Vulnerability Reportdebezium/connect:2.5.4.Final

debezium/connect:2.5.4.Final
digestsha256:08ee20408a350c7ae1fd5808b1ca5d4fce0e2d11fa0bfdd3604ed883bb56f308

Executive Summary

Last scanned:

Threat Score
100/100DANGEROUS
Reputation
RELIABLE

This image poses a critical security risk and must not be used in production, especially as an internet-facing service. An attacker could exploit CVE-2026-2332 to perform request smuggling against the Kafka Connect REST API, bypassing access controls, and CVE-2025-27817 to read arbitrary files or perform SSRF if untrusted connector configurations are allowed. Note that CVE-2025-27817 requires the Kafka client SASL/OAUTHBEARER endpoint URLs to be settable by an untrusted party; CVE-2026-2332 requires no special configuration.

Vulnerabilities

Vulnerability Log

113 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-2332CRITICAL9.1
org.eclipse.jetty:jetty-http
9.4.52.v20230823
fixed in 12.1.7, 12.0.33
1.1%
Low-Moderate Risk
Directly ExposedContext importance: HIGH
CVE-2025-27817HIGH8
org.apache.kafka:kafka-clients
3.6.1
fixed in 3.9.1
64.7%
Actively Exploited
Directly ExposedContext importance: MEDIUM
CVE-2026-42579HIGH7.73
io.netty:netty-codec-dns
4.1.100.Final
fixed in 4.2.13.Final, 4.1.133.Final
1.0%
Theoretical Threat
Directly Exposed
CVE-2026-45292HIGH7.5
io.opentelemetry:opentelemetry-api
1.23.1
fixed in 1.62.0
1.1%
Low-Moderate Risk
Directly Exposed
CVE-2025-67030HIGH7.48
org.codehaus.plexus:plexus-utils
3.3.1
fixed in 4.0.3, 3.6.1
0.7%
Theoretical Threat
Directly Exposed
CVE-2023-22102HIGH7.06
com.mysql:mysql-connector-j
8.0.33
fixed in 8.2.0
0.9%
Theoretical Threat
Directly Exposed
CVE-2024-47561HIGH7.04
org.apache.avro:avro
1.11.1
fixed in 1.11.4
3.3%
Low-Moderate Risk
Directly ExposedContext importance: MEDIUM
CVE-2026-54512MEDIUM6.88
com.fasterxml.jackson.core:jackson-databind
2.13.4.2
fixed in 2.18.8, 3.1.4, 2.21.4
0.8%
Theoretical Threat
Directly Exposed
CVE-2026-54513MEDIUM6.88
com.fasterxml.jackson.core:jackson-databind
2.13.4.2
fixed in 2.18.8, 2.21.4, 3.1.4
0.7%
Theoretical Threat
Directly Exposed
CVE-2026-54512MEDIUM6.88
com.fasterxml.jackson.core:jackson-databind
2.13.5
fixed in 2.18.8, 3.1.4, 2.21.4
0.8%
Theoretical Threat
Directly Exposed
CVE-2026-54513MEDIUM6.88
com.fasterxml.jackson.core:jackson-databind
2.13.5
fixed in 2.18.8, 2.21.4, 3.1.4
0.7%
Theoretical Threat
Directly Exposed
CVE-2026-44249MEDIUM6.88
io.netty:netty-handler
4.1.100.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.6%
Theoretical Threat
Directly Exposed
CVE-2023-2974MEDIUM6.88
io.quarkus:quarkus-core
2.14.0.Final
fixed in 2.16.8.Final
0.9%
Theoretical Threat
Directly Exposed
CVE-2026-45674MEDIUM6.8
io.netty:netty-resolver-dns
4.1.100.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.2%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-47691MEDIUM6.8
io.netty:netty-resolver-dns
4.1.100.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-27830MEDIUM6.8
com.mchange:c3p0
0.9.5.5
fixed in 0.12.0
0.5%
Theoretical Threat
Directly Exposed
CVE-2025-27818MEDIUM6.8
