fad-checker 2.1.1 → 2.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/README.md +7 -12
  2. package/fad-checker-report/cve-report.doc +643 -105
  3. package/fad-checker-report/cve-report.html +653 -108
  4. package/fad-checker.js +103 -12
  5. package/lib/codecs/index.js +66 -2
  6. package/lib/codecs/maven/jar-scan.js +174 -28
  7. package/lib/codecs/maven.codec.js +2 -2
  8. package/lib/codecs/npm/collect.js +3 -1
  9. package/lib/codecs/npm/parse.js +25 -0
  10. package/lib/codecs/npm.codec.js +5 -1
  11. package/lib/core.js +15 -0
  12. package/lib/cve-report.js +3 -1
  13. package/lib/license-policy.js +3 -1
  14. package/lib/outdated.js +3 -0
  15. package/lib/parallel-walk.js +47 -0
  16. package/package.json +1 -1
package/fad-checker-report/cve-report.html CHANGED
@@ -232,28 +232,31 @@ tr.detail-row > td { padding: 0; border-bottom: 2px solid #c7d2fe; background: #
232
232
  <h1>FAD-Checker Report</h1>
233
233
  <div class="report-subtitle">Multi-ecosystem dependency security audit</div>
234
234
  <div class="meta">
235
- Project: <strong>emb</strong> · <code class="path">/tmp/emb</code><br>
236
- Generated: 2026-06-01T11:50:17.518Z · fad-checker 2.0.2 · CVE data: 2026-06-01T09:36:42.393Z
235
+ Project: <strong>monorepo-mixed</strong> · <code class="path">/mnt/wsl/WipDrive/_libs/fad-checker/test/fixtures/monorepo-mixed</code><br>
236
+ Generated: 2026-06-02T09:07:09.509Z · fad-checker 2.1.1 · CVE data: 2026-06-01T09:36:42.393Z
237
237
  </div>
238
238
  </header>
239
- <div class="exec-summary exec-medium">
239
+ <div class="exec-summary exec-high">
240
240
  <div class="exec-head">
241
- <span class="exec-level">MEDIUM</span>
241
+ <span class="exec-level">HIGH</span>
242
242
  <span class="exec-title">Executive Summary</span>
243
- <button class="btn-copy exec-copy-btn" type="button" title="Copy the executive summary — paste it into Word with formatting preserved">📋 Copy summary</button><template class="exec-copy-rich"><div style="font-family:Calibri,Arial,sans-serif; font-size:11pt; color:#1f2937;"><p style="font-size:14pt; font-weight:bold; margin:0 0 2px;">Executive Summary — MEDIUM</p><p style="margin:0 0 8px; color:#4b5563;">3 dependencies scanned</p><ul style="margin:4px 0 0; padding-left:22px;"><li style="margin:2px 0;">2 CVE in production deps (critical=0, high=0, medium=1, low=1)</li><li style="margin:2px 0;">1 scan-completeness alert — see chapter 0</li></ul></div></template><textarea class="exec-copy-plain" aria-hidden="true" tabindex="-1" style="position:absolute;left:-9999px;top:0;width:1px;height:1px;opacity:0;">EXECUTIVE SUMMARY — MEDIUM
244
- 3 dependencies scanned
243
+ <button class="btn-copy exec-copy-btn" type="button" title="Copy the executive summary — paste it into Word with formatting preserved">📋 Copy summary</button><template class="exec-copy-rich"><div style="font-family:Calibri,Arial,sans-serif; font-size:11pt; color:#1f2937;"><p style="font-size:14pt; font-weight:bold; margin:0 0 2px;">Executive Summary — HIGH</p><p style="margin:0 0 8px; color:#4b5563;">23 dependencies scanned</p><ul style="margin:4px 0 0; padding-left:22px;"><li style="margin:2px 0;">3 CVE in production deps (critical=0, high=0, medium=3, low=0)</li><li style="margin:2px 0;">1 end-of-life framework</li><li style="margin:2px 0;">1 obsolete / deprecated lib</li><li style="margin:2px 0;">5 outdated libs</li><li style="margin:2px 0;">1 scan-completeness alert — see chapter 0</li></ul></div></template><textarea class="exec-copy-plain" aria-hidden="true" tabindex="-1" style="position:absolute;left:-9999px;top:0;width:1px;height:1px;opacity:0;">EXECUTIVE SUMMARY — HIGH
244
+ 23 dependencies scanned
245
245
 
246
- - 2 CVE in production deps (critical=0, high=0, medium=1, low=1)
246
+ - 3 CVE in production deps (critical=0, high=0, medium=3, low=0)
247
+ - 1 end-of-life framework
248
+ - 1 obsolete / deprecated lib
249
+ - 5 outdated libs
247
250
  - 1 scan-completeness alert — see chapter 0</textarea>
248
251
  </div>
249
- <div class="exec-meta">3 dependencies scanned</div>
252
+ <div class="exec-meta">23 dependencies scanned</div>
250
253
  <ul class="exec-bullets">
251
- <li><strong>2</strong> CVE in production deps (critical=0, high=0, medium=1, low=1)</li><li><strong>1</strong> scan-completeness alert — see chapter 0</li>
254
+ <li><strong>3</strong> CVE in production deps (critical=0, high=0, medium=3, low=0)</li><li><strong>1</strong> end-of-life framework</li><li><strong>1</strong> obsolete / deprecated lib</li><li><strong>5</strong> outdated libs</li><li><strong>1</strong> scan-completeness alert — see chapter 0</li>
252
255
  </ul>
253
256
 
254
257
  </div>
255
- <div class="summary"><div class="card sev-critical"><div class="v">0</div><div class="l">Critical</div></div><div class="card sev-high"><div class="v">0</div><div class="l">High</div></div><div class="card sev-medium"><div class="v">1</div><div class="l">Medium</div></div><div class="card sev-low"><div class="v">1</div><div class="l">Low</div></div><div class="card"><div class="v">2</div><div class="l">Total CVEs</div></div><div class="card"><div class="v">2</div><div class="l">in Direct</div></div><div class="card"><div class="v">0</div><div class="l">in Transitive</div></div><div class="card sev-vendored"><div class="v">0</div><div class="l">Vendored JS</div></div><div class="card"><div class="v">0</div><div class="l">EOL</div></div><div class="card"><div class="v">0</div><div class="l">Obsolete</div></div><div class="card"><div class="v">0</div><div class="l">Outdated</div></div><div class="card sev-warn"><div class="v">1</div><div class="l">Scan alerts</div></div></div>
256
