Red Hat Build Of Apicurio Registry 2 vulnerabilities

11 CVEs affecting Red Hat Build Of Apicurio Registry 2, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-69873, published 2026-02-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-3653, published 2024-07-08. Medium severity, CVSS 5.3. EPSS: 1.9% chance of exploitation in the next 30 days. A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler…
CVE-2024-3884, published 2025-12-03. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding…
CVE-2024-11831, published 2025-02-10. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object…
CVE-2025-2240, published 2025-03-12. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates…
CVE-2024-12397, published 2024-12-12. High severity, CVSS 7.4. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to…
CVE-2023-6717, published 2024-04-25. Medium severity, CVSS 6.0. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a…
CVE-2025-69873, published 2026-02-11. Low severity, CVSS 2.9. EPSS: 0.5% chance of exploitation in the next 30 days. ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON…
CVE-2023-5675, published 2024-04-25. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation…
CVE-2024-1249, published 2024-04-17. High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in…
CVE-2024-4027, published 2026-01-30. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names.…

Latest

CVE-2025-7195, published 2025-08-07. Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days. Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which…