Red Hat Build Of Debezium 3 vulnerabilities

14 CVEs affecting Red Hat Build Of Debezium 3, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-10832, published 2026-09-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-27830, published 2026-02-26. High severity, CVSS 8.0. EPSS: 2% chance of exploitation in the next 30 days. c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource`…
CVE-2026-40984, published 2026-06-09. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5;…
CVE-2026-5598, published 2026-04-15. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue…
CVE-2026-19611, published 2026-08-20. High severity, CVSS 7.4. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more…
CVE-2026-40983, published 2026-06-09. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0…
CVE-2026-89059, published 2026-09-18. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote,…
CVE-2025-70974, published 2026-01-09. Critical severity, CVSS 10.0. EPSS: 0.8% chance of exploitation in the next 30 days. Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of…
CVE-2026-5588, published 2026-04-15. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All…
CVE-2026-17615, published 2026-08-31. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a…
CVE-2026-0636, published 2026-04-15. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is…

Latest

CVE-2026-10832, published 2026-09-18. Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER (Distinguished Encoding…
CVE-2026-87743, published 2026-09-18. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the…
CVE-2026-89058, published 2026-09-18. High severity, CVSS 7.4. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with…