- <nav class="toc"><a href="#ch0">0. Warnings</a><a href="#ch1">1. Prod CVE (2)</a><a href="#ch1e">1B. Embedded (3)</a><a href="#ch2">2. Vendored JS (0)</a><a href="#ch3">3. Dev CVE (0)</a><a href="#ch4">4. EOL (0)</a><a href="#ch5">5. Obsolete (0)</a><a href="#ch6">6. Outdated (0)</a><a href="#ch7">7. Licenses (0)</a><a href="#ch8">8. Fix Recos</a></nav>
258
+ <div class="summary"><div class="card sev-critical"><div class="v">0</div><div class="l">Critical</div></div><div class="card sev-high"><div class="v">0</div><div class="l">High</div></div><div class="card sev-medium"><div class="v">3</div><div class="l">Medium</div></div><div class="card sev-low"><div class="v">0</div><div class="l">Low</div></div><div class="card"><div class="v">3</div><div class="l">Total CVEs</div></div><div class="card"><div class="v">3</div><div class="l">in Direct</div></div><div class="card"><div class="v">0</div><div class="l">in Transitive</div></div><div class="card sev-vendored"><div class="v">0</div><div class="l">Vendored JS</div></div><div class="card"><div class="v">1</div><div class="l">EOL</div></div><div class="card"><div class="v">1</div><div class="l">Obsolete</div></div><div class="card"><div class="v">5</div><div class="l">Outdated</div></div><div class="card sev-warn"><div class="v">1</div><div class="l">Scan alerts</div></div></div>
259
+ <nav class="toc"><a href="#ch0">0. Warnings</a><a href="#ch1">1. Prod CVE (3)</a><a href="#ch2">2. Vendored JS (0)</a><a href="#ch3">3. Dev CVE (0)</a><a href="#ch4">4. EOL (1)</a><a href="#ch5">5. Obsolete (1)</a><a href="#ch6">6. Outdated (5)</a><a href="#ch7">7. Licenses (1)</a><a href="#ch8">8. Fix Recos</a></nav>
257
260
  <div class="toolbar">
258
261
  <button class="btn" type="button" data-action="expand-all">⊕ Expand all</button>
259
262
  <button class="btn" type="button" data-action="collapse-all">⊖ Collapse all</button>
@@ -264,68 +267,198 @@ tr.detail-row > td { padding: 0; border-bottom: 2px solid #c7d2fe; background: #
264
267
 
265
268
  <details class="report-section" open id="ch0">
266
269
  <summary><h2>0. Warnings & scan-completeness (1)</h2></summary>
267
- <div><div class="warnings warnings-chapter"><div class="warn-block warn-embedded-jar">
268
- <div class="warn-head">⚠️ <strong>embedded-jar</strong></div>
269
-
270
- <div class="warn-msg">embedded archive with no resolvable Maven coordinate (not scanned): dist/app.jar!/BOOT-INF/lib/mystery.jar</div>
270
+ <div><div class="warnings warnings-chapter"><div class="warn-block warn-no-lockfile">
271
+ <div class="warn-head">⚠️ <strong>JS manifest without lockfile</strong></div>
272
+ <div class="warn-path"><code>packages/no-lock/package.json</code></div>
273
+ <div class="warn-msg">package.json without lockfile — best-effort: 1 pinned dep(s) scanned, 2 range(s) skipped (run &quot;npm install&quot; or &quot;yarn install&quot; for full coverage)</div>
271
274
 
272
275
  </div></div></div>
273
276
  </details>
274
277
  <details class="report-section" open id="ch1">
275
- <summary><h2>1. CVE Vulnerabilities — production (2)</h2></summary>
278
+ <summary><h2>1. CVE Vulnerabilities — production (3)</h2></summary>
276
279
  <div><details class="report-subsection" open>
277
- <summary><h3>1.a Maven (2)</h3></summary>
280
+ <summary><h3>1.a Maven (3)</h3></summary>
278
281
  <div><details class="report-subsection" open>
279
- <summary><h3>1.a.0 All (2)</h3></summary>
282
+ <summary><h3>1.a.0 All (3)</h3></summary>
280
283
  <div><details class="report-subsection" open>
281
- <summary><h3>All — direct (2)</h3></summary>
284
+ <summary><h3>All — direct (3)</h3></summary>
282
285
  <div><div class="table-wrap"><div class="table-actions"><button class="btn-copy" type="button" title="Copy this table — paste it into Word with formatting preserved">📋 Copy table</button></div><table>
283
286
  <thead><tr><th>Priority</th><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th></tr></thead>
284
287
  <tbody><tr class="cve-row">
285
288
  <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span></td>
286
- <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">5.5</div></td>
287
- <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2023-2976" target="_blank">CVE-2023-2976</a><div class="confidence">probable</div></td>
288
- <td class="dep">com.google.guava:<br>guava<br><span style="color:#6b7280">30.0-jre</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code></div></td>
289
- <td class="cwe"><span class="cwe-empty">—</span></td>
290
- <td class="published">—</td>
291
- <td class="desc">Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the defaul…</td>
292
- <td class="dep">32.0.0</td>
293
- <td><span class="source fad">fad</span></td>
289
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
290
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-68161" target="_blank">CVE-2025-68161</a><div class="confidence">exact</div></td>
291
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
292
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
293
+ <td class="published">2025-12-18</td>
294
+ <td class="desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#…</td>
295
+ <td class="dep">2.25.3</td>
296
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
297
+
298
+ </tr>
299
+ <tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
300
+ <div class="panel-title">Description</div>
301
+ <div><div class="full-desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true.
302
+
303
+ This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:
304
+
305
+ * The attacker is able to intercept or redirect network traffic between the client and the log receiver.
306
+ * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).
307
+
308
+
309
+ Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.
