{ "bomFormat": "CycloneDX", "specVersion": "1.5", "serialNumber": "urn:uuid:493e5f23-5c3b-45ba-a931-cda115442d70", "version": 1, "metadata": { "timestamp": "2025-01-16T00:00:00Z", "authors": [ { "name": "Connext Security Team", "email": "security@rti.com" } ], "component": { "type": "framework", "bom-ref": "Connext Pro", "supplier": { "name": "Real-Time Innovations, Inc. (RTI)", "url": [ "https://www.rti.com" ] }, "name": "Connext Professional", "version": "7.7.0.1" }, "properties": [ { "name": "last_updated", "value": "2026-07-15T07:30:48Z" } ] }, "vulnerabilities": [ { "bom-ref": "CVE-2011-1145", "id": "CVE-2011-1145", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1145" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2011-1145&vector=AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H&version=3.1" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2011-1145&vector=(AV:L/AC:L/Au:N/C:P/I:P/A:P)&version=2" }, "score": 4.6, "severity": "medium", "method": "CVSSv2", "vector": "CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:P/A:P" } ], "cwes": [ 120 ], "description": "The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in the connection string.", "published": "2019-11-14T02:15:10Z", "updated": "2024-11-21T01:25:39Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Connext does not call the impacted APIs", "firstIssued": "2024-06-12T13:10:44.519000Z", "lastUpdated": "2024-08-05T11:53:38.915000Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-203" }, { "name": "xray_id", "value": "XRAY-593529" } ] }, { "bom-ref": "CVE-2012-2657", "id": "CVE-2012-2657", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2657" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2012-2657&vector=(AV:L/AC:L/Au:N/C:N/I:N/A:P)&version=2" }, "score": 2.1, "severity": "low", "method": "CVSSv2", "vector": "CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:P" } ], "cwes": [ 119 ], "description": "Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.", "published": "2012-08-31T18:55:00Z", "updated": "2024-11-21T01:39:23Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "The code that triggers the vulnerability is not present in Connext.", "firstIssued": "2023-01-16T12:06:31.575000Z", "lastUpdated": "2023-01-24T12:13:58.073000Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-50" }, { "name": "xray_id", "value": "XRAY-169235" } ] }, { "bom-ref": "CVE-2018-7409", "id": "CVE-2018-7409", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7409" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2018-7409&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H&version=3" }, "score": 9.8, "severity": "critical", "method": "CVSSv3", "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2018-7409&vector=(AV:N/AC:L/Au:N/C:P/I:P/A:P)&version=2" }, "score": 7.5, "severity": "high", "method": "CVSSv2", "vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P" } ], "cwes": [ 119 ], "description": "In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.", "published": "2018-02-22T18:29:00Z", "updated": "2024-11-21T04:12:05Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "The code that triggers the vulnerability is not present in Connext.", "firstIssued": "2023-01-16T12:06:31.575000Z", "lastUpdated": "2023-01-24T12:13:58.073000Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-50" }, { "name": "xray_id", "value": "XRAY-148319" } ] }, { "bom-ref": "CVE-2020-24370", "id": "CVE-2020-24370", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24370" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2020-24370&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L&version=3.1" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2020-24370&vector=(AV:N/AC:L/Au:N/C:N/I:N/A:P)&version=2" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P" } ], "cwes": [ 191 ], "description": "ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).", "published": "2020-08-17T17:15:13Z", "updated": "2024-11-21T05:14:41Z", "analysis": { "state": "not_affected", "firstIssued": "2023-01-16T12:06:31.575000Z", "lastUpdated": "2023-01-24T12:13:58.073000Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-50" }, { "name": "xray_id", "value": "XRAY-146889" } ] }, { "bom-ref": "CVE-2020-24371", "id": "CVE-2020-24371", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24371" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2020-24371&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L&version=3.1" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2020-24371&vector=(AV:N/AC:L/Au:N/C:N/I:N/A:P)&version=2" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P" } ], "cwes": [ 763 ], "description": "lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.", "published": "2020-08-17T17:15:13Z", "updated": "2024-11-21T05:14:41Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "The code that triggers the vulnerability is not present in Connext.", "firstIssued": "2023-01-16T12:06:31.575000Z", "lastUpdated": "2023-01-24T12:13:58.073000Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-50" }, { "name": "xray_id", "value": "XRAY-142250" } ] }, { "bom-ref": "CVE-2021-43519", "id": "CVE-2021-43519", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43519" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2021-43519&vector=AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H&version=3.1" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2021-43519&vector=(AV:N/AC:M/Au:N/C:N/I:N/A:P)&version=2" }, "score": 4.3, "severity": "medium", "method": "CVSSv2", "vector": "CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:P" } ], "cwes": [ 674 ], "description": "Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file.", "published": "2021-11-09T13:15:08Z", "updated": "2024-11-21T06:29:20Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "The impacted code is not reachable in the product", "firstIssued": "2023-01-16T12:06:31.575000Z", "lastUpdated": "2023-01-24T12:13:58.073000Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-50" }, { "name": "xray_id", "value": "XRAY-189532" } ] }, { "bom-ref": "CVE-2021-44647", "id": "CVE-2021-44647", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44647" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2021-44647&vector=AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H&version=3.1" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2021-44647&vector=(AV:L/AC:L/Au:N/C:N/I:N/A:P)&version=2" }, "score": 