apicurio-registry.advisories.yaml

schema-version: 2.0.2

package:
  name: apicurio-registry

advisories:
  - id: CGA-3mr8-6pqr-xv84
    aliases:
      - CVE-2025-11966
      - GHSA-45p5-v273-3qqr
    events:
      - timestamp: 2025-10-24T07:14:44Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: e9364a94ec3ce9f8
            componentName: vertx-web
            componentVersion: 4.5.20
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/io.vertx.vertx-web-4.5.20.jar
            scanner: grype
      - timestamp: 2025-10-29T14:17:01Z
        type: pending-upstream-fix
        data:
          note: This vulnerability is fixed in vertx-web 4.5.22. However, upgrading from 4.5.20 to 4.5.22 results in build failures. Since vertx-web is a transitive dependency, upstream will need to update direct dependencies to versions that depend on vertx-web 4.5.22 or later.

  - id: CGA-3qmv-j289-r7c5
    aliases:
      - CVE-2025-1634
      - GHSA-4fwr-mh5q-hchh
    events:
      - timestamp: 2025-02-27T07:08:12Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: 1db8ad5db6e9418c
            componentName: quarkus-resteasy
            componentVersion: 3.15.1
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/modified-io.quarkus.quarkus-resteasy-3.15.1.jar
            scanner: grype
      - timestamp: 2025-03-07T18:26:06Z
        type: pending-upstream-fix
        data:
          note: Upstream maintainers will have to upgrade quarkus-resteasy to 3.15.3.1 or later due to breaking build changes.
      - timestamp: 2025-03-19T18:39:31Z
        type: fixed
        data:
          fixed-version: 3.0.6-r2

  - id: CGA-5hr5-g6v2-4w72
    aliases:
      - CVE-2024-47535
      - GHSA-xq3w-v528-46rv
    events:
      - timestamp: 2024-12-02T09:29:58Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: 5126e31e6af0c797
            componentName: netty-common
            componentVersion: 4.1.111.Final
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/io.netty.netty-common-4.1.111.Final.jar
            scanner: grype
      - timestamp: 2025-01-17T00:56:02Z
        type: pending-upstream-fix
        data:
          note: |
            netty is a transitive dependency of this project, and is affected by this CVE.
            Remediating this CVE would require upgrading a chain of dependencies: (quarkus <-- quarkus-http <-- netty).
            The latest version of quarkus-http (at the time of writing), still depends on an older, affected version of netty.
            Regardless, attempting to upgrade netty results in build failures. Waiting for upstream to address in a future release.
             - https://github.com/quarkusio/quarkus/blob/a98a3f91fc06c959672b67ece75516bb59b994cd/bom/application/pom.xml#L38
             - https://github.com/Apicurio/apicurio-registry/blob/779f0994a1de5ebd48f617f476f3e3b7c5a36e48/pom.xml#L147
             - https://github.com/quarkusio/quarkus-http/blob/314574122c3616e96d2e76edb15da2692036edc8/pom.xml#L67
      - timestamp: 2025-02-19T16:07:53Z
        type: fixed
        data:
          fixed-version: 3.0.6-r1

  - id: CGA-6xmr-f935-3957
    aliases:
      - CVE-2025-27817
      - GHSA-vgq5-3255-v292
    events:
      - timestamp: 2025-06-11T07:03:26Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: e4ccc1b8dacb84d6
            componentName: kafka-clients
            componentVersion: 3.7.1
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/modified-org.apache.kafka.kafka-clients-3.7.1.jar
            scanner: grype
      - timestamp: 2025-06-11T08:57:28Z
        type: fixed
        data:
          fixed-version: 3.0.9-r1

  - id: CGA-6xxq-cf3f-jrfr
    aliases:
      - CVE-2025-24970
      - GHSA-4g8c-wm8x-jfhw
    events:
      - timestamp: 2025-02-11T09:14:59Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: 2dd43f83df045348
            componentName: netty-handler
            componentVersion: 4.1.111.Final
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/io.netty.netty-handler-4.1.111.Final.jar
            scanner: grype
      - timestamp: 2025-02-19T16:07:54Z
        type: fixed
        data:
          fixed-version: 3.0.6-r1