310
+
311
+ As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.</div></div>
312
+ </div><div class="panel-block">
313
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
314
+ <div><ul class="cwe-list"><li>
315
+ <a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
316
+ <span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
317
+ </li><li>
318
+ <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
319
+ <span class="cwe-name-inline">— Improper Certificate Validation</span>
320
+ </li></ul></div>
321
+ </div><div class="panel-block">
322
+ <div class="panel-title">Metadata</div>
323
+ <div><div class="kv"><div><label>CVSS:4.0</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 63/100</span></div><div><label>Fix version</label><span>2.25.3</span></div><div><label>Published</label><span>2025-12-18</span></div><div><label>Modified</label><span>2026-01-20</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
324
+ </div><div class="panel-block">
325
+ <div class="panel-title">External links <span class="count">(8)</span></div>
326
+ <div><div class="ref-group">
327
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
328
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4002" target="_blank">https://github.com/apache/logging-log4j2/pull/4002</a></li></ul>
329
+ </div><div class="ref-group">
330
+ <span class="ref-label exploit">Exploit / PoC</span><span style="color:#9ca3af;font-size:11px">1 link</span>
331
+ <ul class="ref-list"><li><a href="https://logging.apache.org/security.html#CVE-2025-68161" target="_blank">https://logging.apache.org/security.html#CVE-2025-68161</a></li></ul>
332
+ </div><div class="ref-group">
333
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
334
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li></ul>
335
+ </div><div class="ref-group">
336
+ <span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">3 links</span>
337
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx" target="_blank">https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx</a></li><li><a href="http://www.openwall.com/lists/oss-security/2025/12/18/1" target="_blank">http://www.openwall.com/lists/oss-security/2025/12/18/1</a></li><li><a href="https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html" target="_blank">https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html</a></li></ul>
338
+ </div><div class="ref-group">
339
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
340
+ <ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName</a></li></ul>
341
+ </div></div>
342
+ </div><div class="panel-block">
343
+ <div class="panel-title">Affected CPE configurations <span class="count">(6)</span></div>
344
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1-rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*</li></ul></div>
345
+ </div><div class="panel-block">
346
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
347
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
348
+ </div></div></td></tr>
349
+ <tr class="cve-row">
350
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 11%</div></td>
351
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.9</div></td>
352
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34480" target="_blank">CVE-2026-34480</a><div class="confidence">exact</div></td>
353
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
354
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-116: Improper Encoding or Escaping of Output">CWE-116</a><div class="cwe-name">Improper Encoding or Escaping of Output</div></td>
355
+ <td class="published">2026-04-10</td>
356
+ <td class="desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#char…</td>
357
+ <td class="dep">2.25.4</td>
358
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
294
359
 
295
360
  </tr>
296
361
  <tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
297
362
  <div class="panel-title">Description</div>
298
- <div><div class="full-desc">Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.
363
+ <div><div class="full-desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters.
364
+
365
+ The impact depends on the StAX implementation in use:
299
366
 
300
- Even though the security vulnerability is fixed in version 32.0.0, we recommend…</div></div>
367
+ * JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
368
+ * Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.
369
+
370
+
371
+ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.</div></div>
372
+ </div><div class="panel-block">
373
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(1)</span></div>
374
+ <div><ul class="cwe-list"><li>
375
+ <a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link">CWE-116</a>
376
+ <span class="cwe-name-inline">— Improper Encoding or Escaping of Output</span>
377
+ </li></ul></div>
301
378
  </div><div class="panel-block">
302
379
  <div class="panel-title">Metadata</div>
303
- <div><div class="kv"><div><label>Base score</label><span>5.5 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 55/100</span></div><div><label>Fix version</label><span>32.0.0</span></div><div><label>Match confidence</label><span>probable</span></div><div><label>Sources</label><span>fad</span></div></div></div>
380
+ <div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.9 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 57.3/100</span></div><div><label>EPSS</label><span>0.0% prob · 11th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-04-24</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
304
381
  </div><div class="panel-block">
305
- <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
306
- <div><div class="via-list"><div>pom.xml</div></div></div>
382
+ <div class="panel-title">External links <span class="count">(6)</span></div>
383
+ <div><div class="ref-group">
384
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
385
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4077" target="_blank">https://github.com/apache/logging-log4j2/pull/4077</a></li></ul>
386
+ </div><div class="ref-group">
387
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
388
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb" target="_blank">https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34480" target="_blank">https://logging.apache.org/security.html#CVE-2026-34480</a></li></ul>
389
+ </div><div class="ref-group">
390
+ <span class="ref-label third-party">Third-party advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
391
+ <ul class="ref-list"><li><a href="http://www.openwall.com/lists/oss-security/2026/04/10/9" target="_blank">http://www.openwall.com/lists/oss-security/2026/04/10/9</a></li></ul>
392
+ </div><div class="ref-group">
393
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
394
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout" target="_blank">https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout</a></li></ul>
395
+ </div></div>
396
+ </div><div class="panel-block">
397
+ <div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
398
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
399
+ </div><div class="panel-block">
400
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
401
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
307
402
  </div></div></td></tr>
308
403
  <tr class="cve-row">
309
- <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#2563eb;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">LOW</span></td>
310
- <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#3b82f6;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">LOW</span><div class="confidence">3.3</div></td>
311
- <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2020-8908" target="_blank">CVE-2020-8908</a><div class="confidence">probable</div></td>
312
- <td class="dep">com.google.guava:<br>guava<br><span style="color:#6b7280">30.0-jre</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code></div></td>
313
- <td class="cwe"><span class="cwe-empty">—</span></td>
314
- <td class="published">—</td>
315
- <td class="desc">A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir()…</td>
316
- <td class="dep">32.0</td>
317
- <td><span class="source fad">fad</span></td>
404
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 12%</div></td>
405
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
406
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34477" target="_blank">CVE-2026-34477</a><div class="confidence">exact</div></td>
407
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
408
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
409
+ <td class="published">2026-04-10</td>
410
+ <td class="desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systempr…</td>
411
+ <td class="dep">2.25.4</td>
412
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
318
413
 
319
414
  </tr>
320
415
  <tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
321
416
  <div class="panel-title">Description</div>
322
- <div><div class="full-desc">A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been…</div></div>
417
+ <div><div class="full-desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the &lt;Ssl&gt; element.
418
+
419
+ Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
420
+
421
+ A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:
422
+
423
+ * An SMTP, Socket, or Syslog appender is in use.
424
+ * TLS is configured via a nested &lt;Ssl&gt; element.
425
+ * The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured.
426
+ This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default.