2.1, "severity": "low", "method": "CVSSv2", "vector": "CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:P" } ], "cwes": [ 843 ], "description": "Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.", "published": "2022-01-11T13:15:07Z", "updated": "2024-11-21T06:31:18Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "The code that triggers the vulnerability is not present in Connext.", "firstIssued": "2023-01-16T12:06:31.575000Z", "lastUpdated": "2023-01-24T12:13:58.073000Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-50" }, { "name": "xray_id", "value": "XRAY-194232" } ] }, { "bom-ref": "CVE-2021-45985", "id": "CVE-2021-45985", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45985" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2021-45985&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 787 ], "description": "In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read.", "published": "2023-04-10T09:15:07Z", "updated": "2024-11-21T06:33:25Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "The code that triggers the vulnerability is not present in Connext.", "firstIssued": "2023-04-20T20:18:32.307000Z", "lastUpdated": "2023-07-17T10:50:34.215000Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-95" }, { "name": "xray_id", "value": "XRAY-513829" } ] }, { "bom-ref": "CVE-2022-28805", "id": "CVE-2022-28805", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28805" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2022-28805&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H&version=3.1" }, "score": 9.1, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2022-28805&vector=(AV:N/AC:L/Au:N/C:P/I:N/A:P)&version=2" }, "score": 6.4, "severity": "medium", "method": "CVSSv2", "vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:P" } ], "cwes": [ 125 ], "description": "singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.", "published": "2022-04-08T06:15:07Z", "updated": "2024-11-21T06:57:57Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "The code path that leads to the vulnerability is not reachable in our usage of Lua.", "firstIssued": "2023-01-16T12:06:31.575000Z", "lastUpdated": "2023-01-24T12:13:58.073000Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-50" }, { "name": "xray_id", "value": "XRAY-203400" } ] }, { "bom-ref": "CVE-2022-31631", "id": "CVE-2022-31631", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31631" }, "ratings": [ { "source": { "name": "security@php.net" }, "score": 9.1, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "cwes": [ 74 ], "description": "In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.", "published": "2025-02-12T22:15:29Z", "updated": "2025-07-02T21:35:56Z", "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This issue affects the SQLite Driver used by PHP. The vulnerability does not originate from the SQLite3 library itself, but from the way it is being used. The sqlite3_snprintf() function from the SQLite3 library expects an int parameter to specify the buffer size. However, the PHP SQLite driver passes a size_t value, which on a 64-bit system can be larger than the maximum value of an int, leading to a potential overflow. Connext Pro does not directly call sqlite3_snprintf(). This function is only invoked via the SQLite3 library, which correctly manages its buffer sizes to prevent the integer overflow described, ensuring that this vulnerability is not applicable.", "firstIssued": "2025-07-10T13:37:13Z", "lastUpdated": "2025-07-10T13:37:13Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-375" }, { "name": "xray_id", "value": "XRAY-707596" } ] }, { "bom-ref": "CVE-2022-33099", "id": "CVE-2022-33099", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-33099" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2022-33099&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2022-33099&vector=(AV:N/AC:L/Au:N/C:N/I:N/A:P)&version=2" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P" } ], "cwes": [ 787 ], "description": "An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs.", "published": "2022-07-01T12:15:08Z", "updated": "2024-11-21T07:07:32Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "The code that triggers the vulnerability is not present in Connext.", "firstIssued": "2022-10-05T13:24:28.660000Z", "lastUpdated": "2022-10-19T11:20:02.434000Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-32" }, { "name": "xray_id", "value": "XRAY-230272" } ] }, { "bom-ref": "CVE-2022-37434", "id": "CVE-2022-37434", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37434" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2022-37434&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H&version=3.1" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 787 ], "description": "zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).", "published": "2022-08-05T07:15:07Z", "updated": "2024-11-21T07:14:59Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Connext is not affected since we are not using inflateGetHeader function from the zlib library.", "firstIssued": "2023-04-26T13:47:24.750000Z", "lastUpdated": "2023-06-26T14:05:02.317000Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-81" }, { "name": "xray_id", "value": "XRAY-248499" } ] }, { "bom-ref": "CVE-2023-23088", "id": "CVE-2023-23088", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23088" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2023-23088&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H&version=3.1" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 787 ], "description": "Buffer OverFlow Vulnerability in Barenboim json-parser master and v1.1.0 fixed in v1.1.1 allows an attacker to execute arbitrary code via the json_value_parse function.", "published": "2023-02-03T18:15:17Z", "updated": "2024-11-21T07:45:51Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "We don't use Barenboim json-parser in our code base. The code impacted code is not present in our codebase.", "firstIssued": "2024-05-03T14:43:35.976000Z", "lastUpdated": "2024-07-31T21:16:11.149000Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-200" }, { "name": "xray_id", "value": "XRAY-593528" } ] }, { "bom-ref": "CVE-2023-35116", "id": "CVE-2023-35116", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35116" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2023-35116&vector=AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H&version=3.1" }, "score": 4.