{ "SchemaVersion": 2, "Trivy": { "Version": "0.70.0" }, "ReportID": "01a1b919-85b8-7b36-9256-492ef104c0fd", "CreatedAt": "2026-11-08T04:00:20.024736461+01:00", "ArtifactID": "sha256:6caf5d54bb4655d1de734cb7f795d3f6195f8a684e3e9c0376b079713c4a7726", "ArtifactName": "a406021d23fa", "ArtifactType": "container_image", "Metadata": { "Size": 254030848, "OS": { "Family": "alpine", "Name": "3.23.4" }, "ImageID": "sha256:a406021d23fa6fcbc3b3d517203a03a3e92cef19d53df921ce1e770d63c9ab74", "DiffIDs": [ "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1", "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006", "sha256:7e14e103bdbd2703c67c4f136911f9839b8135d0c881b695d0674aeb0fdb5214", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ], "RepoDigests": [ "traccar/traccar@sha256:f187e0be41503f1365fec62cb3075c8545fa6b325a5ac47e37667a47e7a31459" ], "Reference": "traccar/traccar@sha256:f187e0be41503f1365fec62cb3075c8545fa6b325a5ac47e37667a47e7a31459", "ImageConfig": { "architecture": "amd64", "created": "2026-06-05T15:10:29.517126017Z", "history": [ { "created": "2026-04-15T20:01:40Z", "created_by": "ADD alpine-minirootfs-3.23.4-x86_64.tar.gz / # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-04-15T20:01:40Z", "created_by": "CMD [\"/bin/sh\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-06-05T15:10:18Z", "created_by": "COPY /traccar /opt/traccar # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-06-05T15:10:29Z", "created_by": "COPY /jre /opt/traccar/jre # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-06-05T15:10:29Z", "created_by": "WORKDIR /opt/traccar", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-06-05T15:10:29Z", "created_by": "ENTRYPOINT [\"/opt/traccar/jre/bin/java\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-06-05T15:10:29Z", "created_by": "CMD [\"-jar\" \"tracker-server.jar\" \"conf/traccar.xml\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true } ], "os": "linux", "rootfs": { "type": "layers", "diff_ids": [ "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1", "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006", "sha256:7e14e103bdbd2703c67c4f136911f9839b8135d0c881b695d0674aeb0fdb5214", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ] }, "config": { "Cmd": [ "-jar", "tracker-server.jar", "conf/traccar.xml" ], "Entrypoint": [ "/opt/traccar/jre/bin/java" ], "Env": [ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ], "Labels": { "org.opencontainers.image.created": "2026-06-05T15:10:08.943Z", "org.opencontainers.image.description": "Traccar GPS Tracking System", "org.opencontainers.image.licenses": "Apache-2.0", "org.opencontainers.image.revision": "28f33d8f0903782c06e721a80117bf74ee4b3a27", "org.opencontainers.image.source": "https://github.com/traccar/traccar", "org.opencontainers.image.title": "traccar", "org.opencontainers.image.url": "https://github.com/traccar/traccar", "org.opencontainers.image.version": "6.14.4" }, "WorkingDir": "/opt/traccar", "ArgsEscaped": true } }, "Layers": [ { "Size": 8732160, "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, { "Size": 178670592, "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, { "Size": 66627072, "DiffID": "sha256:7e14e103bdbd2703c67c4f136911f9839b8135d0c881b695d0674aeb0fdb5214" }, { "Size": 1024, "DiffID": "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" } ] }, "Results": [ { "Target": "a406021d23fa (alpine 3.23.4)", "Class": "os-pkgs", "Type": "alpine", "Packages": [ { "ID": "alpine-baselayout@3.7.2-r0", "Name": "alpine-baselayout", "Identifier": { "PURL": "pkg:apk/alpine/alpine-baselayout@3.7.2-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ff3090489ca40326" }, "Version": "3.7.2-r0", "Arch": "x86_64", "SrcName": "alpine-baselayout", "SrcVersion": "3.7.2-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "alpine-baselayout-data@3.7.2-r0", "busybox-binsh@1.37.0-r30" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:545aa6f291209af89932b761d9e422c2778596cc", "InstalledFiles": [ "etc/motd", "etc/crontabs/root", "etc/modprobe.d/aliases.conf", "etc/modprobe.d/blacklist.conf", "etc/modprobe.d/i386.conf", "etc/profile.d/20locale.sh", "etc/profile.d/README", "etc/profile.d/color_prompt.sh.disabled", "usr/lib/sysctl.d/00-alpine.conf", "var/lock", "var/run", "var/spool/mail", "var/spool/cron/crontabs" ], "AnalyzedBy": "apk" }, { "ID": "alpine-baselayout-data@3.7.2-r0", "Name": "alpine-baselayout-data", "Identifier": { "PURL": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r0?arch=x86_64\u0026distro=3.23.4", "UID": "78c0ed61d7df9a7e" }, "Version": "3.7.2-r0", "Arch": "x86_64", "SrcName": "alpine-baselayout", "SrcVersion": "3.7.2-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:85816632dbce07ba7e9e7a629fa59eddbd1687fb", "InstalledFiles": [ "etc/fstab", "etc/group", "etc/hostname", "etc/hosts", "etc/inittab", "etc/modules", "etc/mtab", "etc/nsswitch.conf", "etc/passwd", "etc/profile", "etc/protocols", "etc/services", "etc/shadow", "etc/shells", "etc/sysctl.conf" ], "AnalyzedBy": "apk" }, { "ID": "alpine-keys@2.6-r0", "Name": "alpine-keys", "Identifier": { "PURL": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "2c7cb90de388aa7d" }, "Version": "2.6-r0", "Arch": "x86_64", "SrcName": "alpine-keys", "SrcVersion": "2.6-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:5c45a821cd6b84d543bbd7ff12a7de1855c5cd13", "InstalledFiles": [ "etc/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", "usr/share/apk/keys/loongarch64/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", "usr/share/apk/keys/mips64/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub" ], "AnalyzedBy": "apk" }, { "ID": "alpine-release@3.23.4-r0", "Name": "alpine-release", "Identifier": { "PURL": "pkg:apk/alpine/alpine-release@3.23.4-r0?arch=x86_64\u0026distro=3.23.4", "UID": "114fb0bc8cc9ff31" }, "Version": "3.23.4-r0", "Arch": "x86_64", "SrcName": "alpine-base", "SrcVersion": "3.23.4-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "alpine-keys@2.6-r0" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:7ff0b58e52211bb31a84e2afdbcbff0620df55a1", "InstalledFiles": [ "etc/alpine-release", "etc/issue", "etc/os-release", "etc/secfixes.d/alpine", "usr/lib/os-release" ], "AnalyzedBy": "apk" }, { "ID": "apk-tools@3.0.6-r0", "Name": "apk-tools", "Identifier": { "PURL": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "760256a5bdd94a07" }, "Version": "3.0.6-r0", "Arch": "x86_64", "SrcName": "apk-tools", "SrcVersion": "3.0.6-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "ca-certificates-bundle@20260413-r0", "libapk@3.0.6-r0", "libcrypto3@3.5.6-r0", "musl@1.2.5-r23", "zlib@1.3.2-r0" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:86f3b3ef94d1cb213a4ed1187b34a6bb9f593033", "InstalledFiles": [ "sbin/apk" ], "AnalyzedBy": "apk" }, { "ID": "busybox@1.37.0-r30", "Name": "busybox", "Identifier": { "PURL": "pkg:apk/alpine/busybox@1.37.0-r30?arch=x86_64\u0026distro=3.23.4", "UID": "9647681d0b54db77" }, "Version": "1.37.0-r30", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r30", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:f1347801bb96b1aa40d17f82237c3f4ff02a4725", "InstalledFiles": [ "bin/busybox", "etc/securetty", "etc/busybox-paths.d/busybox", "etc/logrotate.d/acpid", "etc/network/if-up.d/dad", "etc/udhcpc/udhcpc.conf", "usr/share/udhcpc/default.script" ], "AnalyzedBy": "apk" }, { "ID": "busybox-binsh@1.37.0-r30", "Name": "busybox-binsh", "Identifier": { "PURL": "pkg:apk/alpine/busybox-binsh@1.37.0-r30?arch=x86_64\u0026distro=3.23.4", "UID": "3e18d05d46a6f46f" }, "Version": "1.37.0-r30", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r30", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "busybox@1.37.0-r30" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:188d2d0110afa58e8a3e3e5fd424b2d996df7a09", "InstalledFiles": [ "bin/sh" ], "AnalyzedBy": "apk" }, { "ID": "ca-certificates-bundle@20260413-r0", "Name": "ca-certificates-bundle", "Identifier": { "PURL": "pkg:apk/alpine/ca-certificates-bundle@20260413-r0?arch=x86_64\u0026distro=3.23.4", "UID": "d9471547e8751507" }, "Version": "20260413-r0", "Arch": "x86_64", "SrcName": "ca-certificates", "SrcVersion": "20260413-r0", "Licenses": [ "MPL-2.0", "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:44c90827e10115cb6afec51081cb26785dc8f418", "InstalledFiles": [ "etc/ssl/cert.pem", "etc/ssl/certs/ca-certificates.crt", "etc/ssl1.1/cert.pem", "etc/ssl1.1/certs" ], "AnalyzedBy": "apk" }, { "ID": "libapk@3.0.6-r0", "Name": "libapk", "Identifier": { "PURL": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "47dcfb9093b112c1" }, "Version": "3.0.6-r0", "Arch": "x86_64", "SrcName": "apk-tools", "SrcVersion": "3.0.6-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcrypto3@3.5.6-r0", "libssl3@3.5.6-r0", "musl@1.2.5-r23", "zlib@1.3.2-r0" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:f064c8318c4f7f17da6a490921ce0d5e709fc063", "InstalledFiles": [ "usr/lib/libapk.so.3.0.0" ], "AnalyzedBy": "apk" }, { "ID": "libcrypto3@3.5.6-r0", "Name": "libcrypto3", "Identifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "975680d851f10fda" }, "Version": "3.5.6-r0", "Arch": "x86_64", "SrcName": "openssl", "SrcVersion": "3.5.6-r0", "Licenses": [ "Apache-2.0" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:9e7a866d0d052d290d3f9d621a4c89214188acff", "InstalledFiles": [ "etc/ssl/ct_log_list.cnf", "etc/ssl/ct_log_list.cnf.dist", "etc/ssl/openssl.cnf", "etc/ssl/openssl.cnf.dist", "usr/lib/libcrypto.so.3", "usr/lib/engines-3/afalg.so", "usr/lib/engines-3/capi.so", "usr/lib/engines-3/loader_attic.so", "usr/lib/engines-3/padlock.so", "usr/lib/ossl-modules/legacy.so" ], "AnalyzedBy": "apk" }, { "ID": "libssl3@3.5.6-r0", "Name": "libssl3", "Identifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "aece396067dff154" }, "Version": "3.5.6-r0", "Arch": "x86_64", "SrcName": "openssl", "SrcVersion": "3.5.6-r0", "Licenses": [ "Apache-2.0" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcrypto3@3.5.6-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:5a2620d507434903b747470a76b47e24b222de5e", "InstalledFiles": [ "usr/lib/libssl.so.3" ], "AnalyzedBy": "apk" }, { "ID": "musl@1.2.5-r23", "Name": "musl", "Identifier": { "PURL": "pkg:apk/alpine/musl@1.2.5-r23?arch=x86_64\u0026distro=3.23.4", "UID": "dca30b3fd6708a32" }, "Version": "1.2.5-r23", "Arch": "x86_64", "SrcName": "musl", "SrcVersion": "1.2.5-r23", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:1b6c50426d3c0656e9c5a567a5a59601c7f4307a", "InstalledFiles": [ "lib/ld-musl-x86_64.so.1", "lib/libc.musl-x86_64.so.1" ], "AnalyzedBy": "apk" }, { "ID": "musl-utils@1.2.5-r23", "Name": "musl-utils", "Identifier": { "PURL": "pkg:apk/alpine/musl-utils@1.2.5-r23?arch=x86_64\u0026distro=3.23.4", "UID": "ffcf7198a9776c5f" }, "Version": "1.2.5-r23", "Arch": "x86_64", "SrcName": "musl", "SrcVersion": "1.2.5-r23", "Licenses": [ "MIT", "BSD-2-Clause", "GPL-2.