427
+
428
+ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.</div></div>
429
+ </div><div class="panel-block">
430
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
431
+ <div><ul class="cwe-list"><li>
432
+ <a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
433
+ <span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
434
+ </li><li>
435
+ <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
436
+ <span class="cwe-name-inline">— Improper Certificate Validation</span>
437
+ </li></ul></div>
323
438
  </div><div class="panel-block">
324
439
  <div class="panel-title">Metadata</div>
325
- <div><div class="kv"><div><label>Base score</label><span>3.3 (LOW)</span></div><div><label>Priority</label><span>LOW · 33/100</span></div><div><label>Fix version</label><span>32.0</span></div><div><label>Match confidence</label><span>probable</span></div><div><label>Sources</label><span>fad</span></div></div></div>
440
+ <div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 52.8/100</span></div><div><label>EPSS</label><span>0.0% prob · 12th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-05-06</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
326
441
  </div><div class="panel-block">
327
- <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
328
- <div><div class="via-list"><div>pom.xml</div></div></div>
442
+ <div class="panel-title">External links <span class="count">(5)</span></div>
443
+ <div><div class="ref-group">
444
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
445
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4075" target="_blank">https://github.com/apache/logging-log4j2/pull/4075</a></li></ul>
446
+ </div><div class="ref-group">
447
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
448
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34477" target="_blank">https://logging.apache.org/security.html#CVE-2026-34477</a></li></ul>
449
+ </div><div class="ref-group">
450
+ <span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">1 link</span>
451
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4" target="_blank">https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4</a></li></ul>
452
+ </div><div class="ref-group">
453
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">1 link</span>
454
+ <ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li></ul>
455
+ </div></div>
456
+ </div><div class="panel-block">
457
+ <div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
458
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
459
+ </div><div class="panel-block">
460
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
461
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
329
462
  </div></div></td></tr></tbody>
330
463
  </table></div></div>
331
464
  </details><details class="report-subsection" open>
@@ -333,93 +466,440 @@ Even though the security vulnerability is fixed in version 32.0.0, we recommend
333
466
  <div><div class="empty">No CVEs matched.</div></div>
334
467
  </details></div>
335
468
  </details><details class="report-subsection">
336
- <summary><h3>By pom.xml (1 file)</h3></summary>
469
+ <summary><h3>By pom.xml (3 files)</h3></summary>
337
470
  <div><details class="report-subsection" open>
338
- <summary><h3><code class="path">pom.xml</code> (2)</h3></summary>
471
+ <summary><h3><code class="path">libs/common-bom/pom.xml</code> (3)</h3></summary>
339
472
  <div><div class="table-wrap"><div class="table-actions"><button class="btn-copy" type="button" title="Copy this table — paste it into Word with formatting preserved">📋 Copy table</button></div><table>
340
473
  <thead><tr><th>Priority</th><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th></tr></thead>
341
474
  <tbody><tr class="cve-row">
342
475
  <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span></td>
343
- <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">5.5</div></td>
344
- <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2023-2976" target="_blank">CVE-2023-2976</a><div class="confidence">probable</div></td>
345
- <td class="dep">com.google.guava:<br>guava<br><span style="color:#6b7280">30.0-jre</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code></div></td>
346
- <td class="cwe"><span class="cwe-empty">—</span></td>
347
- <td class="published">—</td>
348
- <td class="desc">Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the defaul…</td>
349
- <td class="dep">32.0.0</td>
350
- <td><span class="source fad">fad</span></td>
476
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
477
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-68161" target="_blank">CVE-2025-68161</a><div class="confidence">exact</div></td>
478
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
479
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
480
+ <td class="published">2025-12-18</td>
481
+ <td class="desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#…</td>
482
+ <td class="dep">2.25.3</td>
483
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
351
484
 
352
485
  </tr>
353
486
  <tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
354
487
  <div class="panel-title">Description</div>
355
- <div><div class="full-desc">Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.
488
+ <div><div class="full-desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true.
489
+
490
+ This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:
491
+
492
+ * The attacker is able to intercept or redirect network traffic between the client and the log receiver.
493
+ * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).
494
+
356
495
 
357
- Even though the security vulnerability is fixed in version 32.0.0, we recommend…</div></div>
496
+ Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.
497
+
498
+ As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.</div></div>
499
+ </div><div class="panel-block">
500
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
501
+ <div><ul class="cwe-list"><li>
502
+ <a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
503
+ <span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
504
+ </li><li>
505
+ <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
506
+ <span class="cwe-name-inline">— Improper Certificate Validation</span>
507
+ </li></ul></div>
358
508
  </div><div class="panel-block">
359
509
  <div class="panel-title">Metadata</div>
360
- <div><div class="kv"><div><label>Base score</label><span>5.5 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 55/100</span></div><div><label>Fix version</label><span>32.0.0</span></div><div><label>Match confidence</label><span>probable</span></div><div><label>Sources</label><span>fad</span></div></div></div>
510
+ <div><div class="kv"><div><label>CVSS:4.0</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 63/100</span></div><div><label>Fix version</label><span>2.25.3</span></div><div><label>Published</label><span>2025-12-18</span></div><div><label>Modified</label><span>2026-01-20</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
361
511
  </div><div class="panel-block">
362
- <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
363
- <div><div class="via-list"><div>pom.xml</div></div></div>
512
+ <div class="panel-title">External links <span class="count">(8)</span></div>
513
+ <div><div class="ref-group">
514
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
515
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4002" target="_blank">https://github.com/apache/logging-log4j2/pull/4002</a></li></ul>
516
+ </div><div class="ref-group">
517
+ <span class="ref-label exploit">Exploit / PoC</span><span style="color:#9ca3af;font-size:11px">1 link</span>
518
+ <ul class="ref-list"><li><a href="https://logging.apache.org/security.html#CVE-2025-68161" target="_blank">https://logging.apache.org/security.html#CVE-2025-68161</a></li></ul>
519
+ </div><div class="ref-group">
520
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
521
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li></ul>
522
+ </div><div class="ref-group">
523
+ <span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">3 links</span>
524
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx" target="_blank">https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx</a></li><li><a href="http://www.openwall.com/lists/oss-security/2025/12/18/1" target="_blank">http://www.openwall.com/lists/oss-security/2025/12/18/1</a></li><li><a href="https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html" target="_blank">https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html</a></li></ul>
525
+ </div><div class="ref-group">
526
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
527
+ <ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName</a></li></ul>
528
+ </div></div>
529
+ </div><div class="panel-block">
530
+ <div class="panel-title">Affected CPE configurations <span class="count">(6)</span></div>
531
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1-rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*</li></ul></div>
532
+ </div><div class="panel-block">
533
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
534
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
364
535
  </div></div></td></tr>
365
536
  <tr class="cve-row">
366
- <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#2563eb;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">LOW</span></td>
367
- <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#3b82f6;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">LOW</span><div class="confidence">3.3</div></td>
368
- <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2020-8908" target="_blank">CVE-2020-8908</a><div class="confidence">probable</div></td>
369
- <td class="dep">com.google.guava:<br>guava<br><span style="color:#6b7280">30.0-jre</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code></div></td>
370
- <td class="cwe"><span class="cwe-empty">—</span></td>
371
- <td class="published">—</td>
372
- <td class="desc">A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir()…</td>
373
- <td class="dep">32.0</td>
374
- <td><span class="source fad">fad</span></td>
537
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 11%</div></td>
538
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.9</div></td>
539
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34480" target="_blank">CVE-2026-34480</a><div class="confidence">exact</div></td>
540
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
541
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-116: Improper Encoding or Escaping of Output">CWE-116</a><div class="cwe-name">Improper Encoding or Escaping of Output</div></td>
542
+ <td class="published">2026-04-10</td>
543
+ <td class="desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#char…</td>
544
+ <td class="dep">2.25.4</td>
545
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
375
546
 
376
547
  </tr>
377
548
  <tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
378
549
  <div class="panel-title">Description</div>
379
- <div><div class="full-desc">A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been…</div></div>
550
+ <div><div class="full-desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters.
551
+
552
+ The impact depends on the StAX implementation in use:
553
+
554
+ * JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
555
+ * Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.