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 770 ], "description": "jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker.", "published": "2023-06-14T14:15:10Z", "updated": "2024-11-21T08:07:58Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Connext Professional is not affected as this vulnerability has been identified as a false positive.", "firstIssued": "2024-03-07T18:02:19.418000Z", "lastUpdated": "2026-03-10T14:32:17Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-117" }, { "name": "xray_id", "value": "XRAY-522015" } ] }, { "bom-ref": "CVE-2023-45853", "id": "CVE-2023-45853", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45853" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2023-45853&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H&version=3.1" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "CISA-ADP", "url": "https://github.com/cisagov/vulnrichment/blob/develop/2023/45xxx/CVE-2023-45853.json" }, "score": 8.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "cwes": [ 190 ], "description": "MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.", "published": "2023-10-14T02:15:09Z", "updated": "2024-12-20T17:41:31Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "No. The affected code is https://github.com/madler/zlib/blob/develop/contrib/minizip/zip.c#L1016C20-L1016C43 . We do not use MiniZip in our code. There is no `contrib` or `minizip` folder in our codebase.", "firstIssued": "2024-03-05T13:34:45.109000Z", "lastUpdated": "2024-07-31T08:52:59.634000Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-202" }, { "name": "xray_id", "value": "XRAY-533513" } ] }, { "bom-ref": "CVE-2024-47554", "id": "CVE-2024-47554", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47554" }, "ratings": [ { "source": { "name": "CISA-ADP", "url": "https://github.com/cisagov/vulnrichment/blob/develop/2024/47xxx/CVE-2024-47554.json" }, "score": 4.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" } ], "cwes": [ 400 ], "description": "Uncontrolled Resource Consumption vulnerability in Apache Commons IO.\n\nThe org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.\n\n\nThis issue affects Apache Commons IO: from 2.0 before 2.14.0.\n\nUsers are recommended to upgrade to version 2.14.0 or later, which fixes the issue.", "published": "2024-10-03T12:15:02Z", "updated": "2024-12-04T15:15:11Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Connext does not use the impacted component.", "firstIssued": "2024-11-25T12:06:41.884000Z", "lastUpdated": "2024-11-27T15:37:49.870000Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-277" }, { "name": "xray_id", "value": "XRAY-645644" } ] }, { "bom-ref": "CVE-2025-10966", "id": "CVE-2025-10966", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10966" }, "ratings": [ { "source": { "name": "CISA-ADP", "url": "https://github.com/cisagov/vulnrichment/blob/develop/2025/10xxx/CVE-2025-10966.json" }, "score": 4.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "description": "curl's code for managing SSH connections when SFTP was done using the wolfSSH\npowered backend was flawed and missed host verification mechanisms.\n\nThis prevents curl from detecting MITM attackers and more.", "published": "2025-11-07T08:15:39Z", "updated": "2025-11-12T16:20:22Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "We are not affected because this CVE only affects curl when built with the wolfSSL backend. The curl built for use with Collector Service is only built with OpenSSL.", "firstIssued": "2025-12-18T14:52:02Z", "lastUpdated": "2025-12-18T14:52:02Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-452" }, { "name": "xray_id", "value": "XRAY-740917" } ] }, { "bom-ref": "CVE-2025-11226", "id": "CVE-2025-11226", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11226" }, "ratings": [ { "source": { "name": "vulnerability@ncsc.ch" }, "score": 5.9, "severity": "medium", "method": "CVSSv4", "vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:M/U:Green" } ], "cwes": [ 20 ], "description": "ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.\n\n\n\nA successful attack requires the presence of Janino library and Spring Framework to be present on the user's class path. In addition, the attacker must\u00a0 have write access to a \nconfiguration file. Alternatively, the attacker could inject a malicious \nenvironment variable pointing to a malicious configuration file. In both \ncases, the attack requires existing privilege.", "published": "2025-10-01T08:15:31Z", "updated": "2025-10-31T15:15:41Z", "recommendation": "Enforce least-privilege principles on systems running Connext, protecting Connext applications from unauthorized modification or access.", "analysis": { "state": "exploitable", "detail": "RTI Admin Console is affected by product issue ADMINCONSOLE-1499, which has a maximum CVSS 3.1 score of 5.3.", "firstIssued": "2025-11-17T09:29:26Z", "lastUpdated": "2025-11-17T09:29:26Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-440" }, { "name": "xray_id", "value": "XRAY-736604" }, { "name": "rti_vulnerability_id", "value": "ADMINCONSOLE-1499" } ] }, { "bom-ref": "CVE-2025-11563", "id": "CVE-2025-11563", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11563" }, "ratings": [ { "source": { "name": "CISA-ADP", "url": "https://github.com/cisagov/vulnrichment/blob/develop/2025/11xxx/CVE-2025-11563.json" }, "score": 4.6, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N" } ], "cwes": [ 22 ], "description": "URLs containing percent-encoded slashes (`/` or `\\`) can trick wcurl into\nsaving the output file outside of the current directory without the user\nexplicitly asking for it.\n\nThis flaw only affects the wcurl command line tool.", "published": "2026-02-25T08:16:18Z", "updated": "2026-02-26T20:06:37Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "We are not affected by this vulnerability as it only affects the wcurl command line tool which we do not use.", "firstIssued": "2026-03-04T15:10:43Z", "lastUpdated": "2026-03-04T15:10:43Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-538" }, { "name": "xray_id", "value": "XRAY-946392" } ] }, { "bom-ref": "CVE-2025-13034", "id": "CVE-2025-13034", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13034" }, "ratings": [ { "source": { "name": "CISA-ADP", "url": "https://github.com/cisagov/vulnrichment/blob/develop/2025/13xxx/CVE-2025-13034.json" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "cwes": [ 295 ], "description": "When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool,curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification.", "published": "2026-01-08T10:15:45Z", "updated": "2026-01-20T14:54:02Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "The Collector Service is not built with the GnuTLS backend.", "firstIssued": "2026-02-11T19:19:20Z", "lastUpdated": "2026-02-11T19:19:20Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-488" }, { "name": "xray_id", "value": "XRAY-930567" } ] }, { "bom-ref": "CVE-2025-14017", "id": "CVE-2025-14017", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14017" }, "ratings": [ { "source": { "name": "CISA-ADP", "url": "https://github.com/cisagov/vulnrichment/blob/develop/2025/14xxx/CVE-2025-14017.json" }, "score": 6.