  - id: CGA-7r2r-4fw7-h3qv
    aliases:
      - CVE-2025-48924
      - GHSA-j288-q9x7-2f5v
    events:
      - timestamp: 2025-07-12T07:08:35Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: ed1d14e5f6d5a951
            componentName: commons-lang3
            componentVersion: 3.14.0
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/org.apache.commons.commons-lang3-3.14.0.jar
            scanner: grype
      - timestamp: 2025-07-12T08:48:57Z
        type: fixed
        data:
          fixed-version: 3.0.9-r5

  - id: CGA-83rw-p5wh-p5v5
    aliases:
      - CVE-2025-25193
      - GHSA-389x-839f-4rhx
    events:
      - timestamp: 2025-02-11T09:14:57Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: 5126e31e6af0c797
            componentName: netty-common
            componentVersion: 4.1.111.Final
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/io.netty.netty-common-4.1.111.Final.jar
            scanner: grype
      - timestamp: 2025-02-13T19:41:51Z
        type: false-positive-determination
        data:
          type: vulnerable-code-cannot-be-controlled-by-adversary
          note: Vulnerability affects only Windows systems.

  - id: CGA-9vf2-8c9q-q94f
    aliases:
      - CVE-2024-12397
      - GHSA-cxrx-q234-m22m
    events:
      - timestamp: 2024-12-13T07:03:43Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: 103775bab44f729f
            componentName: quarkus-http-core
            componentVersion: 5.3.2
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/io.quarkus.http.quarkus-http-core-5.3.2.jar
            scanner: grype
      - timestamp: 2025-01-17T00:56:02Z
        type: pending-upstream-fix
        data:
          note: |
            apicurio-registry, depends on 'quarkus', which in turn depends on 'quarkus-http', affected by this CVE.
            This is addressed in 'quarkus-http' v5.3.4, but the 'quarkus' version used by this project, depends on 'quarkus-http v5.3.2'.
            Attempts to upgrade quarkus resulted in build errors. The project has noted caveats when bumping quarkus in the code base.
            Waiting for upstream to address in a future release.
             - https://github.com/quarkusio/quarkus/blob/a98a3f91fc06c959672b67ece75516bb59b994cd/bom/application/pom.xml#L38
             - https://github.com/Apicurio/apicurio-registry/blob/779f0994a1de5ebd48f617f476f3e3b7c5a36e48/pom.xml#L147
             - https://github.com/quarkusio/quarkus-http
      - timestamp: 2025-02-19T16:07:52Z
        type: fixed
        data:
          fixed-version: 3.0.6-r1

  - id: CGA-cxqr-5r5g-9rgj
    aliases:
      - CVE-2025-53864
      - GHSA-xwmg-2g98-w7v9
    events:
      - timestamp: 2025-07-12T07:08:34Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: 63abc7672303fcff
            componentName: nimbus-jose-jwt
            componentVersion: "9.40"
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/com.nimbusds.nimbus-jose-jwt-9.40.jar
            scanner: grype
      - timestamp: 2025-07-12T12:41:54Z
        type: fixed
        data:
          fixed-version: 3.0.9-r6

  - id: CGA-f7xm-9r25-c899
    aliases:
      - CVE-2025-55163
      - GHSA-prj3-ccx8-p6x4
    events:
      - timestamp: 2025-08-15T15:08:00Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: 01355e18412d0f51
            componentName: netty-codec-http2
            componentVersion: 4.1.121.Final
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/apicurio-registry-mcp-server-3.0.12-runner.jar
            scanner: grype
      - timestamp: 2025-08-19T02:03:28Z
        type: fixed
        data:
          fixed-version: 3.0.12-r1

  - id: CGA-f8wf-5cjx-7789
    aliases:
      - CVE-2025-2240
      - GHSA-gfh6-3pqw-x2j4
    events:
      - timestamp: 2025-03-14T14:12:20Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: 014a905757c8a655
            componentName: smallrye-fault-tolerance-core
            componentVersion: 6.4.0
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/io.smallrye.smallrye-fault-tolerance-core-6.4.0.jar
            scanner: grype
      - timestamp: 2025-03-19T18:39:32Z
        type: fixed
        data:
          fixed-version: 3.0.6-r2

  - id: CGA-fr9m-mrh7-gwv4
    aliases:
      - CVE-2024-57699
      - GHSA-pq2g-wx69-c263
    events:
      - timestamp: 2025-02-07T07:36:46Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: fe5710a8afcf02ab
            componentName: json-smart
            componentVersion: 2.5.0
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/net.minidev.json-smart-2.5.0.jar
            scanner: grype
      - timestamp: 2025-02-19T16:07:53Z
        type: fixed
        data:
          fixed-version: 3.0.6-r1