556
+
557
+
558
+ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.</div></div>
559
+ </div><div class="panel-block">
560
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(1)</span></div>
561
+ <div><ul class="cwe-list"><li>
562
+ <a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link">CWE-116</a>
563
+ <span class="cwe-name-inline">— Improper Encoding or Escaping of Output</span>
564
+ </li></ul></div>
380
565
  </div><div class="panel-block">
381
566
  <div class="panel-title">Metadata</div>
382
- <div><div class="kv"><div><label>Base score</label><span>3.3 (LOW)</span></div><div><label>Priority</label><span>LOW · 33/100</span></div><div><label>Fix version</label><span>32.0</span></div><div><label>Match confidence</label><span>probable</span></div><div><label>Sources</label><span>fad</span></div></div></div>
567
+ <div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.9 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 57.3/100</span></div><div><label>EPSS</label><span>0.0% prob · 11th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-04-24</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
383
568
  </div><div class="panel-block">
384
- <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
385
- <div><div class="via-list"><div>pom.xml</div></div></div>
569
+ <div class="panel-title">External links <span class="count">(6)</span></div>
570
+ <div><div class="ref-group">
571
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
572
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4077" target="_blank">https://github.com/apache/logging-log4j2/pull/4077</a></li></ul>
573
+ </div><div class="ref-group">
574
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
575
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb" target="_blank">https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34480" target="_blank">https://logging.apache.org/security.html#CVE-2026-34480</a></li></ul>
576
+ </div><div class="ref-group">
577
+ <span class="ref-label third-party">Third-party advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
578
+ <ul class="ref-list"><li><a href="http://www.openwall.com/lists/oss-security/2026/04/10/9" target="_blank">http://www.openwall.com/lists/oss-security/2026/04/10/9</a></li></ul>
579
+ </div><div class="ref-group">
580
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
581
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout" target="_blank">https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout</a></li></ul>
582
+ </div></div>
583
+ </div><div class="panel-block">
584
+ <div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
585
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
586
+ </div><div class="panel-block">
587
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
588
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
589
+ </div></div></td></tr>
590
+ <tr class="cve-row">
591
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 12%</div></td>
592
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
593
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34477" target="_blank">CVE-2026-34477</a><div class="confidence">exact</div></td>
594
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
595
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
596
+ <td class="published">2026-04-10</td>
597
+ <td class="desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systempr…</td>
598
+ <td class="dep">2.25.4</td>
599
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
600
+
601
+ </tr>
602
+ <tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
603
+ <div class="panel-title">Description</div>
604
+ <div><div class="full-desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the &lt;Ssl&gt; element.
605
+
606
+ Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
607
+
608
+ A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:
609
+
610
+ * An SMTP, Socket, or Syslog appender is in use.
611
+ * TLS is configured via a nested &lt;Ssl&gt; element.
612
+ * The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured.
613
+ This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default.
614
+
615
+ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.</div></div>
616
+ </div><div class="panel-block">
617
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
618
+ <div><ul class="cwe-list"><li>
619
+ <a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
620
+ <span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
621
+ </li><li>
622
+ <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
623
+ <span class="cwe-name-inline">— Improper Certificate Validation</span>
624
+ </li></ul></div>
625
+ </div><div class="panel-block">
626
+ <div class="panel-title">Metadata</div>
627
+ <div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 52.8/100</span></div><div><label>EPSS</label><span>0.0% prob · 12th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-05-06</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
628
+ </div><div class="panel-block">
629
+ <div class="panel-title">External links <span class="count">(5)</span></div>
630
+ <div><div class="ref-group">
631
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
632
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4075" target="_blank">https://github.com/apache/logging-log4j2/pull/4075</a></li></ul>
633
+ </div><div class="ref-group">
634
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
635
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34477" target="_blank">https://logging.apache.org/security.html#CVE-2026-34477</a></li></ul>
636
+ </div><div class="ref-group">
637
+ <span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">1 link</span>
638
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4" target="_blank">https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4</a></li></ul>
639
+ </div><div class="ref-group">
640
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">1 link</span>
641
+ <ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li></ul>
642
+ </div></div>
643
+ </div><div class="panel-block">
644
+ <div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
645
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
646
+ </div><div class="panel-block">
647
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
648
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
386
649
  </div></div></td></tr></tbody>
387
650
  </table></div></div>
388
- </details></div>
389
- </details></div>
390
- </details></div>
391
- </details>
392
- <details class="report-section" open id="ch1e">
393
- <summary><h2>1B. Embedded binaries — JAR/WAR/EAR (3)</h2></summary>
394
- <div><div class="fp-intro">Maven coordinates discovered inside committed <code>.jar</code>/<code>.war</code>/<code>.ear</code> binaries (vendored libs, fat-jars) — not declared in any <code>pom.xml</code>. Patch by rebuilding/replacing the containing archive.</div><div class="eco-block"><h3 class="eco-h">📦 dist/app.jar <span class="eco-count">(3)</span></h3><div class="table-wrap"><div class="table-actions"><button class="btn-copy" type="button" title="Copy this table — paste it into Word with formatting preserved">📋 Copy table</button></div><table>
651
+ </details><details class="report-subsection" open>
652
+ <summary><h3><code class="path">pom.xml</code> (3)</h3></summary>
653
+ <div><div class="table-wrap"><div class="table-actions"><button class="btn-copy" type="button" title="Copy this table — paste it into Word with formatting preserved">📋 Copy table</button></div><table>
654
+ <thead><tr><th>Priority</th><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th></tr></thead>
655
+ <tbody><tr class="cve-row">
656
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span></td>
657
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
658
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-68161" target="_blank">CVE-2025-68161</a><div class="confidence">exact</div></td>
659
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
660
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
661
+ <td class="published">2025-12-18</td>
662
+ <td class="desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#…</td>
663
+ <td class="dep">2.25.3</td>
664
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
665
+
666
+ </tr>
667
+ <tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
668
+ <div class="panel-title">Description</div>
669
+ <div><div class="full-desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true.
670
+
671
+ This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:
672
+
673
+ * The attacker is able to intercept or redirect network traffic between the client and the log receiver.
674
+ * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).
675
+
676
+
677
+ Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.
