-providers-snowflake
            componentVersion: 6.2.1
            componentType: python
            componentLocation: /opt/airflow/lib/python3.12/site-packages/apache_airflow_providers_snowflake-6.2.1.dist-info/METADATA, /opt/airflow/lib/python3.12/site-packages/apache_airflow_providers_snowflake-6.2.1.dist-info/RECORD, /opt/airflow/lib/python3.12/site-packages/apache_airflow_providers_snowflake-6.2.1.dist-info/direct_url.json
            scanner: grype
      - timestamp: 2025-06-30T16:29:57Z
        type: pending-upstream-fix
        data:
          note: Airflow v3.0.2 tagged version has apache-airflow-providers-snowflake dipendency at version 6.2.1. We need to wait for upstream to release another version for Airflow that has the fixed dipendency at v6.4.0. At the moment upstream released it in a not-tagged Airflow version commit. Once upstream release a tagged version with a fixed apache-airflow-providers-snowflake, we can update it.