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23", "scanelf@1.3.8-r2" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:92fdbe96d25f13fe3a3d297ada56e4fb907aacec", "InstalledFiles": [ "sbin/ldconfig", "usr/bin/getconf", "usr/bin/getent", "usr/bin/iconv", "usr/bin/ldd" ], "AnalyzedBy": "apk" }, { "ID": "scanelf@1.3.8-r2", "Name": "scanelf", "Identifier": { "PURL": "pkg:apk/alpine/scanelf@1.3.8-r2?arch=x86_64\u0026distro=3.23.4", "UID": "4efd612ed6f16dca" }, "Version": "1.3.8-r2", "Arch": "x86_64", "SrcName": "pax-utils", "SrcVersion": "1.3.8-r2", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:6ea36dd44ef9f6364f0cdfabe09ea15d2fdbe229", "InstalledFiles": [ "usr/bin/scanelf" ], "AnalyzedBy": "apk" }, { "ID": "ssl_client@1.37.0-r30", "Name": "ssl_client", "Identifier": { "PURL": "pkg:apk/alpine/ssl_client@1.37.0-r30?arch=x86_64\u0026distro=3.23.4", "UID": "f1acb8f2a8f94f51" }, "Version": "1.37.0-r30", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r30", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "libcrypto3@3.5.6-r0", "libssl3@3.5.6-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:5b6ec0939cfc9be47d9677a3152c547cc18b5edd", "InstalledFiles": [ "usr/bin/ssl_client" ], "AnalyzedBy": "apk" }, { "ID": "zlib@1.3.2-r0", "Name": "zlib", "Identifier": { "PURL": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64\u0026distro=3.23.4", "UID": "23a5a7d167a86311" }, "Version": "1.3.2-r0", "Arch": "x86_64", "SrcName": "zlib", "SrcVersion": "1.3.2-r0", "Licenses": [ "Zlib" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:68bb97ea5255e77aa974e65476d64832ad56288a", "InstalledFiles": [ "usr/lib/libz.so.1", "usr/lib/libz.so.1.3.2" ], "AnalyzedBy": "apk" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-14456", "PkgID": "libcrypto3@3.5.6-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "975680d851f10fda" }, "InstalledVersion": "3.5.6-r0", "FixedVersion": "3.5.8-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:e2f78b2162f4af45756d35ca39c721edd9853de5b5457cdef5972854fea5977a", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-45447", "PkgID": "libcrypto3@3.5.6-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "975680d851f10fda" }, "InstalledVersion": "3.5.6-r0", "FixedVersion": "3.5.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:98868d09db4f72e71c0f4a4adeb1ba3ac2dc15ed011d97fdc4f3a866091f6e2a", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-14456", "PkgID": "libssl3@3.5.6-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "aece396067dff154" }, "InstalledVersion": "3.5.6-r0", "FixedVersion": "3.5.8-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:853f0e39dfe56f62d9cee1cc765b8a237b7b357206e25888c14a9be6e7b51e5f", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-45447", "PkgID": "libssl3@3.5.6-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "aece396067dff154" }, "InstalledVersion": "3.5.6-r0", "FixedVersion": "3.5.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:af1df238ba8bd9376a0baba301c9a1f01d774fa02ba2787566eb5844afa4704d", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-107891", "PkgID": "musl@1.2.5-r23", "PkgName": "musl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/musl@1.2.5-r23?arch=x86_64\u0026distro=3.23.4", "UID": "dca30b3fd6708a32" }, "InstalledVersion": "1.2.5-r23", "FixedVersion": "1.2.5-r24", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-107891", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:94068118732008548c468155864690c6dfdfc75faf728dfc96df82d848ec3007", "Title": "musl: musl: Arbitrary code execution via integer overflow in regcomp", "Description": "musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/21/18", "https://access.redhat.com/security/cve/CVE-2026-107891", "https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941", "https://musl.libc.org", "https://nvd.nist.gov/vuln/detail/CVE-2026-107891", "https://www.cve.org/CVERecord?id=CVE-2026-107891", "https://www.openwall.com/lists/musl/2026/10/21/1" ], "PublishedDate": "2026-11-05T16:17:32.15Z", "LastModifiedDate": "2026-11-05T17:17:35.287Z" }, { "VulnerabilityID": "CVE-2026-107891", "PkgID": "musl-utils@1.2.5-r23", "PkgName": "musl-utils", "PkgIdentifier": { "PURL": "pkg:apk/alpine/musl-utils@1.2.5-r23?arch=x86_64\u0026distro=3.23.4", "UID": "ffcf7198a9776c5f" }, "InstalledVersion": "1.2.5-r23", "FixedVersion": "1.2.5-r24", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-107891", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:1bc0fadcb0ff8ca9be9e15311840f9a1352cb00a1744bf526bfb93fbb5d211de", "Title": "musl: musl: Arbitrary code execution via integer overflow in regcomp", "Description": "musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/21/18", "https://access.redhat.com/security/cve/CVE-2026-107891", "https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941", "https://musl.libc.org", "https://nvd.nist.gov/vuln/detail/CVE-2026-107891", "https://www.cve.org/CVERecord?id=CVE-2026-107891", "https://www.openwall.com/lists/musl/2026/10/21/1" ], "PublishedDate": "2026-11-05T16:17:32.15Z", "LastModifiedDate": "2026-11-05T17:17:35.287Z" }, { "VulnerabilityID": "CVE-2026-85091", "PkgID": "zlib@1.3.2-r0", "PkgName": "zlib", "PkgIdentifier": { "PURL": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64\u0026distro=3.23.4", "UID": "23a5a7d167a86311" }, "InstalledVersion": "1.3.2-r0", "FixedVersion": "1.3.2-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-85091", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:e1596b1cb4b04460749a648435d6e40e1ef42e00147e5732828d1f0e8e04f31a", "Title": "zlib: zlib: Heap buffer overflow in gz_vacate() allows arbitrary code execution", "Description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-85091", "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "https://github.com/madler/zlib", "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393", "https://nvd.nist.gov/vuln/detail/CVE-2026-85091", "https://ubuntu.com/security/notices/USN-8954-1", "https://www.cve.org/CVERecord?id=CVE-2026-85091", "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" ], "PublishedDate": "2026-09-03T13:06:20.573Z", "LastModifiedDate": "2026-09-09T20:41:07.123Z" } ] }, { "Target": "Java", "Class": "lang-pkgs", "Type": "jar", "Packages": [ { "Name": "aopalliance:aopalliance", "Identifier": { "PURL": "pkg:maven/aopalliance/aopalliance@1.0", "UID": "409f8ac992ae20d1" }, "Version": "1.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/aopalliance-1.0.jar", "AnalyzedBy": "jar" }, { "Name": "at.yawk.lz4:lz4-java", "Identifier": { "PURL": "pkg:maven/at.yawk.lz4/lz4-java@1.10.2", "UID": "1b92f33cd184c9fb" }, "Version": "1.10.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/lz4-java-1.10.2.jar", "AnalyzedBy": "jar" }, { "Name": "ch.qos.logback:logback-core", "Identifier": { "PURL": "pkg:maven/ch.qos.logback/logback-core@1.2.13", "UID": "82f21899d4a3aaea" }, "Version": "1.2.13", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/logback-core-1.2.13.jar", "AnalyzedBy": "jar" }, { "Name": "com.azure:azure-core", "Identifier": { "PURL": "pkg:maven/com.azure/azure-core@1.58.0", "UID": "3a4b5863a03144fe" }, "Version": "1.58.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/azure-core-1.58.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.azure:azure-core-http-netty", "Identifier": { "PURL": "pkg:maven/com.azure/azure-core-http-netty@1.16.4", "UID": "a59bc4601269fe89" }, "Version": "1.16.4", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/azure-core-http-netty-1.16.4.jar", "AnalyzedBy": "jar" }, { "Name": "com.azure:azure-identity", "Identifier": { "PURL": "pkg:maven/com.azure/azure-identity@1.18.3", "UID": "4f23cc09a5b104a1" }, "Version": "1.18.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/azure-identity-1.18.3.jar", "AnalyzedBy": "jar" }, { "Name": "com.azure:azure-json", "Identifier": { "PURL": "pkg:maven/com.azure/azure-json@1.5.1", "UID": "bb121d68eed6ecc6" }, "Version": "1.5.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/azure-json-1.5.1.jar", "AnalyzedBy": "jar" }, { "Name": "com.azure:azure-xml", "Identifier": { "PURL": "pkg:maven/com.azure/azure-xml@1.2.1", "UID": "1f837ed78b31b4d3" }, "Version": "1.2.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/azure-xml-1.2.1.jar", "AnalyzedBy": "jar" }, { "Name": "com.ethlo.time:itu", "Identifier": { "PURL": "pkg:maven/com.ethlo.time/itu@1.14.0", "UID": "f704f397faf94976" }, "Version": "1.14.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/itu-1.14.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.fasterxml.jackson.core:jackson-annotations", "Identifier": { "PURL": "pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.21", "UID": "7b788217053d8a4b" }, "Version": "2.21", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jackson-annotations-2.21.jar", "AnalyzedBy": "jar" }, { "Name": "com.fasterxml.jackson.core:jackson-core", "Identifier": { "PURL": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2", "UID": "88074c2bfde3aa7a" }, "Version": "2.21.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jackson-core-2.21.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.fasterxml.jackson.core:jackson-databind", "Identifier": { "PURL": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "UID": "edd04e3383cf7ac0" }, "Version": "2.21.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jackson-databind-2.21.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.fasterxml.jackson.dataformat:jackson-dataformat-xml", "Identifier": { "PURL": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-xml@2.21.2", "UID": "9c0fb02cefd40985" }, "Version": "2.21.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jackson-dataformat-xml-2.21.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.fasterxml.jackson.dataformat:jackson-dataformat-yaml", "Identifier": { "PURL": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml@2.21.2", "UID": "c514a7f3eb4a8f74" }, "Version": "2.21.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jackson-dataformat-yaml-2.21.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.fasterxml.jackson.datatype:jackson-datatype-jakarta-jsonp", "Identifier": { "PURL": "pkg:maven/com.fasterxml.jackson.datatype/jackson-datatype-jakarta-jsonp@2.21.2", "UID": "1622d7820a1f292d" }, "Version": "2.21.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jackson-datatype-jakarta-jsonp-2.21.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.fasterxml.jackson.datatype:jackson-datatype-jsr310", "Identifier": { "PURL": "pkg:maven/com.fasterxml.jackson.datatype/jackson-datatype-jsr310@2.21.2", "UID": "95d35a9a8d2c795c" }, "Version": "2.21.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jackson-datatype-jsr310-2.21.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.fasterxml.jackson.jaxrs:jackson-jaxrs-base", "Identifier": { "PURL": "pkg:maven/com.fasterxml.jackson.jaxrs/jackson-jaxrs-base@2.21.2", "UID": "1f8055bab51fc075" }, "Version": "2.21.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jackson-jaxrs-base-2.21.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider", "Identifier": { "PURL": "pkg:maven/com.fasterxml.jackson.jaxrs/jackson-jaxrs-json-provider@2.21.2", "UID": "7253cd4cab8bd21f" }, "Version": "2.21.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jackson-jaxrs-json-provider-2.21.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.fasterxml.jackson.module:jackson-module-blackbird", "Identifier": { "PURL": "pkg:maven/com.fasterxml.jackson.module/jackson-module-blackbird@2.21.2", "UID": "15af9498559ba9c6" }, "Version": "2.21.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jackson-module-blackbird-2.21.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations", "Identifier": { "PURL": "pkg:maven/com.fasterxml.jackson.module/jackson-module-jakarta-xmlbind-annotations@2.21.2", "UID": "4683959dfecfb734" }, "Version": "2.21.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jackson-module-jakarta-xmlbind-annotations-2.21.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.fasterxml.jackson.module:jackson-module-jaxb-annotations", "Identifier": { "PURL": "pkg:maven/com.fasterxml.jackson.module/jackson-module-jaxb-annotations@2.21.2", "UID": "db6bf839789a89d4" }, "Version": "2.21.