678
+
679
+ As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.</div></div>
680
+ </div><div class="panel-block">
681
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
682
+ <div><ul class="cwe-list"><li>
683
+ <a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
684
+ <span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
685
+ </li><li>
686
+ <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
687
+ <span class="cwe-name-inline">— Improper Certificate Validation</span>
688
+ </li></ul></div>
689
+ </div><div class="panel-block">
690
+ <div class="panel-title">Metadata</div>
691
+ <div><div class="kv"><div><label>CVSS:4.0</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 63/100</span></div><div><label>Fix version</label><span>2.25.3</span></div><div><label>Published</label><span>2025-12-18</span></div><div><label>Modified</label><span>2026-01-20</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
692
+ </div><div class="panel-block">
693
+ <div class="panel-title">External links <span class="count">(8)</span></div>
694
+ <div><div class="ref-group">
695
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
696
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4002" target="_blank">https://github.com/apache/logging-log4j2/pull/4002</a></li></ul>
697
+ </div><div class="ref-group">
698
+ <span class="ref-label exploit">Exploit / PoC</span><span style="color:#9ca3af;font-size:11px">1 link</span>
699
+ <ul class="ref-list"><li><a href="https://logging.apache.org/security.html#CVE-2025-68161" target="_blank">https://logging.apache.org/security.html#CVE-2025-68161</a></li></ul>
700
+ </div><div class="ref-group">
701
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
702
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li></ul>
703
+ </div><div class="ref-group">
704
+ <span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">3 links</span>
705
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx" target="_blank">https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx</a></li><li><a href="http://www.openwall.com/lists/oss-security/2025/12/18/1" target="_blank">http://www.openwall.com/lists/oss-security/2025/12/18/1</a></li><li><a href="https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html" target="_blank">https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html</a></li></ul>
706
+ </div><div class="ref-group">
707
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
708
+ <ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName</a></li></ul>
709
+ </div></div>
710
+ </div><div class="panel-block">
711
+ <div class="panel-title">Affected CPE configurations <span class="count">(6)</span></div>
712
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1-rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*</li></ul></div>
713
+ </div><div class="panel-block">
714
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
715
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
716
+ </div></div></td></tr>
717
+ <tr class="cve-row">
718
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 11%</div></td>
719
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.9</div></td>
720
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34480" target="_blank">CVE-2026-34480</a><div class="confidence">exact</div></td>
721
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
722
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-116: Improper Encoding or Escaping of Output">CWE-116</a><div class="cwe-name">Improper Encoding or Escaping of Output</div></td>
723
+ <td class="published">2026-04-10</td>
724
+ <td class="desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#char…</td>
725
+ <td class="dep">2.25.4</td>
726
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
727
+
728
+ </tr>
729
+ <tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
730
+ <div class="panel-title">Description</div>
731
+ <div><div class="full-desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters.
732
+
733
+ The impact depends on the StAX implementation in use:
734
+
735
+ * JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
736
+ * Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.
737
+
738
+
739
+ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.</div></div>
740
+ </div><div class="panel-block">
741
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(1)</span></div>
742
+ <div><ul class="cwe-list"><li>
743
+ <a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link">CWE-116</a>
744
+ <span class="cwe-name-inline">— Improper Encoding or Escaping of Output</span>
745
+ </li></ul></div>
746
+ </div><div class="panel-block">
747
+ <div class="panel-title">Metadata</div>
748
+ <div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.9 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 57.3/100</span></div><div><label>EPSS</label><span>0.0% prob · 11th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-04-24</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
749
+ </div><div class="panel-block">
750
+ <div class="panel-title">External links <span class="count">(6)</span></div>
751
+ <div><div class="ref-group">
752
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
753
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4077" target="_blank">https://github.com/apache/logging-log4j2/pull/4077</a></li></ul>
754
+ </div><div class="ref-group">
755
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
756
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb" target="_blank">https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34480" target="_blank">https://logging.apache.org/security.html#CVE-2026-34480</a></li></ul>
757
+ </div><div class="ref-group">
758
+ <span class="ref-label third-party">Third-party advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
759
+ <ul class="ref-list"><li><a href="http://www.openwall.com/lists/oss-security/2026/04/10/9" target="_blank">http://www.openwall.com/lists/oss-security/2026/04/10/9</a></li></ul>
760
+ </div><div class="ref-group">
761
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
762
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout" target="_blank">https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout</a></li></ul>
763
+ </div></div>
764
+ </div><div class="panel-block">
765
+ <div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
766
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
767
+ </div><div class="panel-block">
768
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
769
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
770
+ </div></div></td></tr>
771
+ <tr class="cve-row">
772
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 12%</div></td>
773
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
774
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34477" target="_blank">CVE-2026-34477</a><div class="confidence">exact</div></td>
775
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
776
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
777
+ <td class="published">2026-04-10</td>
778
+ <td class="desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systempr…</td>
779
+ <td class="dep">2.25.4</td>
780
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
781
+
782
+ </tr>
783
+ <tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
784
+ <div class="panel-title">Description</div>
785
+ <div><div class="full-desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the &lt;Ssl&gt; element.
786
+
787
+ Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
788
+
789
+ A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:
790
+
791
+ * An SMTP, Socket, or Syslog appender is in use.
792
+ * TLS is configured via a nested &lt;Ssl&gt; element.
793
+ * The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured.
794
+ This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default.
795
+
796
+ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.</div></div>
797
+ </div><div class="panel-block">
798
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
799
+ <div><ul class="cwe-list"><li>
800
+ <a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
801
+ <span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
802
+ </li><li>
803
+ <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
804
+ <span class="cwe-name-inline">— Improper Certificate Validation</span>
805
+ </li></ul></div>
806
+ </div><div class="panel-block">
807
+ <div class="panel-title">Metadata</div>
808
+ <div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 52.8/100</span></div><div><label>EPSS</label><span>0.0% prob · 12th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-05-06</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
809
+ </div><div class="panel-block">
810
+ <div class="panel-title">External links <span class="count">(5)</span></div>
811
+ <div><div class="ref-group">
812
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
813
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4075" target="_blank">https://github.com/apache/logging-log4j2/pull/4075</a></li></ul>
814
+ </div><div class="ref-group">
815
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
816
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34477" target="_blank">https://logging.apache.org/security.html#CVE-2026-34477</a></li></ul>
817
+ </div><div class="ref-group">
818
+ <span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">1 link</span>
819
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4" target="_blank">https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4</a></li></ul>
820
+ </div><div class="ref-group">
821
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">1 link</span>
822
+ <ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li></ul>
823
+ </div></div>
824
+ </div><div class="panel-block">
825
+ <div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
826
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
827
+ </div><div class="panel-block">
828
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
829
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
830
+ </div></div></td></tr></tbody>
831
+ </table></div></div>
832
+ </details><details class="report-subsection" open>
833
+ <summary><h3><code class="path">services/worker/pom.xml</code> (3)</h3></summary>
834
+ <div><div class="table-wrap"><div class="table-actions"><button class="btn-copy" type="button" title="Copy this table — paste it into Word with formatting preserved">📋 Copy table</button></div><table>
395
835
  <thead><tr><th>Priority</th><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th></tr></thead>
396
836
  <tbody><tr class="cve-row">
397
837
  <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span></td>
398
838
  <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
399
839
  <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-68161" target="_blank">CVE-2025-68161</a><div class="confidence">exact</div></td>
400
- <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>dist/app.jar!/BOOT-INF/lib/log4j-core-2.14.0.jar</code></div></td>
401
- <td class="cwe"><span class="cwe-empty">—</span></td>
402
- <td class="published">—</td>
840
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
841
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
842
+ <td class="published">2025-12-18</td>
403
843
  <td class="desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#…</td>
404
844
  <td class="dep">2.25.3</td>
405
- <td><span class="source fad">fad</span></td>
845
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
406
846
 
407
847
  </tr>
408
848
  <tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
409
849
  <div class="panel-title">Description</div>
410
- <div><div class="full-desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html…</div></div>
850
+ <div><div class="full-desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true.