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "description": "When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well.", "published": "2026-01-08T10:15:45Z", "updated": "2026-01-27T21:29:39Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "The Collector Service does not use LDAP.", "firstIssued": "2026-02-11T19:12:21Z", "lastUpdated": "2026-02-11T19:12:21Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-488" }, { "name": "xray_id", "value": "XRAY-930568" } ] }, { "bom-ref": "CVE-2025-14524", "id": "CVE-2025-14524", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14524" }, "ratings": [ { "source": { "name": "CISA-ADP", "url": "https://github.com/cisagov/vulnrichment/blob/develop/2025/14xxx/CVE-2025-14524.json" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "cwes": [ 601 ], "description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.", "published": "2026-01-08T10:15:46Z", "updated": "2026-01-20T14:53:11Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "The Collector Service only uses basic authentication.", "firstIssued": "2026-02-11T19:04:50Z", "lastUpdated": "2026-02-11T19:04:50Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-488" }, { "name": "xray_id", "value": "XRAY-930569" } ] }, { "bom-ref": "CVE-2025-14813", "id": "CVE-2025-14813", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813" }, "ratings": [ { "source": { "name": "91579145-5d7b-4cc5-b925-a0262ff19630" }, "score": 9.3, "severity": "critical", "method": "CVSSv4", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Red" } ], "cwes": [ 327 ], "description": "Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher.\n\nGOSTCTR implementation unable to process more than 255 blocks correctly.\n\n\nThis issue affects BC-JAVA: from 1.59 before 1.84.", "published": "2026-04-15T10:16:38Z", "updated": "2026-04-17T15:38:09Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "The affected component is the GOST CTR (G3413CTRBlockCipher) implementation within Bouncy Castle. While Admin Console includes Bouncy Castle version 1.80 as a transitive dependency via the Eclipse/OSGi platform, the application is not affected. Neither the Bouncy Castle library nor any of its classes are imported, invoked, or utilized anywhere within our codebase. Furthermore, there are no references to G3413CTRBlockCipher or any Russian cryptographic standards in our system, rendering the vulnerability completely unexploitable in our environment.", "firstIssued": "2026-05-18T08:26:52Z", "lastUpdated": "2026-05-18T08:26:52Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-574" }, { "name": "xray_id", "value": "XRAY-965522" } ] }, { "bom-ref": "CVE-2025-14819", "id": "CVE-2025-14819", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14819" }, "ratings": [ { "source": { "name": "CISA-ADP", "url": "https://github.com/cisagov/vulnrichment/blob/develop/2025/14xxx/CVE-2025-14819.json" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "cwes": [ 295 ], "description": "When doing TLS related transfers with reused easy or multi handles and\naltering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user's wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.", "published": "2026-01-08T10:15:46Z", "updated": "2026-01-20T14:51:26Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "The Collector Service does not use the CURLSSLOPT_NO_PARTIALCHAIN option.", "firstIssued": "2026-02-11T19:03:13Z", "lastUpdated": "2026-02-11T19:03:13Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-488" }, { "name": "xray_id", "value": "XRAY-930570" } ] }, { "bom-ref": "CVE-2025-15079", "id": "CVE-2025-15079", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15079" }, "ratings": [ { "source": { "name": "CISA-ADP", "url": "https://github.com/cisagov/vulnrichment/blob/develop/2025/15xxx/CVE-2025-15079.json" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "cwes": [ 297 ], "description": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.", "published": "2026-01-08T10:15:47Z", "updated": "2026-01-20T14:50:24Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "The Collector Service does not use SFTP or SCP.", "firstIssued": "2026-02-11T19:13:32Z", "lastUpdated": "2026-02-11T19:13:32Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-488" }, { "name": "xray_id", "value": "XRAY-930571" } ] }, { "bom-ref": "CVE-2025-15224", "id": "CVE-2025-15224", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15224" }, "ratings": [ { "source": { "name": "CISA-ADP", "url": "https://github.com/cisagov/vulnrichment/blob/develop/2025/15xxx/CVE-2025-15224.json" }, "score": 3.1, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N" } ], "cwes": [ 287 ], "description": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.", "published": "2026-01-08T10:15:47Z", "updated": "2026-01-20T14:47:52Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "The Collector Service does not use SFTP or SCP.", "firstIssued": "2026-02-11T19:20:21Z", "lastUpdated": "2026-02-11T19:20:21Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-488" }, { "name": "xray_id", "value": "XRAY-930572" } ] }, { "bom-ref": "CVE-2025-30749", "id": "CVE-2025-30749", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30749" }, "ratings": [ { "source": { "name": "secalert_us@oracle.com" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "description": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).", "published": "2025-07-15T20:15:29Z", "updated": "2025-08-04T21:05:34Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "This vulnerability does not affect Admin Console because the product does not run untrusted Java code. The only untrusted code that Admin Console runs is python code provided by the user and executed in an isolated Python thread. It is not possible for the user to execute untrusted code within Admin Console's java code base.", "firstIssued": "2025-08-18T09:46:47Z", "lastUpdated": "2025-08-18T09:46:47Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-399" }, { "name": "xray_id", "value": "XRAY-713435" } ] }, { "bom-ref": "CVE-2025-30754", "id": "CVE-2025-30754", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30754" }, "ratings": [ { "source": { "name": "secalert_us@oracle.com" }, "score": 4.