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jackson-module-jaxb-annotations-2.21.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.fasterxml.woodstox:woodstox-core", "Identifier": { "PURL": "pkg:maven/com.fasterxml.woodstox/woodstox-core@7.0.0", "UID": "1aaa75efa3259945" }, "Version": "7.0.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/woodstox-core-7.0.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.github.cliftonlabs:json-simple", "Identifier": { "PURL": "pkg:maven/com.github.cliftonlabs/json-simple@3.0.2", "UID": "9f713ced4b34f3a9" }, "Version": "3.0.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/json-simple-3.0.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.github.jnr:jffi", "Identifier": { "PURL": "pkg:maven/com.github.jnr/jffi@1.3.15", "UID": "ab0f74b6400abc59" }, "Version": "1.3.15", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jffi-1.3.15-native.jar", "AnalyzedBy": "jar" }, { "Name": "com.github.jnr:jffi", "Identifier": { "PURL": "pkg:maven/com.github.jnr/jffi@1.3.15", "UID": "ae4008b8aad4d92a" }, "Version": "1.3.15", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jffi-1.3.15.jar", "AnalyzedBy": "jar" }, { "Name": "com.github.jnr:jnr-a64asm", "Identifier": { "PURL": "pkg:maven/com.github.jnr/jnr-a64asm@1.0.0", "UID": "9bf2c5d8e5e531d" }, "Version": "1.0.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jnr-a64asm-1.0.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.github.jnr:jnr-constants", "Identifier": { "PURL": "pkg:maven/com.github.jnr/jnr-constants@0.10.4", "UID": "6bc3d924cde22a57" }, "Version": "0.10.4", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jnr-constants-0.10.4.jar", "AnalyzedBy": "jar" }, { "Name": "com.github.jnr:jnr-ffi", "Identifier": { "PURL": "pkg:maven/com.github.jnr/jnr-ffi@2.2.19", "UID": "d70ba5e791a67742" }, "Version": "2.2.19", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jnr-ffi-2.2.19.jar", "AnalyzedBy": "jar" }, { "Name": "com.github.jnr:jnr-posix", "Identifier": { "PURL": "pkg:maven/com.github.jnr/jnr-posix@3.1.22", "UID": "dd44bc337315518e" }, "Version": "3.1.22", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jnr-posix-3.1.22.jar", "AnalyzedBy": "jar" }, { "Name": "com.github.jnr:jnr-x86asm", "Identifier": { "PURL": "pkg:maven/com.github.jnr/jnr-x86asm@1.0.2", "UID": "362dd89aee996e3a" }, "Version": "1.0.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jnr-x86asm-1.0.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.github.luben:zstd-jni", "Identifier": { "PURL": "pkg:maven/com.github.luben/zstd-jni@1.5.6-10", "UID": "7587a831d1c35d73" }, "Version": "1.5.6-10", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/zstd-jni-1.5.6-10.jar", "AnalyzedBy": "jar" }, { "Name": "com.github.stephenc.jcip:jcip-annotations", "Identifier": { "PURL": "pkg:maven/com.github.stephenc.jcip/jcip-annotations@1.0-1", "UID": "931bc3a38cd38fc7" }, "Version": "1.0-1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jcip-annotations-1.0-1.jar", "AnalyzedBy": "jar" }, { "Name": "com.github.stephenc.jcip:jcip-annotations", "Identifier": { "PURL": "pkg:maven/com.github.stephenc.jcip/jcip-annotations@1.0-1", "UID": "552b62546286794a" }, "Version": "1.0-1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/nimbus-jose-jwt-10.9.jar", "AnalyzedBy": "jar" }, { "Name": "com.github.virtuald:curvesapi", "Identifier": { "PURL": "pkg:maven/com.github.virtuald/curvesapi@1.07", "UID": "631b39ddcbade9eb" }, "Version": "1.07", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/curvesapi-1.07.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.android:annotations", "Identifier": { "PURL": "pkg:maven/com.google.android/annotations@4.1.1.4", "UID": "153819fa4001e80c" }, "Version": "4.1.1.4", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/annotations-4.1.1.4.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.api-client:google-api-client", "Identifier": { "PURL": "pkg:maven/com.google.api-client/google-api-client@2.7.2", "UID": "c084191180aa4a55" }, "Version": "2.7.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/google-api-client-2.7.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.api-client:google-api-client-gson", "Identifier": { "PURL": "pkg:maven/com.google.api-client/google-api-client-gson@2.7.2", "UID": "70b66dff7a54975f" }, "Version": "2.7.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/google-api-client-gson-2.7.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.api.grpc:gapic-google-cloud-storage-v2", "Identifier": { "PURL": "pkg:maven/com.google.api.grpc/gapic-google-cloud-storage-v2@2.64.0", "UID": "13ef36244b3f04a6" }, "Version": "2.64.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/gapic-google-cloud-storage-v2-2.64.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.api.grpc:grpc-google-cloud-storage-v2", "Identifier": { "PURL": "pkg:maven/com.google.api.grpc/grpc-google-cloud-storage-v2@2.64.0", "UID": "10b533a8e672a015" }, "Version": "2.64.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/grpc-google-cloud-storage-v2-2.64.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.api.grpc:proto-google-cloud-firestore-v1", "Identifier": { "PURL": "pkg:maven/com.google.api.grpc/proto-google-cloud-firestore-v1@3.38.0", "UID": "cb9885c44c591ed1" }, "Version": "3.38.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/proto-google-cloud-firestore-v1-3.38.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.api.grpc:proto-google-cloud-monitoring-v3", "Identifier": { "PURL": "pkg:maven/com.google.api.grpc/proto-google-cloud-monitoring-v3@3.52.0", "UID": "c7f00be4759a44a3" }, "Version": "3.52.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/proto-google-cloud-monitoring-v3-3.52.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.api.grpc:proto-google-cloud-storage-v2", "Identifier": { "PURL": "pkg:maven/com.google.api.grpc/proto-google-cloud-storage-v2@2.64.0", "UID": "89d59b01a126b2f8" }, "Version": "2.64.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/proto-google-cloud-storage-v2-2.64.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.api.grpc:proto-google-common-protos", "Identifier": { "PURL": "pkg:maven/com.google.api.grpc/proto-google-common-protos@2.66.0", "UID": "b93a1e9c9a88d739" }, "Version": "2.66.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/proto-google-common-protos-2.66.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.api.grpc:proto-google-iam-v1", "Identifier": { "PURL": "pkg:maven/com.google.api.grpc/proto-google-iam-v1@1.61.0", "UID": "36353b05aefdf67d" }, "Version": "1.61.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/proto-google-iam-v1-1.61.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.api:api-common", "Identifier": { "PURL": "pkg:maven/com.google.api/api-common@2.58.0", "UID": "d60d5c6b43b61bd5" }, "Version": "2.58.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/api-common-2.58.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.api:gax", "Identifier": { "PURL": "pkg:maven/com.google.api/gax@2.75.0", "UID": "57e410d374c8ca9e" }, "Version": "2.75.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/gax-2.75.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.api:gax-grpc", "Identifier": { "PURL": "pkg:maven/com.google.api/gax-grpc@2.75.0", "UID": "5ff097f7b9d752f" }, "Version": "2.75.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/gax-grpc-2.75.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.api:gax-httpjson", "Identifier": { "PURL": "pkg:maven/com.google.api/gax-httpjson@2.75.0", "UID": "214b688806485df7" }, "Version": "2.75.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/gax-httpjson-2.75.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.apis:google-api-services-storage", "Identifier": { "PURL": "pkg:maven/com.google.apis/google-api-services-storage@v1-rev20251118-2.0.0", "UID": "7ad21a9ef130acc5" }, "Version": "v1-rev20251118-2.0.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/google-api-services-storage-v1-rev20251118-2.0.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.auth:google-auth-library-credentials", "Identifier": { "PURL": "pkg:maven/com.google.auth/google-auth-library-credentials@1.43.0", "UID": "262933e16cf47235" }, "Version": "1.43.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/google-auth-library-credentials-1.43.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.auth:google-auth-library-oauth2-http", "Identifier": { "PURL": "pkg:maven/com.google.auth/google-auth-library-oauth2-http@1.43.0", "UID": "126907ee5d67d18a" }, "Version": "1.43.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/google-auth-library-oauth2-http-1.43.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.auto.value:auto-value-annotations", "Identifier": { "PURL": "pkg:maven/com.google.auto.value/auto-value-annotations@1.11.0", "UID": "470489ecb71cca77" }, "Version": "1.11.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/auto-value-annotations-1.11.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.cloud.opentelemetry:detector-resources-support", "Identifier": { "PURL": "pkg:maven/com.google.cloud.opentelemetry/detector-resources-support@0.33.0", "UID": "68db1faab7093b57" }, "Version": "0.33.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/detector-resources-support-0.33.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.cloud.opentelemetry:exporter-metrics", "Identifier": { "PURL": "pkg:maven/com.google.cloud.opentelemetry/exporter-metrics@0.33.0", "UID": "6df19455e99be0cb" }, "Version": "0.33.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/exporter-metrics-0.33.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.cloud.opentelemetry:shared-resourcemapping", "Identifier": { "PURL": "pkg:maven/com.google.cloud.opentelemetry/shared-resourcemapping@0.33.0", "UID": "33bbab6f7e6f1f13" }, "Version": "0.33.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/shared-resourcemapping-0.33.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.cloud:google-cloud-core", "Identifier": { "PURL": "pkg:maven/com.google.cloud/google-cloud-core@2.65.0", "UID": "caff27cc559cd9fc" }, "Version": "2.65.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/google-cloud-core-2.65.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.cloud:google-cloud-core-grpc", "Identifier": { "PURL": "pkg:maven/com.google.cloud/google-cloud-core-grpc@2.65.0", "UID": "fad5a2348cd71218" }, "Version": "2.65.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/google-cloud-core-grpc-2.65.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.cloud:google-cloud-core-http", "Identifier": { "PURL": "pkg:maven/com.google.cloud/google-cloud-core-http@2.65.0", "UID": "3e817a420953b341" }, "Version": "2.65.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/google-cloud-core-http-2.65.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.cloud:google-cloud-firestore", "Identifier": { "PURL": "pkg:maven/com.google.cloud/google-cloud-firestore@3.38.0", "UID": "9e6c9196ae4b2871" }, "Version": "3.38.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/google-cloud-firestore-3.38.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.cloud:google-cloud-monitoring", "Identifier": { "PURL": "pkg:maven/com.google.cloud/google-cloud-monitoring@3.52.0", "UID": "d646249f49bd417a" }, "Version": "3.52.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/google-cloud-monitoring-3.52.