851
+
852
+ This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:
853
+
854
+ * The attacker is able to intercept or redirect network traffic between the client and the log receiver.
855
+ * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).
856
+
857
+
858
+ Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.
859
+
860
+ As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.</div></div>
861
+ </div><div class="panel-block">
862
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
863
+ <div><ul class="cwe-list"><li>
864
+ <a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
865
+ <span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
866
+ </li><li>
867
+ <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
868
+ <span class="cwe-name-inline">— Improper Certificate Validation</span>
869
+ </li></ul></div>
411
870
  </div><div class="panel-block">
412
871
  <div class="panel-title">Metadata</div>
413
- <div><div class="kv"><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 63/100</span></div><div><label>Fix version</label><span>2.25.3</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad</span></div></div></div>
872
+ <div><div class="kv"><div><label>CVSS:4.0</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 63/100</span></div><div><label>Fix version</label><span>2.25.3</span></div><div><label>Published</label><span>2025-12-18</span></div><div><label>Modified</label><span>2026-01-20</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
414
873
  </div><div class="panel-block">
415
- <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
416
- <div><div class="via-list"><div>dist/app.jar!/BOOT-INF/lib/log4j-core-2.14.0.jar</div></div></div>
874
+ <div class="panel-title">External links <span class="count">(8)</span></div>
875
+ <div><div class="ref-group">
876
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
877
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4002" target="_blank">https://github.com/apache/logging-log4j2/pull/4002</a></li></ul>
878
+ </div><div class="ref-group">
879
+ <span class="ref-label exploit">Exploit / PoC</span><span style="color:#9ca3af;font-size:11px">1 link</span>
880
+ <ul class="ref-list"><li><a href="https://logging.apache.org/security.html#CVE-2025-68161" target="_blank">https://logging.apache.org/security.html#CVE-2025-68161</a></li></ul>
881
+ </div><div class="ref-group">
882
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
883
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li></ul>
884
+ </div><div class="ref-group">
885
+ <span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">3 links</span>
886
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx" target="_blank">https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx</a></li><li><a href="http://www.openwall.com/lists/oss-security/2025/12/18/1" target="_blank">http://www.openwall.com/lists/oss-security/2025/12/18/1</a></li><li><a href="https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html" target="_blank">https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html</a></li></ul>
887
+ </div><div class="ref-group">
888
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
889
+ <ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName</a></li></ul>
890
+ </div></div>
891
+ </div><div class="panel-block">
892
+ <div class="panel-title">Affected CPE configurations <span class="count">(6)</span></div>
893
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1-rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*</li></ul></div>
894
+ </div><div class="panel-block">
895
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
896
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
417
897
  </div></div></td></tr>
418
898
  <tr class="cve-row">
419
899
  <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 11%</div></td>
420
900
  <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.9</div></td>
421
901
  <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34480" target="_blank">CVE-2026-34480</a><div class="confidence">exact</div></td>
422
- <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>dist/app.jar!/BOOT-INF/lib/log4j-core-2.14.0.jar</code></div></td>
902
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
423
903
  <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-116: Improper Encoding or Escaping of Output">CWE-116</a><div class="cwe-name">Improper Encoding or Escaping of Output</div></td>
424
904
  <td class="published">2026-04-10</td>
425
905
  <td class="desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#char…</td>
@@ -466,14 +946,14 @@ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this is
466
946
  <div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
467
947
  <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
468
948
  </div><div class="panel-block">
469
- <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
470
- <div><div class="via-list"><div>dist/app.jar!/BOOT-INF/lib/log4j-core-2.14.0.jar</div></div></div>
949
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
950
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
471
951
  </div></div></td></tr>
472
952
  <tr class="cve-row">
473
953
  <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 12%</div></td>
474
954
  <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
475
955
  <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34477" target="_blank">CVE-2026-34477</a><div class="confidence">exact</div></td>
476
- <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>dist/app.jar!/BOOT-INF/lib/log4j-core-2.14.0.jar</code></div></td>
956
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
477
957
  <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
478
958
  <td class="published">2026-04-10</td>
479
959
  <td class="desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systempr…</td>
@@ -526,11 +1006,15 @@ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this is
526
1006
  <div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
527
1007
  <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
528
1008
  </div><div class="panel-block">
529
- <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
530
- <div><div class="via-list"><div>dist/app.jar!/BOOT-INF/lib/log4j-core-2.14.0.jar</div></div></div>
1009
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
1010
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
531
1011
  </div></div></td></tr></tbody>
532
- </table></div></div></div>
1012
+ </table></div></div>
1013
+ </details></div>
1014
+ </details></div>
1015
+ </details></div>
533
1016
  </details>
1017
+
534
1018
  <details class="report-section" id="ch2">
535
1019
  <summary><h2>2. Vendored JS scan — retire.js (0)</h2></summary>
536
1020
  <div><div class="empty">No vulnerable vendored JavaScript files detected (or retire.js was skipped).</div></div>
@@ -540,20 +1024,81 @@ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this is