org.apache.kafka:kafka_2.13
3.6.1
fixed in 3.9.1
0.9%
Theoretical Threat
Directly Exposed
CVE-2024-27309MEDIUM6.8
org.apache.kafka:kafka-metadata
3.6.1
fixed in 3.6.2
1.1%
Low-Moderate Risk
Directly Exposed
CVE-2024-8184MEDIUM6.5
org.eclipse.jetty:jetty-server
9.4.52.v20230823
fixed in 12.0.9, 10.0.24, 11.0.24, 9.4.56
1.0%
Low-Moderate Risk
Directly Exposed
CVE-2025-52999MEDIUM6.38
com.fasterxml.jackson.core:jackson-core
2.13.4
fixed in 2.15.0
0.6%
Theoretical Threat
Directly Exposed
CVE-2025-52999MEDIUM6.38
com.fasterxml.jackson.core:jackson-core
2.13.5
fixed in 2.15.0
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-50193MEDIUM6.38
com.fasterxml.jackson.core:jackson-databind
2.13.4.2
fixed in 2.14.0
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-50193MEDIUM6.38
com.fasterxml.jackson.core:jackson-databind
2.13.5
fixed in 2.14.0
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-55223MEDIUM6.38
com.mchange:c3p0
0.9.5.5
fixed in 0.14.0
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-42583MEDIUM6.38
io.netty:netty-codec
4.1.100.Final
fixed in 4.1.133.Final
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-59901MEDIUM6.38
io.netty:netty-codec
4.1.100.Final
fixed in 4.1.136.Final
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-58057MEDIUM6.38
io.netty:netty-codec
4.1.100.Final
fixed in 4.1.125.Final
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-33870MEDIUM6.38
io.netty:netty-codec-http
4.1.100.Final
fixed in 4.1.132.Final, 4.2.10.Final
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-42587MEDIUM6.38
io.netty:netty-codec-http
4.1.100.Final
fixed in 4.2.13.Final, 4.1.133.Final
1.0%
Theoretical Threat
Directly Exposed
CVE-2026-55831MEDIUM6.38
io.netty:netty-codec-http
4.1.100.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-55833MEDIUM6.38
io.netty:netty-codec-http
4.1.100.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-56745MEDIUM6.38
io.netty:netty-codec-http
4.1.100.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-42585MEDIUM6.38
io.netty:netty-codec-http
4.1.100.Final
fixed in 4.2.13.Final, 4.1.133.Final
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-56746MEDIUM6.38
io.netty:netty-codec-http
4.1.100.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-59899MEDIUM6.38
io.netty:netty-codec-http
4.1.100.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.3%
Theoretical Threat
Directly Exposed
CVE-2025-58056MEDIUM6.38
io.netty:netty-codec-http
4.1.100.Final
fixed in 4.1.125.Final, 4.2.5.Final
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-42587MEDIUM6.38
io.netty:netty-codec-http2
4.1.100.Final
fixed in 4.2.13.Final, 4.1.133.Final
1.0%
Theoretical Threat
Directly Exposed
CVE-2026-48043MEDIUM6.38
io.netty:netty-codec-http2
4.1.100.Final
fixed in 4.1.135.Final, 4.2.15.Final
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-45416MEDIUM6.38
io.netty:netty-handler
4.1.100.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-50010MEDIUM6.38
io.netty:netty-handler
4.1.100.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-42578MEDIUM6.38