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.cloud:google-cloud-storage", "Identifier": { "PURL": "pkg:maven/com.google.cloud/google-cloud-storage@2.64.0", "UID": "94ba48e767e041bf" }, "Version": "2.64.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/google-cloud-storage-2.64.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.cloud:proto-google-cloud-firestore-bundle-v1", "Identifier": { "PURL": "pkg:maven/com.google.cloud/proto-google-cloud-firestore-bundle-v1@3.38.0", "UID": "87ec4c995ee764bc" }, "Version": "3.38.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/proto-google-cloud-firestore-bundle-v1-3.38.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.code.findbugs:jsr305", "Identifier": { "PURL": "pkg:maven/com.google.code.findbugs/jsr305@3.0.2", "UID": "75f06bbd91995d7a" }, "Version": "3.0.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jsr305-3.0.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.code.gson:gson", "Identifier": { "PURL": "pkg:maven/com.google.code.gson/gson@2.13.1", "UID": "4747bdb3e11c0145" }, "Version": "2.13.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/nimbus-jose-jwt-10.9.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.code.gson:gson", "Identifier": { "PURL": "pkg:maven/com.google.code.gson/gson@2.13.2", "UID": "9ece343ab9146be4" }, "Version": "2.13.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/gson-2.13.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.dagger:dagger", "Identifier": { "PURL": "pkg:maven/com.google.dagger/dagger@2.42", "UID": "f5d725a86ab0da2d" }, "Version": "2.42", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/dagger-2.42.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.errorprone:error_prone_annotations", "Identifier": { "PURL": "pkg:maven/com.google.errorprone/error_prone_annotations@2.42.0", "UID": "8f1b2907d03f362b" }, "Version": "2.42.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/error_prone_annotations-2.42.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.firebase:firebase-admin", "Identifier": { "PURL": "pkg:maven/com.google.firebase/firebase-admin@9.9.0", "UID": "ee4f8b60f30340b1" }, "Version": "9.9.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/firebase-admin-9.9.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.guava:failureaccess", "Identifier": { "PURL": "pkg:maven/com.google.guava/failureaccess@1.0.3", "UID": "d9616f52cfdffa11" }, "Version": "1.0.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/failureaccess-1.0.3.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.guava:guava", "Identifier": { "PURL": "pkg:maven/com.google.guava/guava@33.5.0-jre", "UID": "2046ef8c0aea6e9d" }, "Version": "33.5.0-jre", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/guava-33.5.0-jre.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.guava:listenablefuture", "Identifier": { "PURL": "pkg:maven/com.google.guava/listenablefuture@9999.0-empty-to-avoid-conflict-with-guava", "UID": "6aba51ded271929b" }, "Version": "9999.0-empty-to-avoid-conflict-with-guava", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.http-client:google-http-client", "Identifier": { "PURL": "pkg:maven/com.google.http-client/google-http-client@2.1.0", "UID": "3e4070a72534ac00" }, "Version": "2.1.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/google-http-client-2.1.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.http-client:google-http-client-apache-v2", "Identifier": { "PURL": "pkg:maven/com.google.http-client/google-http-client-apache-v2@2.1.0", "UID": "fe129c8e20bfc895" }, "Version": "2.1.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/google-http-client-apache-v2-2.1.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.http-client:google-http-client-appengine", "Identifier": { "PURL": "pkg:maven/com.google.http-client/google-http-client-appengine@2.1.0", "UID": "9f61a914327ef34b" }, "Version": "2.1.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/google-http-client-appengine-2.1.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.http-client:google-http-client-gson", "Identifier": { "PURL": "pkg:maven/com.google.http-client/google-http-client-gson@2.1.0", "UID": "6b41c205c18726b7" }, "Version": "2.1.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/google-http-client-gson-2.1.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.http-client:google-http-client-jackson2", "Identifier": { "PURL": "pkg:maven/com.google.http-client/google-http-client-jackson2@2.1.0", "UID": "8f85d70d5d7386aa" }, "Version": "2.1.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/google-http-client-jackson2-2.1.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.inject.extensions:guice-servlet", "Identifier": { "PURL": "pkg:maven/com.google.inject.extensions/guice-servlet@7.0.0", "UID": "c2ab3ddd6e578ba6" }, "Version": "7.0.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/guice-servlet-7.0.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.inject:guice", "Identifier": { "PURL": "pkg:maven/com.google.inject/guice@7.0.0", "UID": "4958a8130edde014" }, "Version": "7.0.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/guice-7.0.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.j2objc:j2objc-annotations", "Identifier": { "PURL": "pkg:maven/com.google.j2objc/j2objc-annotations@3.1", "UID": "940eee46887c7830" }, "Version": "3.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/j2objc-annotations-3.1.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.oauth-client:google-oauth-client", "Identifier": { "PURL": "pkg:maven/com.google.oauth-client/google-oauth-client@1.39.0", "UID": "624fd86208e6a97d" }, "Version": "1.39.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/google-oauth-client-1.39.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.openlocationcode:openlocationcode", "Identifier": { "PURL": "pkg:maven/com.google.openlocationcode/openlocationcode@1.0.4", "UID": "fb7af7010772e197" }, "Version": "1.0.4", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/openlocationcode-1.0.4.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.protobuf:protobuf-java", "Identifier": { "PURL": "pkg:maven/com.google.protobuf/protobuf-java@4.35.0", "UID": "128bfc483092b0e4" }, "Version": "4.35.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/protobuf-java-4.35.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.protobuf:protobuf-java-util", "Identifier": { "PURL": "pkg:maven/com.google.protobuf/protobuf-java-util@4.33.2", "UID": "5dc60f13b69329ea" }, "Version": "4.33.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/protobuf-java-util-4.33.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.google.re2j:re2j", "Identifier": { "PURL": "pkg:maven/com.google.re2j/re2j@1.8", "UID": "14180d3f4929cd81" }, "Version": "1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/re2j-1.8.jar", "AnalyzedBy": "jar" }, { "Name": "com.h2database:h2", "Identifier": { "PURL": "pkg:maven/com.h2database/h2@2.4.240", "UID": "87fa46105386939e" }, "Version": "2.4.240", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/h2-2.4.240.jar", "AnalyzedBy": "jar" }, { "Name": "com.hivemq:hivemq-mqtt-client", "Identifier": { "PURL": "pkg:maven/com.hivemq/hivemq-mqtt-client@1.3.14", "UID": "c6c97017727cc2ad" }, "Version": "1.3.14", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/hivemq-mqtt-client-1.3.14.jar", "AnalyzedBy": "jar" }, { "Name": "com.kohlschutter.junixsocket:junixsocket-common", "Identifier": { "PURL": "pkg:maven/com.kohlschutter.junixsocket/junixsocket-common@2.10.1", "UID": "41283d49c88a7e39" }, "Version": "2.10.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/junixsocket-common-2.10.1.jar", "AnalyzedBy": "jar" }, { "Name": "com.kohlschutter.junixsocket:junixsocket-mysql", "Identifier": { "PURL": "pkg:maven/com.kohlschutter.junixsocket/junixsocket-mysql@2.10.1", "UID": "962a5b980d46090" }, "Version": "2.10.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/junixsocket-mysql-2.10.1.jar", "AnalyzedBy": "jar" }, { "Name": "com.kohlschutter.junixsocket:junixsocket-native-common", "Identifier": { "PURL": "pkg:maven/com.kohlschutter.junixsocket/junixsocket-native-common@2.10.1", "UID": "65a972b04c009a35" }, "Version": "2.10.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/junixsocket-native-common-2.10.1.jar", "AnalyzedBy": "jar" }, { "Name": "com.microsoft.azure:msal4j", "Identifier": { "PURL": "pkg:maven/com.microsoft.azure/msal4j@1.23.1", "UID": "453a450cef99e2d6" }, "Version": "1.23.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/msal4j-1.23.1.jar", "AnalyzedBy": "jar" }, { "Name": "com.microsoft.azure:msal4j-persistence-extension", "Identifier": { "PURL": "pkg:maven/com.microsoft.azure/msal4j-persistence-extension@1.3.0", "UID": "5546a6df3cfae8a" }, "Version": "1.3.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/msal4j-persistence-extension-1.3.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.microsoft.sqlserver:mssql-jdbc", "Identifier": { "PURL": "pkg:maven/com.microsoft.sqlserver/mssql-jdbc@13.4.0", "UID": "1144c55fdb38cd" }, "Version": "13.4.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/mssql-jdbc-13.4.0.jre11.jar", "AnalyzedBy": "jar" }, { "Name": "com.microsoft.sqlserver:mssql-jdbc", "Identifier": { "PURL": "pkg:maven/com.microsoft.sqlserver/mssql-jdbc@13.4.0.jre11", "UID": "72adc26e9d92dd8f" }, "Version": "13.4.0.jre11", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/mssql-jdbc-13.4.0.jre11.jar", "AnalyzedBy": "jar" }, { "Name": "com.mysql:mysql-connector-j", "Identifier": { "PURL": "pkg:maven/com.mysql/mysql-connector-j@9.7.0", "UID": "7c4254a069f83688" }, "Version": "9.7.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/mysql-connector-j-9.7.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.networknt:json-schema-validator", "Identifier": { "PURL": "pkg:maven/com.networknt/json-schema-validator@2.0.0", "UID": "e11cf4b94911e0a5" }, "Version": "2.0.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/json-schema-validator-2.0.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.nimbusds:content-type", "Identifier": { "PURL": "pkg:maven/com.nimbusds/content-type@2.3", "UID": "52baaa422d5fba78" }, "Version": "2.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/content-type-2.3.jar", "AnalyzedBy": "jar" }, { "Name": "com.nimbusds:lang-tag", "Identifier": { "PURL": "pkg:maven/com.nimbusds/lang-tag@1.7", "UID": "4d0f22659598ebe4" }, "Version": "1.7", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/lang-tag-1.7.jar", "AnalyzedBy": "jar" }, { "Name": "com.nimbusds:nimbus-jose-jwt", "Identifier": { "PURL": "pkg:maven/com.nimbusds/nimbus-jose-jwt@10.9", "UID": "a1ce91cfac5c42a7" }, "Version": "10.9", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/nimbus-jose-jwt-10.9.jar", "AnalyzedBy": "jar" }, { "Name": "com.nimbusds:oauth2-oidc-sdk", "Identifier": { "PURL": "pkg:maven/com.nimbusds/oauth2-oidc-sdk@11.37.2", "UID": "d9dd8b93ad1f9672" }, "Version": "11.37.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/oauth2-oidc-sdk-11.37.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.opencsv:opencsv", "Identifier": { "PURL": "pkg:maven/com.opencsv/opencsv@5.12.0", "UID": "4d49e7a8cfc22a21" }, "Version": "5.12.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/opencsv-5.12.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.rabbitmq:amqp-client", "Identifier": { "PURL": "pkg:maven/com.rabbitmq/amqp-client@5.31.0", "UID": "8cdf2ca37fe2b141" }, "Version": "5.31.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/amqp-client-5.31.