540
1024
  <div><div class="empty">No CVE matches.</div></div>
541
1025
  </details>
542
1026
  <details class="report-section" open id="ch4">
543
- <summary><h2>4. End-of-Life Frameworks (0)</h2></summary>
544
- <div><div class="empty">No end-of-life frameworks detected.</div></div>
1027
+ <summary><h2>4. End-of-Life Frameworks (1)</h2></summary>
1028
+ <div><div class="table-wrap"><div class="table-actions"><button class="btn-copy" type="button" title="Copy this table — paste it into Word with formatting preserved">📋 Copy table</button></div><table>
1029
+ <thead><tr><th>Product</th><th>Dependency</th><th>EOL date</th><th>Latest</th><th>Notes</th></tr></thead>
1030
+ <tbody><tr>
1031
+ <td class="dep">Spring Framework</td>
1032
+ <td class="dep">org.springframework:spring-web<br><span style="color:#6b7280">5.3.20</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>services/api/pom.xml</code></div></td>
1033
+ <td>2024-08-31</td>
1034
+ <td>5.3.39</td>
1035
+ <td class="desc">Latest: 5.3.39 (2024-08-14)</td>
1036
+ </tr></tbody>
1037
+ </table></div></div>
545
1038
  </details>
546
1039
  <details class="report-section" open id="ch5">
547
- <summary><h2>5. Obsolete / Deprecated Libraries (0)</h2></summary>
548
- <div><div class="empty">No obsolete / deprecated libraries detected.</div></div>
1040
+ <summary><h2>5. Obsolete / Deprecated Libraries (1)</h2></summary>
1041
+ <div><div class="table-wrap"><div class="table-actions"><button class="btn-copy" type="button" title="Copy this table — paste it into Word with formatting preserved">📋 Copy table</button></div><table>
1042
+ <thead><tr><th>Severity</th><th>Obsolete</th><th>Replacement</th><th>Why</th></tr></thead>
1043
+ <tbody><tr>
1044
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#3b82f6;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">LOW</span></td>
1045
+ <td class="dep">junit:junit<br><span style="color:#6b7280">4.12</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>services/worker/pom.xml</code></div></td>
1046
+ <td class="dep">org.junit.jupiter:junit-jupiter (JUnit 5)</td>
1047
+ <td class="desc">JUnit 4 is in maintenance; JUnit 5 is the modern line.</td>
1048
+ </tr></tbody>
1049
+ </table></div></div>
549
1050
  </details>
550
1051
  <details class="report-section" open id="ch6">
551
- <summary><h2>6. Outdated Libraries (0)</h2></summary>
552
- <div><div class="empty">No outdated libraries (or --allLibs not set).</div></div>
1052
+ <summary><h2>6. Outdated Libraries (5)</h2></summary>
1053
+ <div><div class="table-wrap"><div class="table-actions"><button class="btn-copy" type="button" title="Copy this table — paste it into Word with formatting preserved">📋 Copy table</button></div><table>
1054
+ <thead><tr><th>Jump</th><th>Dependency</th><th>Current</th><th>Latest</th><th>Released</th></tr></thead>
1055
+ <tbody><tr class="jump-major">
1056
+ <td><span class="jump-badge jump-major">+1 major</span></td>
1057
+ <td class="dep">npm:chalk<div class="defined-in"><span class="defined-label">defined in:</span> <code>packages/cli/yarn.lock</code></div></td>
1058
+ <td class="dep">4.1.2</td>
1059
+ <td class="dep">5.6.2</td>
1060
+ <td>2025-09-08</td>
1061
+ </tr>
1062
+ <tr class="jump-major">
1063
+ <td><span class="jump-badge jump-major">+3 major</span></td>
1064
+ <td class="dep">npm:supports-color<div class="defined-in"><span class="defined-label">defined in:</span> <code>packages/cli/yarn.lock</code></div></td>
1065
+ <td class="dep">7.2.0</td>
1066
+ <td class="dep">10.2.2</td>
1067
+ <td>2025-09-08</td>
1068
+ </tr>
1069
+ <tr class="jump-major">
1070
+ <td><span class="jump-badge jump-major">+1 major</span></td>
1071
+ <td class="dep">org.yaml:snakeyaml<div class="defined-in"><span class="defined-label">defined in:</span> <code>services/worker/pom.xml</code></div></td>
1072
+ <td class="dep">1.30</td>
1073
+ <td class="dep">2.4</td>
1074
+ <td>2025-02-15</td>
1075
+ </tr>
1076
+ <tr class="jump-minor">
1077
+ <td><span class="jump-badge jump-minor">+9 minor</span></td>
1078
+ <td class="dep">com.fasterxml.jackson.core:jackson-databind<div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/api/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
1079
+ <td class="dep">2.9.10</td>
1080
+ <td class="dep">2.18.4</td>
1081
+ <td>2025-05-07</td>
1082
+ </tr>
1083
+ <tr class="jump-minor">
1084
+ <td><span class="jump-badge jump-minor">+12 minor</span></td>
1085
+ <td class="dep">org.apache.logging.log4j:log4j-core<div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
1086
+ <td class="dep">2.14.0</td>
1087
+ <td class="dep">2.26.0</td>
1088
+ <td>2026-05-02</td>
1089
+ </tr></tbody>
1090
+ </table></div></div>
553
1091
  </details>
554
1092
  <details class="report-section" id="ch7">
555
- <summary><h2>7. Licenses (0)</h2></summary>
556
- <div><div class="empty">No license data resolved (offline, or registries returned none).</div></div>
1093
+ <summary><h2>7. Licenses (1)</h2></summary>
1094
+ <div><div class="fp-intro">All resolved licenses are permissive. Listed for completeness.</div><div class="lic-group lic-ok">
1095
+ <h3 class="lic-h">Permissive (MIT/Apache/BSD) <span class="lic-n">1</span></h3>
1096
+ <div class="table-wrap"><div class="table-actions"><button class="btn-copy" type="button" title="Copy this table — paste it into Word with formatting preserved">📋 Copy table</button></div><table><thead><tr><th>Dependency</th><th>License(s)</th><th>Source</th></tr></thead><tbody><tr>
1097
+ <td><td class="dep">npm:<br>supports-color<br><span style="color:#6b7280">7.2.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>packages/cli/yarn.lock</code></div></td></td>
1098
+ <td>MIT</td>
1099
+ <td>npm</td>
1100
+ </tr></tbody></table></div>
1101
+ </div></div>
557
1102
  </details>
558
1103
  <details class="report-section" id="ch8">
559
1104
  <summary><h2>8. Fix Recommendations</h2></summary>
@@ -563,11 +1108,11 @@ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this is
563
1108
  <thead><tr><th>Worst sev</th><th>Direct dependency</th><th>Current</th><th>Pin to ≥</th><th>Maven Central latest</th><th>CVEs covered</th></tr></thead>
564
1109
  <tbody><tr>
565
1110
  <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span></td>
566
- <td class="dep">com.google.guava:guava</td>
567
- <td class="dep">30.0-jre</td>
568
- <td class="dep"><span style="color:#065f46;font-weight:600">32.0.0</span></td>
569
- <td class="dep"><span style="color:#9ca3af">—</span></td>
570
- <td class="confidence">2 CVE: CVE-2023-2976, CVE-2020-8908</td>
1111
+ <td class="dep">org.apache.logging.log4j:log4j-core</td>
1112
+ <td class="dep">2.14.0</td>
1113
+ <td class="dep"><span style="color:#065f46;font-weight:600">2.25.4</span></td>
1114
+ <td class="dep">2.26.0</td>
1115
+ <td class="confidence">3 CVE: CVE-2025-68161, CVE-2026-34477, CVE-2026-34480</td>
571
1116
  </tr></tbody>
572
1117
  </table></div></div>
573
1118
  </details></div>