  - id: CGA-g88v-rfvw-47pv
    aliases:
      - CVE-2025-7962
      - GHSA-9342-92gg-6v29
    events:
      - timestamp: 2025-08-08T07:09:30Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: 6dc0e4cf0edba074
            componentName: smtp
            componentVersion: 2.0.3
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/org.eclipse.angus.angus-mail-2.0.3.jar
            scanner: grype
      - timestamp: 2025-08-13T13:47:08Z
        type: fixed
        data:
          fixed-version: 3.0.11-r1

  - id: CGA-grcc-qx94-3j9g
    aliases:
      - CVE-2025-58056
      - GHSA-fghv-69vj-qj49
    events:
      - timestamp: 2025-09-06T07:14:23Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: b617f16b6f64bd33
            componentName: netty-codec-http
            componentVersion: 4.1.121.Final
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/apicurio-registry-mcp-server-3.0.13-runner.jar
            scanner: grype
      - timestamp: 2025-09-09T17:40:43Z
        type: fixed
        data:
          fixed-version: 3.0.14-r1

  - id: CGA-j66p-v8fc-4w2m
    aliases:
      - CVE-2025-48734
      - GHSA-wxr5-93ph-8wr9
    events:
      - timestamp: 2025-05-29T07:05:10Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: cac89a3232b39fc7
            componentName: commons-beanutils
            componentVersion: 1.10.0
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/commons-beanutils.commons-beanutils-1.10.0.jar
            scanner: grype
      - timestamp: 2025-05-30T20:35:59Z
        type: fixed
        data:
          fixed-version: 3.0.8-r0

  - id: CGA-j8x8-w834-r8hg
    aliases:
      - CVE-2025-49574
      - GHSA-9623-mj7j-p9v4
    events:
      - timestamp: 2025-06-24T08:23:33Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: 1bf146d0715f6664
            componentName: quarkus-vertx
            componentVersion: 3.15.4
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/io.quarkus.quarkus-vertx-3.15.4.jar
            scanner: grype
      - timestamp: 2025-07-02T14:33:07Z
        type: pending-upstream-fix
        data:
          note: This vulnerability is fixed in quarkus-vertx v3.24.0. At this time, apicurio-registry does not support this version, and as such fails to build on the new version.

  - id: CGA-mcf9-q3qf-q8v4
    aliases:
      - CVE-2025-59250
      - GHSA-m494-w24q-6f7w
    events:
      - timestamp: 2025-11-05T07:05:34Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: ea91a5bd849384bd
            componentName: mssql-jdbc
            componentVersion: 12.8.1
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/com.microsoft.sqlserver.mssql-jdbc-12.8.1.jre11.jar
            scanner: grype
      - timestamp: 2025-11-06T20:28:29Z
        type: fixed
        data:
          fixed-version: 3.1.2-r0
      - timestamp: 2025-12-02T01:15:57Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: 6b9fd3d2ff3dcd84
            componentName: mssql-jdbc
            componentVersion: 12.10.2
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/com.microsoft.sqlserver.mssql-jdbc-12.10.2.jre11.jar
            scanner: grype
      - timestamp: 2025-12-05T11:37:28Z
        type: fixed
        data:
          fixed-version: 3.1.4-r2

  - id: CGA-p3w3-hrxv-jqqf
    aliases:
      - CVE-2024-58103
      - GHSA-pwf9-q62p-v7wc
    events:
      - timestamp: 2025-03-19T11:44:19Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: 8c3584a0eed9cc5d
            componentName: wire-runtime
            componentVersion: 4.9.9
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/com.squareup.wire.wire-runtime-4.9.9.jar
            scanner: grype
      - timestamp: 2025-03-19T17:41:07Z
        type: pending-upstream-fix
        data:
          note: 'Bumping com.squareup.wire from 4.9.9 to the fixed 5.2.0 resulted in build failures: apicurio-registry upstream will need to handle the dependency upgrade and release a new version.'