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.sun.activation:jakarta.activation", "Identifier": { "PURL": "pkg:maven/com.sun.activation/jakarta.activation@2.0.1", "UID": "85eb05a9748dedc5" }, "Version": "2.0.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jakarta.activation-2.0.1.jar", "AnalyzedBy": "jar" }, { "Name": "com.sun.mail:jakarta.mail", "Identifier": { "PURL": "pkg:maven/com.sun.mail/jakarta.mail@2.0.2", "UID": "e327b613beb40277" }, "Version": "2.0.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jakarta.mail-2.0.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.sun.xml.bind.jaxb:isorelax", "Identifier": { "PURL": "pkg:maven/com.sun.xml.bind.jaxb/isorelax@20090621", "UID": "ec7c56a7e717ebc9" }, "Version": "20090621", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/woodstox-core-7.0.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.warrenstrange:googleauth", "Identifier": { "PURL": "pkg:maven/com.warrenstrange/googleauth@1.5.0", "UID": "c6669a014b40a1ea" }, "Version": "1.5.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/googleauth-1.5.0.jar", "AnalyzedBy": "jar" }, { "Name": "com.zaxxer:HikariCP", "Identifier": { "PURL": "pkg:maven/com.zaxxer/HikariCP@7.0.2", "UID": "f8a64e2152f6b37d" }, "Version": "7.0.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/HikariCP-7.0.2.jar", "AnalyzedBy": "jar" }, { "Name": "com.zaxxer:SparseBitSet", "Identifier": { "PURL": "pkg:maven/com.zaxxer/SparseBitSet@1.2", "UID": "37411d5fd2845972" }, "Version": "1.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/SparseBitSet-1.2.jar", "AnalyzedBy": "jar" }, { "Name": "commons-beanutils:commons-beanutils", "Identifier": { "PURL": "pkg:maven/commons-beanutils/commons-beanutils@1.9.4", "UID": "790f20ab45a3c6f2" }, "Version": "1.9.4", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/commons-beanutils-1.9.4.jar", "AnalyzedBy": "jar" }, { "Name": "commons-codec:commons-codec", "Identifier": { "PURL": "pkg:maven/commons-codec/commons-codec@1.22.0", "UID": "54381d1a01c897d3" }, "Version": "1.22.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/commons-codec-1.22.0.jar", "AnalyzedBy": "jar" }, { "Name": "commons-collections:commons-collections", "Identifier": { "PURL": "pkg:maven/commons-collections/commons-collections@3.2.2", "UID": "77722eee09fa52ff" }, "Version": "3.2.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/commons-collections-3.2.2.jar", "AnalyzedBy": "jar" }, { "Name": "commons-io:commons-io", "Identifier": { "PURL": "pkg:maven/commons-io/commons-io@2.22.0", "UID": "d1190dad9fa30e32" }, "Version": "2.22.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/commons-io-2.22.0.jar", "AnalyzedBy": "jar" }, { "Name": "commons-logging:commons-logging", "Identifier": { "PURL": "pkg:maven/commons-logging/commons-logging@1.3.5", "UID": "bac8b7d5e7de54bd" }, "Version": "1.3.5", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/commons-logging-1.3.5.jar", "AnalyzedBy": "jar" }, { "Name": "io.grpc:grpc-alts", "Identifier": { "PURL": "pkg:maven/io.grpc/grpc-alts@1.76.3", "UID": "1eb8c4400d452f08" }, "Version": "1.76.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/grpc-alts-1.76.3.jar", "AnalyzedBy": "jar" }, { "Name": "io.grpc:grpc-api", "Identifier": { "PURL": "pkg:maven/io.grpc/grpc-api@1.76.3", "UID": "42e8c61bcfe92f8e" }, "Version": "1.76.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/grpc-api-1.76.3.jar", "AnalyzedBy": "jar" }, { "Name": "io.grpc:grpc-auth", "Identifier": { "PURL": "pkg:maven/io.grpc/grpc-auth@1.76.3", "UID": "1d1329414ec7b287" }, "Version": "1.76.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/grpc-auth-1.76.3.jar", "AnalyzedBy": "jar" }, { "Name": "io.grpc:grpc-context", "Identifier": { "PURL": "pkg:maven/io.grpc/grpc-context@1.76.3", "UID": "cd8d0b2ab954e362" }, "Version": "1.76.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/grpc-context-1.76.3.jar", "AnalyzedBy": "jar" }, { "Name": "io.grpc:grpc-core", "Identifier": { "PURL": "pkg:maven/io.grpc/grpc-core@1.76.3", "UID": "1ab2cd27028c283c" }, "Version": "1.76.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/grpc-core-1.76.3.jar", "AnalyzedBy": "jar" }, { "Name": "io.grpc:grpc-googleapis", "Identifier": { "PURL": "pkg:maven/io.grpc/grpc-googleapis@1.76.3", "UID": "1e52f9091838faa5" }, "Version": "1.76.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/grpc-googleapis-1.76.3.jar", "AnalyzedBy": "jar" }, { "Name": "io.grpc:grpc-grpclb", "Identifier": { "PURL": "pkg:maven/io.grpc/grpc-grpclb@1.76.3", "UID": "7e60cea57145e389" }, "Version": "1.76.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/grpc-grpclb-1.76.3.jar", "AnalyzedBy": "jar" }, { "Name": "io.grpc:grpc-inprocess", "Identifier": { "PURL": "pkg:maven/io.grpc/grpc-inprocess@1.76.3", "UID": "d598b7f2bbc79787" }, "Version": "1.76.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/grpc-inprocess-1.76.3.jar", "AnalyzedBy": "jar" }, { "Name": "io.grpc:grpc-netty-shaded", "Identifier": { "PURL": "pkg:maven/io.grpc/grpc-netty-shaded@1.76.3", "UID": "7563346e21a9b453" }, "Version": "1.76.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/grpc-netty-shaded-1.76.3.jar", "AnalyzedBy": "jar" }, { "Name": "io.grpc:grpc-opentelemetry", "Identifier": { "PURL": "pkg:maven/io.grpc/grpc-opentelemetry@1.76.3", "UID": "1a78b7b40c6fc918" }, "Version": "1.76.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/grpc-opentelemetry-1.76.3.jar", "AnalyzedBy": "jar" }, { "Name": "io.grpc:grpc-protobuf", "Identifier": { "PURL": "pkg:maven/io.grpc/grpc-protobuf@1.76.3", "UID": "608126f5769e2c0f" }, "Version": "1.76.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/grpc-protobuf-1.76.3.jar", "AnalyzedBy": "jar" }, { "Name": "io.grpc:grpc-protobuf-lite", "Identifier": { "PURL": "pkg:maven/io.grpc/grpc-protobuf-lite@1.76.3", "UID": "b650474a6d2ae865" }, "Version": "1.76.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/grpc-protobuf-lite-1.76.3.jar", "AnalyzedBy": "jar" }, { "Name": "io.grpc:grpc-rls", "Identifier": { "PURL": "pkg:maven/io.grpc/grpc-rls@1.76.3", "UID": "fb0d72f75d7b53af" }, "Version": "1.76.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/grpc-rls-1.76.3.jar", "AnalyzedBy": "jar" }, { "Name": "io.grpc:grpc-services", "Identifier": { "PURL": "pkg:maven/io.grpc/grpc-services@1.76.3", "UID": "e0be8e060d004a72" }, "Version": "1.76.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/grpc-services-1.76.3.jar", "AnalyzedBy": "jar" }, { "Name": "io.grpc:grpc-stub", "Identifier": { "PURL": "pkg:maven/io.grpc/grpc-stub@1.76.3", "UID": "b98fe381a44fd5cb" }, "Version": "1.76.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/grpc-stub-1.76.3.jar", "AnalyzedBy": "jar" }, { "Name": "io.grpc:grpc-util", "Identifier": { "PURL": "pkg:maven/io.grpc/grpc-util@1.76.3", "UID": "df65e6286bbe8a" }, "Version": "1.76.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/grpc-util-1.76.3.jar", "AnalyzedBy": "jar" }, { "Name": "io.grpc:grpc-xds", "Identifier": { "PURL": "pkg:maven/io.grpc/grpc-xds@1.76.3", "UID": "b9995cd51aa5aae1" }, "Version": "1.76.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/grpc-xds-1.76.3.jar", "AnalyzedBy": "jar" }, { "Name": "io.modelcontextprotocol.sdk:mcp-core", "Identifier": { "PURL": "pkg:maven/io.modelcontextprotocol.sdk/mcp-core@1.1.3", "UID": "1ee0c04623b35b80" }, "Version": "1.1.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/mcp-core-1.1.3.jar", "AnalyzedBy": "jar" }, { "Name": "io.modelcontextprotocol.sdk:mcp-json-jackson2", "Identifier": { "PURL": "pkg:maven/io.modelcontextprotocol.sdk/mcp-json-jackson2@1.1.3", "UID": "96436163e80220f" }, "Version": "1.1.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/mcp-json-jackson2-1.1.3.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-buffer", "Identifier": { "PURL": "pkg:maven/io.netty/netty-buffer@4.2.14.Final", "UID": "8018f2dd1d95e25" }, "Version": "4.2.14.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-buffer-4.2.14.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-codec", "Identifier": { "PURL": "pkg:maven/io.netty/netty-codec@4.2.14.Final", "UID": "1f0112eba40ef3d6" }, "Version": "4.2.14.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-codec-4.2.14.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-codec-base", "Identifier": { "PURL": "pkg:maven/io.netty/netty-codec-base@4.2.14.Final", "UID": "b397fbb38be5090d" }, "Version": "4.2.14.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-codec-base-4.2.14.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-codec-compression", "Identifier": { "PURL": "pkg:maven/io.netty/netty-codec-compression@4.2.14.Final", "UID": "4a1bf97e5d6f0984" }, "Version": "4.2.14.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-codec-compression-4.2.14.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-codec-dns", "Identifier": { "PURL": "pkg:maven/io.netty/netty-codec-dns@4.2.14.Final", "UID": "a7b6e3c2c60ea62c" }, "Version": "4.2.14.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-codec-dns-4.2.14.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-codec-http", "Identifier": { "PURL": "pkg:maven/io.netty/netty-codec-http@4.2.14.Final", "UID": "a109ef1fc23a0af6" }, "Version": "4.2.14.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-codec-http-4.2.14.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-codec-http2", "Identifier": { "PURL": "pkg:maven/io.netty/netty-codec-http2@4.1.133.Final", "UID": "c685c0a72139ff34" }, "Version": "4.1.133.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-codec-http2-4.1.133.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-codec-marshalling", "Identifier": { "PURL": "pkg:maven/io.netty/netty-codec-marshalling@4.2.14.Final", "UID": "cb23f52abbeac9cd" }, "Version": "4.2.14.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-codec-marshalling-4.2.14.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-codec-mqtt", "Identifier": { "PURL": "pkg:maven/io.netty/netty-codec-mqtt@4.2.14.Final", "UID": "5fbd60df8c89a844" }, "Version": "4.2.14.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-codec-mqtt-4.2.14.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-codec-protobuf", "Identifier": { "PURL": "pkg:maven/io.netty/netty-codec-protobuf@4.2.14.Final", "UID": "77c1d40684103b5b" }, "Version": "4.2.14.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-codec-protobuf-4.2.14.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-codec-socks", "Identifier": { "PURL": "pkg:maven/io.netty/netty-codec-socks@4.1.132.Final", "UID": "54e2e987c0fc22d5" }, "Version": "4.1.132.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-codec-socks-4.1.132.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-common", "Identifier": { "PURL": "pkg:maven/io.netty/netty-common@4.2.14.Final", "UID": "bdc5301a852c5063" }, "Version": "4.2.14.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-common-4.2.14.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-handler", "Identifier": { "PURL": "pkg:maven/io.netty/netty-handler@4.2.14.Final", "UID": "8d517df8484f9e2d" }, "Version": "4.2.14.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-handler-4.2.14.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-handler-proxy", "Identifier": { "PURL": "pkg:maven/io.netty/netty-handler-proxy@4.1.132.Final", "UID": "6dcfb897a98fa3ea" }, "Version": "4.1.132.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-handler-proxy-4.1.132.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-resolver", "Identifier": { "PURL": "pkg:maven/io.netty/netty-resolver@4.2.14.Final", "UID": "96d431b436e3d03b" }, "Version": "4.2.14.