io.netty:netty-handler-proxy
4.1.100.Final
fixed in 4.1.133.Final, 4.2.13.Final
1.0%
Theoretical Threat
Directly Exposed
CVE-2024-29371MEDIUM6.38
org.bitbucket.b_c:jose4j
0.9.3
fixed in 0.9.6
0.2%
Theoretical Threat
Directly Exposed
CVE-2023-51775MEDIUM6.38
org.bitbucket.b_c:jose4j
0.9.3
fixed in 0.9.4
0.9%
Theoretical Threat
Directly Exposed
CVE-2024-9823MEDIUM6.38
org.eclipse.jetty:jetty-servlets
9.4.52.v20230823
fixed in 9.4.54, 10.0.18, 11.0.18
0.9%
Theoretical Threat
Directly Exposed
CVE-2025-66566MEDIUM6.38
org.lz4:lz4-java
1.8.0
No fix yet
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-42198MEDIUM6.38
org.postgresql:postgresql
42.6.1
fixed in 42.7.11
0.8%
Theoretical Threat
Directly Exposed
CVE-2024-56128MEDIUM6.29
org.apache.kafka:kafka_2.13
3.6.1
fixed in 3.7.2, 3.8.1
0.8%
Theoretical Threat
Directly Exposed
CVE-2026-24281MEDIUM6.29
org.apache.zookeeper:zookeeper
3.8.3
fixed in 3.8.6, 3.9.5
0.6%
Theoretical Threat
Directly Exposed
CVE-2024-13009MEDIUM6.12
org.eclipse.jetty:jetty-server
9.4.52.v20230823
fixed in 9.4.57.v20241219
0.5%
Theoretical Threat
Directly Exposed
CVE-2023-2976MEDIUM6.03
com.google.guava:guava
30.1.1-jre
fixed in 32.0.0-android
0.2%
Theoretical Threat
Directly Exposed
CVE-2023-2976MEDIUM6.03
com.google.guava:guava
31.1-jre
fixed in 32.0.0-android
0.2%
Theoretical Threat
Directly Exposed
CVE-2024-7254MEDIUM6
com.google.protobuf:protobuf-java
3.21.7
fixed in 3.25.5, 4.27.5, 4.28.2
2.8%
Low-Moderate Risk
Directly ExposedContext importance: MEDIUM
CVE-2024-7254MEDIUM6
com.google.protobuf:protobuf-java
3.25.2
fixed in 3.25.5, 4.27.5, 4.28.2
2.8%
Low-Moderate Risk
Directly ExposedContext importance: MEDIUM
CVE-2025-24970MEDIUM6
io.netty:netty-handler
4.1.100.Final
fixed in 4.1.118.Final
2.1%
Low-Moderate Risk
Directly ExposedContext importance: MEDIUM
CVE-2023-39410MEDIUM6
org.apache.avro:avro
1.11.1
fixed in 1.11.3
1.8%
Low-Moderate Risk
Directly ExposedContext importance: MEDIUM
CVE-2024-2700MEDIUM5.95
io.quarkus:quarkus-core
2.14.0.Final
fixed in 3.9.2, 3.8.4, 3.2.12.Final
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-45673MEDIUM5.78
io.netty:netty-resolver-dns
4.1.100.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-35554MEDIUM5.78
org.apache.kafka:kafka-clients
3.6.1
fixed in 3.9.2, 4.0.2, 4.1.2
0.3%
Theoretical Threat
Directly Exposed
CVE-2024-23944MEDIUM5.61
org.apache.zookeeper:zookeeper
3.8.3
fixed in 3.8.4, 3.9.2
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-67735MEDIUM5.52
io.netty:netty-codec-http
4.1.100.Final
fixed in 4.2.8.Final, 4.1.129.Final
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-41417MEDIUM5.52
io.netty:netty-codec-http
4.1.100.Final
fixed in 4.1.133.Final, 4.2.13.Final
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-42580MEDIUM5.52
io.netty:netty-codec-http
4.1.100.Final
fixed in 4.2.13.Final, 4.1.133.Final
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-59900MEDIUM5.52
io.netty:netty-codec-http2
4.1.100.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.3%
Theoretical Threat