  - id: CGA-pprc-vhvh-79j3
    aliases:
      - CVE-2025-58057
      - GHSA-3p8m-j85q-pgmj
    events:
      - timestamp: 2025-09-04T07:21:49Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: 6b6f2b18b27c5e48
            componentName: netty-codec
            componentVersion: 4.1.121.Final
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/apicurio-registry-mcp-server-3.0.13-runner.jar
            scanner: grype
      - timestamp: 2025-09-04T08:42:30Z
        type: fixed
        data:
          fixed-version: 3.0.13-r1

  - id: CGA-v92f-24gf-wvfv
    aliases:
      - CVE-2025-11965
      - GHSA-h5fg-jpgr-rv9c
    events:
      - timestamp: 2025-10-24T07:14:45Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: e9364a94ec3ce9f8
            componentName: vertx-web
            componentVersion: 4.5.20
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/io.vertx.vertx-web-4.5.20.jar
            scanner: grype
      - timestamp: 2025-10-28T15:55:28Z
        type: pending-upstream-fix
        data:
          note: This vulnerability is fixed in vertx-web 4.5.22. However, upgrading from 4.5.20 to 4.5.22 results in build failures. Since vertx-web is a transitive dependency, upstream will need to update direct dependencies to versions that depend on vertx-web 4.5.22 or later.

  - id: CGA-x238-2v8w-3j6m
    aliases:
      - CVE-2025-4949
      - GHSA-vrpq-qp53-qv56
    events:
      - timestamp: 2025-05-23T07:05:26Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: c1cca36d662b7a37
            componentName: org.eclipse.jgit
            componentVersion: 7.1.0.202411261347-r
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/org.eclipse.jgit.org.eclipse.jgit-7.1.0.202411261347-r.jar
            scanner: grype
      - timestamp: 2025-05-23T09:13:20Z
        type: fixed
        data:
          fixed-version: 3.0.7-r1

  - id: CGA-x2pj-p6gm-xpqp
    aliases:
      - CVE-2012-5783
      - GHSA-3832-9276-x7gf
    events:
      - timestamp: 2024-12-03T09:26:09Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: 3e0a7c38a5aed36d
            componentName: commons-httpclient
            componentVersion: "3.1"
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/commons-httpclient.commons-httpclient-3.1.jar
            scanner: grype
      - timestamp: 2025-01-27T11:03:07Z
        type: fixed
        data:
          fixed-version: 3.0.6-r0
      - timestamp: 2025-01-29T08:05:40Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: 3e0a7c38a5aed36d
            componentName: commons-httpclient
            componentVersion: "3.1"
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/commons-httpclient.commons-httpclient-3.1.jar
            scanner: grype
      - timestamp: 2025-02-25T13:27:19Z
        type: fixed
        data:
          fixed-version: 3.0.6-r1
      - timestamp: 2025-02-27T07:08:10Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: 3e0a7c38a5aed36d
            componentName: commons-httpclient
            componentVersion: "3.1"
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/commons-httpclient.commons-httpclient-3.1.jar
            scanner: grype
      - timestamp: 2025-03-21T23:20:26Z
        type: fixed
        data:
          fixed-version: 3.0.6-r2
      - timestamp: 2025-03-23T07:17:53Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: 3e0a7c38a5aed36d
            componentName: commons-httpclient
            componentVersion: "3.1"
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/commons-httpclient.commons-httpclient-3.1.jar
            scanner: grype
      - timestamp: 2025-03-24T08:03:43Z
        type: fixed
        data:
          fixed-version: 3.0.6-r2
      - timestamp: 2025-03-26T07:13:18Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: 3e0a7c38a5aed36d
            componentName: commons-httpclient
            componentVersion: "3.1"
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/commons-httpclient.commons-httpclient-3.1.jar
            scanner: grype
      - timestamp: 2025-03-28T08:18:55Z
        type: fixed
        data:
          fixed-version: 3.0.6-r2

  - id: CGA-xfr2-3vw3-m45x
    aliases:
      - CVE-2025-49146
      - GHSA-hq9p-pm7w-8p54
    events:
      - timestamp: 2025-06-12T07:14:59Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apicurio-registry
            componentID: 4880bb8967296ca3
            componentName: postgresql
            componentVersion: 42.7.4
            componentType: java-archive
            componentLocation: /usr/share/java/apicurio-registry/lib/org.postgresql.postgresql-42.7.4.jar
            scanner: grype
      - timestamp: 2025-06-13T09:16:02Z
        type: fixed
        data:
          fixed-version: 3.0.9-r2