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "cwes": [ 284 ], "description": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).", "published": "2025-07-15T20:15:29Z", "updated": "2025-08-04T21:16:20Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "This vulnerability does not affect Admin Console because the product does not run untrusted Java code. The only untrusted code that Admin Console runs is python code provided by the user and executed in an isolated Python thread. It is not possible for the user to execute untrusted code within Admin Console's java code base.", "firstIssued": "2025-08-18T09:50:00Z", "lastUpdated": "2025-08-18T09:50:00Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-399" }, { "name": "xray_id", "value": "XRAY-713439" } ] }, { "bom-ref": "CVE-2025-48924", "id": "CVE-2025-48924", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48924" }, "ratings": [ { "source": { "name": "CISA-ADP", "url": "https://github.com/cisagov/vulnrichment/blob/develop/2025/48xxx/CVE-2025-48924.json" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 674 ], "description": "Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with\u00a0commons-lang:commons-lang\u00a02.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before\u00a03.18.0.\n\nThe methods ClassUtils.getClass(...) can throw\u00a0StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could\u00a0cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue.", "published": "2025-07-11T15:15:24Z", "updated": "2025-07-28T13:45:38Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "No RTI Connext products invoke the impacted function ClassUtils.getClass, either within the RTI tools' direct source code or in any plugin dependencies.", "firstIssued": "2025-08-07T10:51:16Z", "lastUpdated": "2025-08-07T10:51:16Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-378" }, { "name": "xray_id", "value": "XRAY-710140" } ] }, { "bom-ref": "CVE-2025-50059", "id": "CVE-2025-50059", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50059" }, "ratings": [ { "source": { "name": "secalert_us@oracle.com" }, "score": 8.6, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" } ], "cwes": [ 284 ], "description": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).", "published": "2025-07-15T20:15:40Z", "updated": "2025-08-04T21:17:16Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "This vulnerability does not affect Admin Console because the product does not run untrusted Java code. The only untrusted code that Admin Console runs is python code provided by the user and executed in an isolated Python thread. It is not possible for the user to execute untrusted code within Admin Console's java code base.", "firstIssued": "2025-08-18T09:49:24Z", "lastUpdated": "2025-08-18T09:49:24Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-399" }, { "name": "xray_id", "value": "XRAY-713437" } ] }, { "bom-ref": "CVE-2025-50106", "id": "CVE-2025-50106", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50106" }, "ratings": [ { "source": { "name": "secalert_us@oracle.com" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "description": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).", "published": "2025-07-15T20:15:47Z", "updated": "2025-08-04T21:20:26Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "This vulnerability does not affect Admin Console because the product does not run untrusted Java code. The only untrusted code that Admin Console runs is python code provided by the user and executed in an isolated Python thread. It is not possible for the user to execute untrusted code within Admin Console's java code base.", "firstIssued": "2025-08-18T09:50:35Z", "lastUpdated": "2025-08-18T09:50:35Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-399" }, { "name": "xray_id", "value": "XRAY-713440" } ] }, { "bom-ref": "CVE-2026-0636", "id": "CVE-2026-0636", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636" }, "ratings": [ { "source": { "name": "91579145-5d7b-4cc5-b925-a0262ff19630" }, "score": 5.5, "severity": "medium", "method": "CVSSv4", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:X/RE:M/U:Amber" } ], "cwes": [ 90 ], "description": "Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper.\n\nThis issue affects BC-JAVA: from 1.74 before 1.84.", "published": "2026-04-15T10:16:38Z", "updated": "2026-04-17T15:38:09Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "LDAP injection vulnerability within Bouncy Castle's LDAPStoreHelper is not exploitable in Admin Console. Although Bouncy Castle is present as a transitive dependency via the Eclipse/OSGi platform, the application's code and configuration do not invoke its LDAP store or query APIs. Furthermore, Admin Console does not configure LDAP query endpoints nor register provider paths that would route certificate retrieval through the vulnerable helper class. Because no untrusted input can reach or construct queries within this component, the necessary execution paths do not exist, rendering the vulnerability as unexploitable.", "firstIssued": "2026-05-18T08:45:21Z", "lastUpdated": "2026-05-18T08:45:21Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-574" }, { "name": "xray_id", "value": "XRAY-966311" } ] }, { "bom-ref": "CVE-2026-1225", "id": "CVE-2026-1225", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1225" }, "ratings": [ { "source": { "name": "vulnerability@ncsc.ch" }, "score": 1.8, "severity": "low", "method": "CVSSv4", "vector": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:X/RE:M/U:Green" } ], "cwes": [ 20 ], "description": "ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file.