Directly Exposed
CVE-2025-11143MEDIUM5.52
org.eclipse.jetty:jetty-http
9.4.52.v20230823
fixed in 12.0.31, 12.1.5
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-12183MEDIUM5.52
org.lz4:lz4-java
1.8.0
fixed in 1.8.1
0.7%
Theoretical Threat
Directly Exposed
CVE-2024-29025MEDIUM5.3
io.netty:netty-codec-http
4.1.100.Final
fixed in 4.1.108.Final
1.4%
Low-Moderate Risk
Directly Exposed
CVE-2024-31141MEDIUM5.3
org.apache.kafka:kafka-clients
3.6.1
fixed in 3.7.1
1.1%
Low-Moderate Risk
Directly Exposed
CVE-2024-41909MEDIUM5.02
org.apache.sshd:sshd-common
2.9.2
fixed in 2.12.0
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-59921MEDIUM4.84
io.netty:netty-codec-http
4.1.100.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.3%
Theoretical Threat
Directly Exposed
CVE-2024-47535MEDIUM4.67
io.netty:netty-common
4.1.100.Final
fixed in 4.1.115.Final
0.4%
Theoretical Threat
Directly Exposed
CVE-2025-25193MEDIUM4.67
io.netty:netty-common
4.1.100.Final
fixed in 4.1.118.Final
0.4%
Theoretical Threat
Directly Exposed
CVE-2024-25710MEDIUM4.67
org.apache.commons:commons-compress
1.21
fixed in 1.26.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2024-26308MEDIUM4.67
org.apache.commons:commons-compress
1.21
fixed in 1.26.0
0.9%
Theoretical Threat
Directly Exposed
CVE-2022-1471MEDIUM4.58
org.yaml:snakeyaml
1.33
fixed in 2.0
99.6%
Actively Exploited
Post-Exploit
CVE-2026-54514MEDIUM4.5
com.fasterxml.jackson.core:jackson-databind
2.13.4.2
fixed in 2.18.8, 2.21.4, 3.1.4
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-54515MEDIUM4.5
com.fasterxml.jackson.core:jackson-databind
2.13.4.2
fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-54514MEDIUM4.5
com.fasterxml.jackson.core:jackson-databind
2.13.5
fixed in 2.18.8, 2.21.4, 3.1.4
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-54515MEDIUM4.5
com.fasterxml.jackson.core:jackson-databind
2.13.5
fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-50020MEDIUM4.5
io.netty:netty-codec-http
4.1.100.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-59898MEDIUM4.5
io.netty:netty-codec-http
4.1.100.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-47244MEDIUM4.5
io.netty:netty-codec-http2
4.1.100.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-50560MEDIUM4.5
io.netty:netty-codec-http2
4.1.100.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.3%
Theoretical Threat
Directly Exposed
CVE-2024-6763MEDIUM4.5
org.eclipse.jetty:jetty-http
9.4.52.v20230823
fixed in 12.0.12
1.0%
Theoretical Threat
Directly Exposed
CVE-2025-3588MEDIUM4.5
org.jsonschema2pojo:jsonschema2pojo-core
1.1.1
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2024-47554MEDIUM4.3
commons-io:commons-io
2.11.0
fixed in 2.14.0
1.2%
Low-Moderate Risk
Directly Exposed
CVE-2023-35887MEDIUM4.3
org.apache.sshd:sshd-common
2.9.2
fixed in 2.9.3
1.3%
Low-Moderate Risk
Directly Exposed
CVE-2025-48924LOW3.7
org.apache.commons:commons-lang3
3.12.0
fixed in 3.18.0
2.2%
Low-Moderate Risk
Directly Exposed
CVE-2025-48924LOW3.7
org.apache.commons:commons-lang3
3.8.1
fixed in 3.18.0