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-resolver-4.2.14.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-resolver-dns", "Identifier": { "PURL": "pkg:maven/io.netty/netty-resolver-dns@4.2.14.Final", "UID": "e79dfdf4c9cffc19" }, "Version": "4.2.14.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-resolver-dns-4.2.14.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-resolver-dns-classes-macos", "Identifier": { "PURL": "pkg:maven/io.netty/netty-resolver-dns-classes-macos@4.1.131.Final", "UID": "a2be13192f44b100" }, "Version": "4.1.131.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-resolver-dns-classes-macos-4.1.131.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-resolver-dns-native-macos", "Identifier": { "PURL": "pkg:maven/io.netty/netty-resolver-dns-native-macos@4.1.131.Final", "UID": "4fc7451ec52d2aa7" }, "Version": "4.1.131.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-resolver-dns-native-macos-4.1.131.Final-osx-x86_64.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-tcnative-boringssl-static", "Identifier": { "PURL": "pkg:maven/io.netty/netty-tcnative-boringssl-static@2.0.75.Final", "UID": "84e684a2bd3f4514" }, "Version": "2.0.75.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-tcnative-boringssl-static-2.0.75.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-tcnative-classes", "Identifier": { "PURL": "pkg:maven/io.netty/netty-tcnative-classes@2.0.75.Final", "UID": "21e9698cdf79ce38" }, "Version": "2.0.75.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-tcnative-classes-2.0.75.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-transport", "Identifier": { "PURL": "pkg:maven/io.netty/netty-transport@4.2.14.Final", "UID": "3d1c7afd971d1597" }, "Version": "4.2.14.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-transport-4.2.14.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-transport-classes-epoll", "Identifier": { "PURL": "pkg:maven/io.netty/netty-transport-classes-epoll@4.1.133.Final", "UID": "af201f5b472772ef" }, "Version": "4.1.133.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-transport-classes-epoll-4.1.133.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-transport-classes-kqueue", "Identifier": { "PURL": "pkg:maven/io.netty/netty-transport-classes-kqueue@4.1.132.Final", "UID": "1576c2aea24b642a" }, "Version": "4.1.132.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-transport-classes-kqueue-4.1.132.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-transport-native-epoll", "Identifier": { "PURL": "pkg:maven/io.netty/netty-transport-native-epoll@4.1.132.Final", "UID": "92ec4d0e00276221" }, "Version": "4.1.132.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-transport-native-epoll-4.1.132.Final-linux-x86_64.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-transport-native-kqueue", "Identifier": { "PURL": "pkg:maven/io.netty/netty-transport-native-kqueue@4.1.132.Final", "UID": "3cd4285c66a779ff" }, "Version": "4.1.132.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-transport-native-kqueue-4.1.132.Final-osx-x86_64.jar", "AnalyzedBy": "jar" }, { "Name": "io.netty:netty-transport-native-unix-common", "Identifier": { "PURL": "pkg:maven/io.netty/netty-transport-native-unix-common@4.2.14.Final", "UID": "5b05f3c77ec4db93" }, "Version": "4.2.14.Final", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-transport-native-unix-common-4.2.14.Final.jar", "AnalyzedBy": "jar" }, { "Name": "io.opencensus:opencensus-api", "Identifier": { "PURL": "pkg:maven/io.opencensus/opencensus-api@0.31.1", "UID": "844cf4c9fa543d04" }, "Version": "0.31.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/opencensus-api-0.31.1.jar", "AnalyzedBy": "jar" }, { "Name": "io.opencensus:opencensus-contrib-http-util", "Identifier": { "PURL": "pkg:maven/io.opencensus/opencensus-contrib-http-util@0.31.1", "UID": "206620b2a0caf71" }, "Version": "0.31.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/opencensus-contrib-http-util-0.31.1.jar", "AnalyzedBy": "jar" }, { "Name": "io.opentelemetry.contrib:opentelemetry-gcp-resources", "Identifier": { "PURL": "pkg:maven/io.opentelemetry.contrib/opentelemetry-gcp-resources@1.37.0-alpha", "UID": "6c9e4c6892508334" }, "Version": "1.37.0-alpha", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/opentelemetry-gcp-resources-1.37.0-alpha.jar", "AnalyzedBy": "jar" }, { "Name": "io.opentelemetry.instrumentation:opentelemetry-grpc-1.6", "Identifier": { "PURL": "pkg:maven/io.opentelemetry.instrumentation/opentelemetry-grpc-1.6@2.1.0-alpha", "UID": "b5ad4fb8e8fb801a" }, "Version": "2.1.0-alpha", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/opentelemetry-grpc-1.6-2.1.0-alpha.jar", "AnalyzedBy": "jar" }, { "Name": "io.opentelemetry.instrumentation:opentelemetry-instrumentation-api", "Identifier": { "PURL": "pkg:maven/io.opentelemetry.instrumentation/opentelemetry-instrumentation-api@2.1.0", "UID": "2abe8893f121c6f2" }, "Version": "2.1.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/opentelemetry-instrumentation-api-2.1.0.jar", "AnalyzedBy": "jar" }, { "Name": "io.opentelemetry.instrumentation:opentelemetry-instrumentation-api-incubator", "Identifier": { "PURL": "pkg:maven/io.opentelemetry.instrumentation/opentelemetry-instrumentation-api-incubator@2.1.0-alpha", "UID": "a1076fd86ac52ef2" }, "Version": "2.1.0-alpha", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/opentelemetry-instrumentation-api-incubator-2.1.0-alpha.jar", "AnalyzedBy": "jar" }, { "Name": "io.opentelemetry.semconv:opentelemetry-semconv", "Identifier": { "PURL": "pkg:maven/io.opentelemetry.semconv/opentelemetry-semconv@1.29.0-alpha", "UID": "6f1d4a9fc54b4532" }, "Version": "1.29.0-alpha", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/opentelemetry-semconv-1.29.0-alpha.jar", "AnalyzedBy": "jar" }, { "Name": "io.opentelemetry:opentelemetry-api", "Identifier": { "PURL": "pkg:maven/io.opentelemetry/opentelemetry-api@1.51.0", "UID": "b7b603b661a5a0e7" }, "Version": "1.51.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/opentelemetry-api-1.51.0.jar", "AnalyzedBy": "jar" }, { "Name": "io.opentelemetry:opentelemetry-context", "Identifier": { "PURL": "pkg:maven/io.opentelemetry/opentelemetry-context@1.51.0", "UID": "54158b62aa7368e5" }, "Version": "1.51.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/opentelemetry-context-1.51.0.jar", "AnalyzedBy": "jar" }, { "Name": "io.opentelemetry:opentelemetry-extension-incubator", "Identifier": { "PURL": "pkg:maven/io.opentelemetry/opentelemetry-extension-incubator@1.35.0-alpha", "UID": "750f2f47e7214ff" }, "Version": "1.35.0-alpha", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/opentelemetry-extension-incubator-1.35.0-alpha.jar", "AnalyzedBy": "jar" }, { "Name": "io.opentelemetry:opentelemetry-sdk", "Identifier": { "PURL": "pkg:maven/io.opentelemetry/opentelemetry-sdk@1.51.0", "UID": "47c0a6c4fe5b0c6e" }, "Version": "1.51.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/opentelemetry-sdk-1.51.0.jar", "AnalyzedBy": "jar" }, { "Name": "io.opentelemetry:opentelemetry-sdk-common", "Identifier": { "PURL": "pkg:maven/io.opentelemetry/opentelemetry-sdk-common@1.51.0", "UID": "ee375d5dff4adb4d" }, "Version": "1.51.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/opentelemetry-sdk-common-1.51.0.jar", "AnalyzedBy": "jar" }, { "Name": "io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi", "Identifier": { "PURL": "pkg:maven/io.opentelemetry/opentelemetry-sdk-extension-autoconfigure-spi@1.51.0", "UID": "58eeed3260b0c9c3" }, "Version": "1.51.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/opentelemetry-sdk-extension-autoconfigure-spi-1.51.0.jar", "AnalyzedBy": "jar" }, { "Name": "io.opentelemetry:opentelemetry-sdk-logs", "Identifier": { "PURL": "pkg:maven/io.opentelemetry/opentelemetry-sdk-logs@1.51.0", "UID": "a752c970af7073f" }, "Version": "1.51.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/opentelemetry-sdk-logs-1.51.0.jar", "AnalyzedBy": "jar" }, { "Name": "io.opentelemetry:opentelemetry-sdk-metrics", "Identifier": { "PURL": "pkg:maven/io.opentelemetry/opentelemetry-sdk-metrics@1.51.0", "UID": "60f9bed8b4c73ce6" }, "Version": "1.51.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/opentelemetry-sdk-metrics-1.51.0.jar", "AnalyzedBy": "jar" }, { "Name": "io.opentelemetry:opentelemetry-sdk-trace", "Identifier": { "PURL": "pkg:maven/io.opentelemetry/opentelemetry-sdk-trace@1.51.0", "UID": "894af2fc84bb6662" }, "Version": "1.51.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/opentelemetry-sdk-trace-1.51.0.jar", "AnalyzedBy": "jar" }, { "Name": "io.perfmark:perfmark-api", "Identifier": { "PURL": "pkg:maven/io.perfmark/perfmark-api@0.27.0", "UID": "6eda7e77a00c1deb" }, "Version": "0.27.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/perfmark-api-0.27.0.jar", "AnalyzedBy": "jar" }, { "Name": "io.projectreactor.netty:reactor-netty-core", "Identifier": { "PURL": "pkg:maven/io.projectreactor.netty/reactor-netty-core@1.2.16", "UID": "5058b7b85cb8e757" }, "Version": "1.2.16", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/reactor-netty-core-1.2.16.jar", "AnalyzedBy": "jar" }, { "Name": "io.projectreactor.netty:reactor-netty-http", "Identifier": { "PURL": "pkg:maven/io.projectreactor.netty/reactor-netty-http@1.2.16", "UID": "130ac096e6d647a5" }, "Version": "1.2.16", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/reactor-netty-http-1.2.16.jar", "AnalyzedBy": "jar" }, { "Name": "io.projectreactor:reactor-core", "Identifier": { "PURL": "pkg:maven/io.projectreactor/reactor-core@3.7.17", "UID": "b735a9c17183b692" }, "Version": "3.7.17", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/reactor-core-3.7.17.jar", "AnalyzedBy": "jar" }, { "Name": "io.reactivex.rxjava2:rxjava", "Identifier": { "PURL": "pkg:maven/io.reactivex.rxjava2/rxjava@2.2.21", "UID": "ccbfd8ab91133f40" }, "Version": "2.2.21", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/rxjava-2.2.21.jar", "AnalyzedBy": "jar" }, { "Name": "jakarta.activation:jakarta.activation-api", "Identifier": { "PURL": "pkg:maven/jakarta.activation/jakarta.activation-api@2.1.3", "UID": "84be3d1f6e0f6343" }, "Version": "2.1.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jakarta.activation-api-2.1.3.jar", "AnalyzedBy": "jar" }, { "Name": "jakarta.annotation:jakarta.annotation-api", "Identifier": { "PURL": "pkg:maven/jakarta.annotation/jakarta.annotation-api@3.0.0", "UID": "706d4eb19732e0a5" }, "Version": "3.0.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jakarta.annotation-api-3.0.0.jar", "AnalyzedBy": "jar" }, { "Name": "jakarta.enterprise:jakarta.enterprise.cdi-api", "Identifier": { "PURL": "pkg:maven/jakarta.enterprise/jakarta.enterprise.cdi-api@4.0.1", "UID": "bd90dd84825f3838" }, "Version": "4.0.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jakarta.enterprise.cdi-api-4.0.1.jar", "AnalyzedBy": "jar" }, { "Name": "jakarta.enterprise:jakarta.enterprise.lang-model", "Identifier": { "PURL": "pkg:maven/jakarta.enterprise/jakarta.enterprise.lang-model@4.0.1", "UID": "3054ba248009fb24" }, "Version": "4.0.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jakarta.enterprise.lang-model-4.0.1.jar", "AnalyzedBy": "jar" }, { "Name": "jakarta.inject:jakarta.inject-api", "Identifier": { "PURL": "pkg:maven/jakarta.inject/jakarta.inject-api@2.0.1", "UID": "8a72b82497a7b3fc" }, "Version": "2.0.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jakarta.inject-api-2.0.1.jar", "AnalyzedBy": "jar" }, { "Name": "jakarta.interceptor:jakarta.interceptor-api", "Identifier": { "PURL": "pkg:maven/jakarta.interceptor/jakarta.interceptor-api@2.1.0", "UID": "b8e8faab57b5a4b7" }, "Version": "2.1.