\n\n\n\n\nThe instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a \nconfiguration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.", "published": "2026-01-22T10:16:07Z", "updated": "2026-01-26T15:04:59Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "The affected third-party library code is never loaded by Admin Console during use so the vulnerability cannot be exploited.", "firstIssued": "2026-02-18T20:46:30Z", "lastUpdated": "2026-02-18T20:46:30Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-502" }, { "name": "xray_id", "value": "XRAY-935054" } ] }, { "bom-ref": "CVE-2026-1965", "id": "CVE-2026-1965", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1965" }, "ratings": [ { "source": { "name": "CISA-ADP", "url": "https://github.com/cisagov/vulnrichment/blob/develop/2026/1xxx/CVE-2026-1965.json" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" } ], "cwes": [ 305 ], "description": "libcurl can in some circumstances reuse the wrong connection when asked to do\nan Negotiate-authenticated HTTP or HTTPS request.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criterion must first be met. Due to a\nlogical error in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials. One underlying reason being that\nNegotiate sometimes authenticates *connections* and not *requests*, contrary\nto how HTTP is designed to work.\n\nAn application that allows Negotiate authentication to a server (that responds\nwanting Negotiate) with `user1:password1` and then does another operation to\nthe same server also using Negotiate but with `user2:password2` (while the\nprevious connection is still alive) - the second request wrongly reused the\nsame connection and since it then sees that the Negotiate negotiation is\nalready made, it just sends the request over that connection thinking it uses\nthe user2 credentials when it is in fact still using the connection\nauthenticated for user1...\n\nThe set of authentication methods to use is set with `CURLOPT_HTTPAUTH`.\n\nApplications can disable libcurl's reuse of connections and thus mitigate this\nproblem, by using one of the following libcurl options to alter how\nconnections are or are not reused: `CURLOPT_FRESH_CONNECT`,\n`CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the\ncurl_multi API).", "published": "2026-03-11T11:15:59Z", "updated": "2026-03-12T14:11:19Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "The Collector Service only uses a single set of credentials when making HTTPS requests.", "firstIssued": "2026-03-19T18:53:12Z", "lastUpdated": "2026-03-19T18:53:12Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-540" }, { "name": "xray_id", "value": "XRAY-950705" } ] }, { "bom-ref": "CVE-2026-3505", "id": "CVE-2026-3505", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505" }, "ratings": [ { "source": { "name": "91579145-5d7b-4cc5-b925-a0262ff19630" }, "score": 8.7, "severity": "high", "method": "CVSSv4", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "cwes": [ 400, 770 ], "description": "Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java.\n\nThis issue affects BC-JAVA: from 1.74 before 1.84.", "published": "2026-04-15T10:16:49Z", "updated": "2026-04-21T17:16:53Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "The affected component is the OpenPGP module (bcpg) within Bouncy Castle, specifically regarding its handling of AEAD-encrypted PGP packets. While Admin Console includes bcpg-jdk18on version 1.80 as a transitive dependency via the Eclipse/OSGi platform, the application is not affected. The core codebase does not utilize any PGP or OpenPGP functionality. The module's only consumer is the Eclipse p2 framework for verifying signed plugins; however, this feature is strictly restricted and entirely inaccessible to end-users in the shipped product. Because users cannot install or update plugins, the required execution path cannot be triggered, rendering the vulnerability unexploitable in production environments.", "firstIssued": "2026-05-18T08:38:11Z", "lastUpdated": "2026-05-18T08:38:11Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-574" }, { "name": "xray_id", "value": "XRAY-965523" } ] }, { "bom-ref": "CVE-2026-3783", "id": "CVE-2026-3783", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3783" }, "ratings": [ { "source": { "name": "CISA-ADP", "url": "https://github.com/cisagov/vulnrichment/blob/develop/2026/3xxx/CVE-2026-3783.json" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "cwes": [ 522 ], "description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.", "published": "2026-03-11T11:16:00Z", "updated": "2026-03-12T14:10:37Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "The Collector Service does not use OAuth2 tokens.", "firstIssued": "2026-03-19T18:51:23Z", "lastUpdated": "2026-03-19T18:51:23Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-540" }, { "name": "xray_id", "value": "XRAY-950704" } ] }, { "bom-ref": "CVE-2026-3784", "id": "CVE-2026-3784", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3784" }, "ratings": [ { "source": { "name": "CISA-ADP", "url": "https://github.com/cisagov/vulnrichment/blob/develop/2026/3xxx/CVE-2026-3784.json" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "cwes": [ 305 ], "description": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a\nserver, even if the new request uses different credentials for the HTTP proxy.\nThe proper behavior is to create or use a separate connection.", "published": "2026-03-11T11:16:00Z", "updated": "2026-03-12T14:09:50Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "When Collector Service uses curl to connect to a server, only one set of credentials is used.", "firstIssued": "2026-03-19T18:47:16Z", "lastUpdated": "2026-03-19T18:47:16Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-540" }, { "name": "xray_id", "value": "XRAY-950702" } ] }, { "bom-ref": "CVE-2026-3805", "id": "CVE-2026-3805", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3805" }, "ratings": [ { "source": { "name": "CISA-ADP", "url": "https://github.com/cisagov/vulnrichment/blob/develop/2026/3xxx/CVE-2026-3805.json" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 416 ], "description": "When doing a second SMB request to the same host again, curl would wrongly use\na data pointer pointing into already freed memory.", "published": "2026-03-11T11:16:00Z", "updated": "2026-03-12T14:08:56Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "The Collector Service does not use the SMB protocol.", "firstIssued": "2026-03-19T18:48:55Z", "lastUpdated": "2026-03-19T18:48:55Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-540" }, { "name": "xray_id", "value": "XRAY-950703" } ] }, { "bom-ref": "CVE-2026-5598", "id": "CVE-2026-5598", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5598" }, "ratings": [ { "source": { "name": "91579145-5d7b-4cc5-b925-a0262ff19630" }, "score": 8.9, "severity": "high", "method": "CVSSv4", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:Red" } ], "cwes": [ 385 ], "description": "Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java.