2.2%
Low-Moderate Risk
Directly Exposed
CVE-2026-45536LOW3.4
io.netty:netty-transport-native-epoll
4.1.100.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.1%
Theoretical Threat
Directly Exposed
CVE-2025-48734LOW3.17
commons-beanutils:commons-beanutils
1.9.4
fixed in 1.11.0
1.5%
Low-Moderate Risk
Post-Exploit
CVE-2026-27727LOW3
com.mchange:mchange-commons-java
0.2.19
fixed in 0.4.0
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-42581LOW3
io.netty:netty-codec-http
4.1.100.Final
fixed in 4.2.13.Final, 4.1.133.Final
0.6%
Theoretical Threat
Post-Exploit
CVE-2020-8908LOW2.8
com.google.guava:guava
30.1.1-jre
fixed in 32.0.0-android
1.0%
Theoretical Threat
Directly Exposed
CVE-2020-8908LOW2.8
com.google.guava:guava
31.1-jre
fixed in 32.0.0-android
1.0%
Theoretical Threat
Directly Exposed
CVE-2026-42584LOW2.78
io.netty:netty-codec-http
4.1.100.Final
fixed in 4.2.13.Final, 4.1.133.Final
0.8%
Theoretical Threat
Post-Exploit
CVE-2025-55163LOW2.7
io.grpc:grpc-netty-shaded
1.49.0
fixed in 1.75.0
1.0%
Low-Moderate Risk
Post-Exploit
CVE-2025-55163LOW2.7
io.netty:netty-codec-http2
4.1.100.Final
fixed in 4.2.4.Final, 4.1.124.Final
1.0%
Low-Moderate Risk
Post-Exploit
CVE-2026-33871LOW2.7
io.netty:netty-codec-http2
4.1.100.Final
fixed in 4.1.132.Final, 4.2.11.Final
1.1%
Low-Moderate Risk
Post-Exploit
CVE-2026-24308LOW2.7
org.apache.zookeeper:zookeeper
3.8.3
fixed in 3.9.5, 3.8.6
1.2%
Low-Moderate Risk
Post-Exploit
CVE-2022-45688LOW2.7
org.json:json
20220320
fixed in 20230227
1.2%
Low-Moderate Risk
Post-Exploit
CVE-2023-5072LOW2.7
org.json:json
20220320
fixed in 20231013
1.4%
Low-Moderate Risk
Post-Exploit
CVE-2025-48924NONE0
commons-lang:commons-lang
2.6
No fix yet
2.2%
Low-Moderate Risk
Not Applicable
GHSA-r7wm-3cxj-wff9NONE0
com.fasterxml.jackson.core:jackson-core
2.13.4
fixed in 2.18.8, 2.21.4, 2.22.1
—
Not Applicable
GHSA-72hv-8253-57qqNONE0
com.fasterxml.jackson.core:jackson-core
2.13.4
fixed in 2.21.1, 2.18.6
—
Not Applicable
GHSA-r7wm-3cxj-wff9NONE0
com.fasterxml.jackson.core:jackson-core
2.13.5
fixed in 2.18.8, 2.21.4, 2.22.1
—
Not Applicable
GHSA-72hv-8253-57qqNONE0
com.fasterxml.jackson.core:jackson-core
2.13.5
fixed in 2.21.1, 2.18.6
—
Not Applicable
GHSA-mfg7-5gfp-c4w3NONE0
io.netty:netty-codec-dns
4.1.100.Final
fixed in 4.2.16.Final, 4.1.136.Final
—
Not Applicable
CVE-2026-33558NONE0
org.apache.kafka:kafka-clients
3.6.1
fixed in 3.9.2, 4.0.1
0.6%
Theoretical Threat
Not Applicable
CVE-2026-10050NONE0
org.eclipse.jetty:jetty-security
9.4.52.v20230823
fixed in 9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10
—
Not Applicable
CVE-2026-6790NONE0
org.eclipse.jetty:jetty-server
9.4.52.v20230823
fixed in 12.0.35, 12.1.9
0.2%
Theoretical Threat
Not Applicable
CVE-2026-56740NONE0
org.jline:jline-remote-telnet
3.22.0
fixed in 4.2.1
0.5%
Theoretical Threat
Not Applicable
CVE-2026-56741NONE0
org.jline:jline-remote-telnet
3.22.0
fixed in 4.2.1
0.5%
Theoretical Threat
Not Applicable
CVE-2026-59949NONE0
org.lz4:lz4-java
1.8.0
No fix yet
—
Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.