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jakarta.interceptor-api-2.1.0.jar", "AnalyzedBy": "jar" }, { "Name": "jakarta.json:jakarta.json-api", "Identifier": { "PURL": "pkg:maven/jakarta.json/jakarta.json-api@2.1.3", "UID": "653b1ffd7b9343a5" }, "Version": "2.1.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jakarta.json-api-2.1.3.jar", "AnalyzedBy": "jar" }, { "Name": "jakarta.servlet:jakarta.servlet-api", "Identifier": { "PURL": "pkg:maven/jakarta.servlet/jakarta.servlet-api@6.0.0", "UID": "56c87febc2fc3604" }, "Version": "6.0.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jakarta.servlet-api-6.0.0.jar", "AnalyzedBy": "jar" }, { "Name": "jakarta.transaction:jakarta.transaction-api", "Identifier": { "PURL": "pkg:maven/jakarta.transaction/jakarta.transaction-api@2.0.1", "UID": "a45b44a1541de6cc" }, "Version": "2.0.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jakarta.transaction-api-2.0.1.jar", "AnalyzedBy": "jar" }, { "Name": "jakarta.validation:jakarta.validation-api", "Identifier": { "PURL": "pkg:maven/jakarta.validation/jakarta.validation-api@3.1.0", "UID": "455b52a0d2717753" }, "Version": "3.1.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jakarta.validation-api-3.1.0.jar", "AnalyzedBy": "jar" }, { "Name": "jakarta.websocket:jakarta.websocket-api", "Identifier": { "PURL": "pkg:maven/jakarta.websocket/jakarta.websocket-api@2.1.1", "UID": "732b746255329e8e" }, "Version": "2.1.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jakarta.websocket-api-2.1.1.jar", "AnalyzedBy": "jar" }, { "Name": "jakarta.websocket:jakarta.websocket-client-api", "Identifier": { "PURL": "pkg:maven/jakarta.websocket/jakarta.websocket-client-api@2.1.1", "UID": "4c360883bbe382d5" }, "Version": "2.1.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jakarta.websocket-client-api-2.1.1.jar", "AnalyzedBy": "jar" }, { "Name": "jakarta.ws.rs:jakarta.ws.rs-api", "Identifier": { "PURL": "pkg:maven/jakarta.ws.rs/jakarta.ws.rs-api@4.0.0", "UID": "1d6ff70ed679183a" }, "Version": "4.0.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jakarta.ws.rs-api-4.0.0.jar", "AnalyzedBy": "jar" }, { "Name": "jakarta.xml.bind:jakarta.xml.bind-api", "Identifier": { "PURL": "pkg:maven/jakarta.xml.bind/jakarta.xml.bind-api@4.0.2", "UID": "1002b3e0f5aac4d0" }, "Version": "4.0.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jakarta.xml.bind-api-4.0.2.jar", "AnalyzedBy": "jar" }, { "Name": "javax.activation:javax.activation-api", "Identifier": { "PURL": "pkg:maven/javax.activation/javax.activation-api@1.2.0", "UID": "826e3fcfb1fa78e" }, "Version": "1.2.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/javax.activation-api-1.2.0.jar", "AnalyzedBy": "jar" }, { "Name": "javax.annotation:javax.annotation-api", "Identifier": { "PURL": "pkg:maven/javax.annotation/javax.annotation-api@1.3.2", "UID": "1d068243a13f083d" }, "Version": "1.3.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/javax.annotation-api-1.3.2.jar", "AnalyzedBy": "jar" }, { "Name": "javax.inject:javax.inject", "Identifier": { "PURL": "pkg:maven/javax.inject/javax.inject@1", "UID": "188506c6ab3feddd" }, "Version": "1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/javax.inject-1.jar", "AnalyzedBy": "jar" }, { "Name": "javax.xml.bind:jaxb-api", "Identifier": { "PURL": "pkg:maven/javax.xml.bind/jaxb-api@2.3.1", "UID": "75edd47dcea04204" }, "Version": "2.3.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jaxb-api-2.3.1.jar", "AnalyzedBy": "jar" }, { "Name": "net.java.dev.jna:jna", "Identifier": { "PURL": "pkg:maven/net.java.dev.jna/jna@5.18.1", "UID": "8963dc0245e58495" }, "Version": "5.18.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jna-5.18.1.jar", "AnalyzedBy": "jar" }, { "Name": "net.java.dev.jna:jna-platform", "Identifier": { "PURL": "pkg:maven/net.java.dev.jna/jna-platform@5.18.1", "UID": "41a8185c9dc52332" }, "Version": "5.18.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jna-platform-5.18.1.jar", "AnalyzedBy": "jar" }, { "Name": "net.java.dev.msv:xsdlib", "Identifier": { "PURL": "pkg:maven/net.java.dev.msv/xsdlib@2022.7", "UID": "7e870545639057f2" }, "Version": "2022.7", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/woodstox-core-7.0.0.jar", "AnalyzedBy": "jar" }, { "Name": "net.minidev:accessors-smart", "Identifier": { "PURL": "pkg:maven/net.minidev/accessors-smart@2.6.0", "UID": "9c2dfb10ae5d1c8e" }, "Version": "2.6.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/accessors-smart-2.6.0.jar", "AnalyzedBy": "jar" }, { "Name": "net.minidev:json-smart", "Identifier": { "PURL": "pkg:maven/net.minidev/json-smart@2.6.0", "UID": "5528eb12adb17b2f" }, "Version": "2.6.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/json-smart-2.6.0.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.commons:commons-collections4", "Identifier": { "PURL": "pkg:maven/org.apache.commons/commons-collections4@4.5.0", "UID": "467c21ce337c1bd7" }, "Version": "4.5.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/commons-collections4-4.5.0.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.commons:commons-compress", "Identifier": { "PURL": "pkg:maven/org.apache.commons/commons-compress@1.22", "UID": "3f98642ecde851b8" }, "Version": "1.22", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/commons-compress-1.22.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.commons:commons-digester3", "Identifier": { "PURL": "pkg:maven/org.apache.commons/commons-digester3@3.2", "UID": "58c31262a79b1145" }, "Version": "3.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/commons-digester3-3.2.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.commons:commons-jexl3", "Identifier": { "PURL": "pkg:maven/org.apache.commons/commons-jexl3@3.6.2", "UID": "a1b7be3745798b5e" }, "Version": "3.6.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/commons-jexl3-3.6.2.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.commons:commons-lang3", "Identifier": { "PURL": "pkg:maven/org.apache.commons/commons-lang3@3.20.0", "UID": "9947e4ef087bb0aa" }, "Version": "3.20.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/commons-lang3-3.20.0.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.commons:commons-math3", "Identifier": { "PURL": "pkg:maven/org.apache.commons/commons-math3@3.6.1", "UID": "379c84f19b8993bf" }, "Version": "3.6.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/commons-math3-3.6.1.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.commons:commons-pool2", "Identifier": { "PURL": "pkg:maven/org.apache.commons/commons-pool2@2.12.1", "UID": "5be83fb013871c62" }, "Version": "2.12.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/commons-pool2-2.12.1.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.commons:commons-text", "Identifier": { "PURL": "pkg:maven/org.apache.commons/commons-text@1.15.0", "UID": "809d28b3fe9d42a7" }, "Version": "1.15.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/commons-text-1.15.0.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.httpcomponents.client5:httpclient5", "Identifier": { "PURL": "pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.3.1", "UID": "2851213e7e457588" }, "Version": "5.3.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/httpclient5-5.3.1.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.httpcomponents.core5:httpcore5", "Identifier": { "PURL": "pkg:maven/org.apache.httpcomponents.core5/httpcore5@5.2.4", "UID": "3755fe56fd8ed4a4" }, "Version": "5.2.4", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/httpcore5-5.2.4.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.httpcomponents.core5:httpcore5-h2", "Identifier": { "PURL": "pkg:maven/org.apache.httpcomponents.core5/httpcore5-h2@5.2.4", "UID": "ff06854d8c64c696" }, "Version": "5.2.4", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/httpcore5-h2-5.2.4.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.httpcomponents:httpclient", "Identifier": { "PURL": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.14", "UID": "2cadd97deacf0af4" }, "Version": "4.5.14", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/httpclient-4.5.14.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.httpcomponents:httpcore", "Identifier": { "PURL": "pkg:maven/org.apache.httpcomponents/httpcore@4.4.16", "UID": "556b9ee5b7a084c8" }, "Version": "4.4.16", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/httpcore-4.4.16.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.kafka:kafka-clients", "Identifier": { "PURL": "pkg:maven/org.apache.kafka/kafka-clients@4.3.0", "UID": "3f99e1f1c83697e9" }, "Version": "4.3.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/kafka-clients-4.3.0.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.logging.log4j:log4j-api", "Identifier": { "PURL": "pkg:maven/org.apache.logging.log4j/log4j-api@2.17.2", "UID": "14e703665a78808" }, "Version": "2.17.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/log4j-api-2.17.2.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.poi:poi", "Identifier": { "PURL": "pkg:maven/org.apache.poi/poi@5.2.2", "UID": "62954057a0c16707" }, "Version": "5.2.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/poi-5.2.2.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.poi:poi-ooxml", "Identifier": { "PURL": "pkg:maven/org.apache.poi/poi-ooxml@5.2.2", "UID": "e1131b4de09ea342" }, "Version": "5.2.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/poi-ooxml-5.2.2.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.poi:poi-ooxml-lite", "Identifier": { "PURL": "pkg:maven/org.apache.poi/poi-ooxml-lite@5.2.2", "UID": "794f46345b344eb0" }, "Version": "5.2.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/poi-ooxml-lite-5.2.2.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.velocity.tools:velocity-tools-generic", "Identifier": { "PURL": "pkg:maven/org.apache.velocity.tools/velocity-tools-generic@3.1", "UID": "103aadc158d327d8" }, "Version": "3.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/velocity-tools-generic-3.1.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.velocity:velocity-engine-core", "Identifier": { "PURL": "pkg:maven/org.apache.velocity/velocity-engine-core@2.4.1", "UID": "eb2052228e927f2a" }, "Version": "2.4.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/velocity-engine-core-2.4.1.jar", "AnalyzedBy": "jar" }, { "Name": "org.apache.xmlbeans:xmlbeans", "Identifier": { "PURL": "pkg:maven/org.apache.xmlbeans/xmlbeans@5.0.3", "UID": "3f98bdba1870f674" }, "Version": "5.0.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/xmlbeans-5.0.3.jar", "AnalyzedBy": "jar" }, { "Name": "org.checkerframework:checker-qual", "Identifier": { "PURL": "pkg:maven/org.checkerframework/checker-qual@3.49.0", "UID": "ae886d7cfd931519" }, "Version": "3.49.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/checker-qual-3.49.0.jar", "AnalyzedBy": "jar" }, { "Name": "org.codehaus.mojo:animal-sniffer-annotations", "Identifier": { "PURL": "pkg:maven/org.codehaus.mojo/animal-sniffer-annotations@1.24", "UID": "20401490d3d0e21a" }, "Version": "1.24", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/animal-sniffer-annotations-1.24.jar", "AnalyzedBy": "jar" }, { "Name": "org.codehaus.woodstox:stax2-api", "Identifier": { "PURL": "pkg:maven/org.codehaus.woodstox/stax2-api@4.2.2", "UID": "cb06f146c30ac4b9" }, "Version": "4.2.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/stax2-api-4.2.2.jar", "AnalyzedBy": "jar" }, { "Name": "org.conscrypt:conscrypt-openjdk-uber", "Identifier": { "PURL": "pkg:maven/org.conscrypt/conscrypt-openjdk-uber@2.5.2", "UID": "1024a9d9190802b6" }, "Version": "2.5.