\n\nThis issue affects BC-JAVA: from 1.71 before 1.84.", "published": "2026-04-15T10:16:49Z", "updated": "2026-04-21T16:16:20Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Although Bouncy Castle is included as a transitive dependency via the Eclipse/OSGi platform, the application's codebase contains no references to PQC or Frodo APIs. Because this functionality is neither present nor invoked anywhere within the application workflow, the affected cryptographic operations cannot be executed or observed by an attacker, rendering the vulnerability as unreachable and unexploitable.", "firstIssued": "2026-05-18T08:43:06Z", "lastUpdated": "2026-05-18T08:43:06Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-574" }, { "name": "xray_id", "value": "XRAY-965524" } ] }, { "bom-ref": "CVE-2026-9828", "id": "CVE-2026-9828", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9828" }, "ratings": [ { "source": { "name": "vulnerability@ncsc.ch" }, "score": 2.9, "severity": "low", "method": "CVSSv4", "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:L/U:Green" } ], "cwes": [ 502 ], "description": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted.\n\nMore precisely, an attacker able to influence serialized data sent to \nSimpleSocketServer or SimpleSSLSocketServer can instantiate objects from\n classes in the java.lang and java.util packages that are not explicitly\n blocked.\n\nAlthough deserialization is heavily restricted by HardenedObjectInputStream and no \npractical way to achieve remote code execution or significant privilege \nescalation has been identified, this issue constitutes a bypass of the \nintended security restrictions.\n\n\n\nThis issue affects logback: through 1.5.32 inclusive.", "published": "2026-05-28T14:16:27Z", "updated": "2026-06-17T11:05:40Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "RTI Admin Console is not affected by this vulnerability. To exploit this vulnerability, it is required to have SimpleSocketServer or SimpleSSLSocketServer running and reachable on the network. Those are absent on RTI Admin Console, and the application does not use, configure, or invoke any logback socket server components, so this vulnerability is not reachable.", "firstIssued": "2026-07-15T07:30:15Z", "lastUpdated": "2026-07-15T07:30:15Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-629" }, { "name": "xray_id", "value": "XRAY-1017552" } ] }, { "bom-ref": "CVE-2026-10532", "id": "CVE-2026-10532", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10532" }, "ratings": [ { "source": { "name": "vulnerability@ncsc.ch" }, "score": 2.9, "severity": "low", "method": "CVSSv4", "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Green" } ], "cwes": [ 502 ], "description": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection, albeit heavily restricted.\n\nMore precisely, an attacker able to influence serialized data sent to \nSimpleSocketServer or SimpleSSLSocketServer can instantiate Proxy objects.\n\n\nAlthough deserialization is heavily restricted by HardenedObjectInputStream and no \npractical way to achieve remote code execution or significant privilege \nescalation has been identified, this issue constitutes a bypass of the \nintended security restrictions.\n\n\n\nThis issue affects logback: through 1.5.33 inclusive.", "published": "2026-06-01T13:16:30Z", "updated": "2026-06-17T10:12:22Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "RTI Admin Console is not affected by this vulnerability. This vulnerability is a deserialization bypass in logback's HardenedObjectInputStream, exploitable only when SimpleSocketServer or SimpleSSLSocketServer is actively running and reachable on the network. RTI Admin Console does not start, configure, or reference these socket server components anywhere in its codebase.", "firstIssued": "2026-07-15T07:30:48Z", "lastUpdated": "2026-07-15T07:30:48Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-629" }, { "name": "xray_id", "value": "XRAY-1021727" } ] }, { "bom-ref": "CVE-2026-11822", "id": "CVE-2026-11822", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11822" }, "ratings": [ { "source": { "name": "disclosure@vulncheck.com" }, "score": 8.5, "severity": "high", "method": "CVSSv4", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": { "name": "disclosure@vulncheck.com" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "cwes": [ 122 ], "description": "SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.", "published": "2026-06-09T20:16:32Z", "updated": "2026-06-11T17:12:47Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "The vulnerability requires the FTS5 extension (the root vector of the issue), which must be explicitly enabled at compile time using the SQLITE_ENABLE_FTS5 definition. Because FTS5 is disabled by default and our build system does not enable it, we are not vulnerable.", "firstIssued": "2026-06-16T10:15:15Z", "lastUpdated": "2026-06-16T10:15:15Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-603" }, { "name": "xray_id", "value": "XRAY-999361" } ] }, { "bom-ref": "CVE-2026-11824", "id": "CVE-2026-11824", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824" }, "ratings": [ { "source": { "name": "disclosure@vulncheck.com" }, "score": 8.5, "severity": "high", "method": "CVSSv4", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": { "name": "disclosure@vulncheck.com" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "cwes": [ 122 ], "description": "SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.", "published": "2026-06-09T20:16:32Z", "updated": "2026-06-11T17:12:11Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "The vulnerability requires the FTS5 extension (the root vector of the issue), which must be explicitly enabled at compile time using the SQLITE_ENABLE_FTS5 definition. Because FTS5 is disabled by default and our build system does not enable it, we are not vulnerable.", "firstIssued": "2026-06-16T10:18:10Z", "lastUpdated": "2026-06-16T10:18:10Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-603" }, { "name": "xray_id", "value": "XRAY-999364" } ] }, { "bom-ref": "CVE-2026-22184", "id": "CVE-2026-22184", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22184" }, "ratings": [ { "source": { "name": "disclosure@vulncheck.com" }, "score": 4.6, "severity": "medium", "method": "CVSSv4", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2026-22184&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H&version=3.1" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 787 ], "description": "zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.", "published": "2026-01-07T21:16:01Z", "updated": "2026-01-15T14:16:27Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "The untgz code is not present in the Core Libraries.", "firstIssued": "2026-01-22T15:19:51Z", "lastUpdated": "2026-01-22T15:19:51Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-493" }, { "name": "xray_id", "value": "XRAY-932447" } ] }, { "bom-ref": "CVE-2026-27171", "id": "CVE-2026-27171", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27171" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2026-27171&vector=AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H&version=3.1" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "cve@mitre.org" }, "score": 2.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 1284 ], "description": "zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.", "published": "2026-02-18T04:16:01Z", "updated": "2026-02-20T16:45:28Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Connext does not use crc32_combine64 or crc32_combine_gen64 from the zlib library.", "firstIssued": "2026-02-23T19:37:36Z", "lastUpdated": "2026-02-23T19:37:36Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-536" }, { "name": "xray_id", "value": "XRAY-945094" } ] }, { "bom-ref": "CVE-2026-54512", "id": "CVE-2026-54512", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512" }, "ratings": [ { "source": { "name": "security-advisories@github.com" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 184, 502 ], "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container \u2014 for example java.util.ArrayList when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.", "published": "2026-06-23T21:17:02Z", "updated": "2026-06-27T21:01:36Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "RTI Admin Console is not affected because the vulnerability requires polymorphic typing to be enabled, and our codebase does not enable this feature anywhere. All ObjectMapper instances use default safe configuration without enableDefaultTyping(), @JsonTypeInfo annotations, or any polymorphic type handling. The vulnerable code path cannot be reached.", "firstIssued": "2026-06-30T11:55:24Z", "lastUpdated": "2026-06-30T11:55:24Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-608" }, { "name": "xray_id", "value": "XRAY-1008324" } ] }, { "bom-ref": "CVE-2026-54513", "id": "CVE-2026-54513", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54513" }, "ratings": [ { "source": { "name": "security-advisories@github.com" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 184 ], "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.", "published": "2026-06-23T21:17:02Z", "updated": "2026-06-30T03:21:03Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "RTI Admin Console is not affected by this vulnerability as, to be exploited, it is required to use both the BasicPolymorphicTypeValidator and enable polymorphic typing. However, Admin Console is not using this functionality and it is not present in the code base. There is no code path to be reached that could be exploitable.", "firstIssued": "2026-06-30T11:58:45Z", "lastUpdated": "2026-06-30T11:58:45Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-608" }, { "name": "xray_id", "value": "XRAY-1008325" } ] }, { "bom-ref": "CVE-2026-54514", "id": "CVE-2026-54514", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54514" }, "ratings": [ { "source": { "name": "security-advisories@github.com" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "cwes": [ 918 ], "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.", "published": "2026-06-23T21:17:02Z", "updated": "2026-06-27T20:55:09Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "RTI Admin Console is not affected by this vulnerability as this vulnerability only triggers when deserializing JSON into objects containing InetSocketAddress fields. However, Admin Console is not using InetSocketAddress in this code and no class contains an instance of InetSocketAddress, so no path exists to trigger the vulnerability.", "firstIssued": "2026-06-30T11:59:44Z", "lastUpdated": "2026-06-30T11:59:44Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-608" }, { "name": "xray_id", "value": "XRAY-1008335" } ] }, { "bom-ref": "CVE-2026-54515", "id": "CVE-2026-54515", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54515" }, "ratings": [ { "source": { "name": "security-advisories@github.com" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "cwes": [ 915 ], "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map \u2014 restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.", "published": "2026-06-23T21:17:02Z", "updated": "2026-06-29T13:38:59Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "RTI Admin Console is not exploitable by this vulnerability as, to exploit this vulnerability, it is required to have both @JsonIgnoreProperties and @JsonFormat with case-insensitive properties. However, this code is not used and is not present in the Admin Console's code base so the vulnerable code path is not reachable.", "firstIssued": "2026-06-30T12:03:37Z", "lastUpdated": "2026-06-30T12:03:37Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-608" }, { "name": "xray_id", "value": "XRAY-1008336" } ] }, { "bom-ref": "GHSA-72hv-8253-57qq", "id": "GHSA-72hv-8253-57qq", "source": { "name": "GHSA", "url": "https://github.com/advisories/GHSA-72hv-8253-57qq" }, "ratings": [ { "source": { "name": "GHSA", "url": "https://github.com/advisories/GHSA-72hv-8253-57qq" }, "severity": "high" } ], "cwes": [ 770 ], "description": "jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition", "published": "2026-02-28T02:01:05Z", "updated": "2026-03-03T16:59:15Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Admin Console is using jackson-core, but it is using the synchronous version of it and not the asynchronous parser that is affected. According to the vulnerability description, the synchronous parser is not affected by this vulnerability, so the vulnerable code is not reachable", "firstIssued": "2026-03-17T11:22:18Z", "lastUpdated": "2026-03-17T11:22:18Z" }, "affects": [ { "ref": "Connext Pro" } ], "properties": [ { "name": "rti_id", "value": "THIRDPARTY-539" }, { "name": "xray_id", "value": "XRAY-947687" } ] } ] }