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/conscrypt-openjdk-uber-2.5.2.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.compression:jetty-compression-common", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.compression/jetty-compression-common@12.1.8", "UID": "3b91ef3491693a18" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-compression-common-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.compression:jetty-compression-gzip", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.compression/jetty-compression-gzip@12.1.8", "UID": "ebff6101d8e5641b" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-compression-gzip-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.compression:jetty-compression-server", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.compression/jetty-compression-server@12.1.8", "UID": "117f4870b84bdc89" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-compression-server-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jakarta-client", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jakarta-client@12.1.8", "UID": "fcfd8699ced3f093" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-ee10-websocket-jakarta-client-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jakarta-common", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jakarta-common@12.1.8", "UID": "f6676f255b7eeb94" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-ee10-websocket-jakarta-common-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jakarta-server", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jakarta-server@12.1.8", "UID": "222c96c7956c2aef" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-ee10-websocket-jakarta-server-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.1.8", "UID": "5f8e2fa47ee2c925" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-ee10-websocket-jetty-server-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-servlet", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-servlet@12.1.8", "UID": "d727304b2c6ab135" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-ee10-websocket-servlet-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.ee10:jetty-ee10-annotations", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.1.8", "UID": "28cdbbf00c24d8c5" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-ee10-annotations-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.ee10:jetty-ee10-plus", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-plus@12.1.8", "UID": "2845bc3df49185cd" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-ee10-plus-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.ee10:jetty-ee10-proxy", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-proxy@12.1.8", "UID": "2154db13752e9e6b" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-ee10-proxy-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.ee10:jetty-ee10-servlet", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-servlet@12.1.8", "UID": "692eecfa24b1a6e7" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-ee10-servlet-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.ee10:jetty-ee10-servlets", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-servlets@12.1.8", "UID": "165618344e5c13c2" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-ee10-servlets-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.ee10:jetty-ee10-webapp", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-webapp@12.1.8", "UID": "ab27ec352803b13d" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-ee10-webapp-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.ee:jetty-ee-webapp", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.ee/jetty-ee-webapp@12.1.8", "UID": "d00214963142aded" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-ee-webapp-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.websocket:jetty-websocket-core-client", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.1.8", "UID": "b5963781b77e0f63" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-websocket-core-client-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.websocket:jetty-websocket-core-common", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-common@12.1.8", "UID": "bae8649a39095d66" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-websocket-core-common-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.websocket:jetty-websocket-core-server", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.1.8", "UID": "ca6e6b51088bbd95" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-websocket-core-server-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.websocket:jetty-websocket-jetty-api", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-jetty-api@12.1.8", "UID": "37609bfe11653c42" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-websocket-jetty-api-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.websocket:jetty-websocket-jetty-common", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-jetty-common@12.1.8", "UID": "4aa11187c62eb14a" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-websocket-jetty-common-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty.websocket:jetty-websocket-jetty-server", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-jetty-server@12.1.8", "UID": "e0788253f2c80d8a" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-websocket-jetty-server-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty:jetty-alpn-client", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty/jetty-alpn-client@12.1.8", "UID": "a10c98e5194e5290" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-alpn-client-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty:jetty-annotations", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty/jetty-annotations@12.1.8", "UID": "efdb0488b5c5ce1b" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-annotations-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty:jetty-client", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty/jetty-client@12.1.8", "UID": "eec03898933ecd7d" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-client-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty:jetty-http", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty/jetty-http@12.1.8", "UID": "4b24f921e38a0c7f" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-http-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty:jetty-io", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty/jetty-io@12.1.8", "UID": "4641c1cacf0d9928" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-io-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty:jetty-jndi", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty/jetty-jndi@12.1.8", "UID": "f1f84cec030acbe1" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-jndi-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty:jetty-plus", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty/jetty-plus@12.1.8", "UID": "a385ecb9e34aaed8" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-plus-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty:jetty-security", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty/jetty-security@12.1.8", "UID": "8c6caab2462987ec" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-security-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty:jetty-server", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty/jetty-server@12.1.8", "UID": "85810d120dd7c6e5" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-server-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty:jetty-session", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty/jetty-session@12.1.8", "UID": "e36e6deafec17f69" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-session-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty:jetty-util", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty/jetty-util@12.1.8", "UID": "42b91a44e933c8ca" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-util-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.eclipse.jetty:jetty-xml", "Identifier": { "PURL": "pkg:maven/org.eclipse.jetty/jetty-xml@12.1.8", "UID": "bade7b227a6c1113" }, "Version": "12.1.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jetty-xml-12.1.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.glassfish.hk2.external:aopalliance-repackaged", "Identifier": { "PURL": "pkg:maven/org.glassfish.hk2.external/aopalliance-repackaged@4.0.0-M3", "UID": "5962919649705eb6" }, "Version": "4.0.0-M3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/aopalliance-repackaged-4.0.0-M3.jar", "AnalyzedBy": "jar" }, { "Name": "org.glassfish.hk2:guice-bridge", "Identifier": { "PURL": "pkg:maven/org.glassfish.hk2/guice-bridge@4.0.0-M3", "UID": "7ab54767f1b5214e" }, "Version": "4.0.0-M3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/guice-bridge-4.0.0-M3.jar", "AnalyzedBy": "jar" }, { "Name": "org.glassfish.hk2:hk2-api", "Identifier": { "PURL": "pkg:maven/org.glassfish.hk2/hk2-api@4.0.0-M3", "UID": "2a62af20147b6d9" }, "Version": "4.0.0-M3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/hk2-api-4.0.0-M3.jar", "AnalyzedBy": "jar" }, { "Name": "org.glassfish.hk2:hk2-locator", "Identifier": { "PURL": "pkg:maven/org.glassfish.hk2/hk2-locator@4.0.0-M3", "UID": "d3fa9594d448bfbb" }, "Version": "4.0.0-M3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/hk2-locator-4.0.0-M3.jar", "AnalyzedBy": "jar" }, { "Name": "org.glassfish.hk2:hk2-utils", "Identifier": { "PURL": "pkg:maven/org.glassfish.hk2/hk2-utils@4.0.0-M3", "UID": "1c6f6f1c8bea8777" }, "Version": "4.0.0-M3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/hk2-utils-4.0.0-M3.jar", "AnalyzedBy": "jar" }, { "Name": "org.glassfish.hk2:osgi-resource-locator", "Identifier": { "PURL": "pkg:maven/org.glassfish.hk2/osgi-resource-locator@3.0.0", "UID": "ccdad50ce11918f4" }, "Version": "3.0.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/osgi-resource-locator-3.0.0.jar", "AnalyzedBy": "jar" }, { "Name": "org.glassfish.jersey.containers:jersey-container-servlet", "Identifier": { "PURL": "pkg:maven/org.glassfish.jersey.containers/jersey-container-servlet@4.0.2", "UID": "705623876da113c4" }, "Version": "4.0.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jersey-container-servlet-4.0.2.jar", "AnalyzedBy": "jar" }, { "Name": "org.glassfish.jersey.core:jersey-client", "Identifier": { "PURL": "pkg:maven/org.glassfish.jersey.core/jersey-client@4.0.2", "UID": "22956bc39996443" }, "Version": "4.0.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jersey-client-4.0.2.jar", "AnalyzedBy": "jar" }, { "Name": "org.glassfish.jersey.core:jersey-common", "Identifier": { "PURL": "pkg:maven/org.glassfish.jersey.core/jersey-common@4.0.2", "UID": "7972616ae6226a15" }, "Version": "4.0.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jersey-common-4.0.2.jar", "AnalyzedBy": "jar" }, { "Name": "org.glassfish.jersey.core:jersey-server", "Identifier": { "PURL": "pkg:maven/org.glassfish.jersey.core/jersey-server@4.0.2", "UID": "efacedf70fe4786" }, "Version": "4.0.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jersey-server-4.0.2.jar", "AnalyzedBy": "jar" }, { "Name": "org.glassfish.jersey.ext:jersey-entity-filtering", "Identifier": { "PURL": "pkg:maven/org.glassfish.jersey.ext/jersey-entity-filtering@4.0.2", "UID": "82597985aa6bfea9" }, "Version": "4.0.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jersey-entity-filtering-4.0.2.jar", "AnalyzedBy": "jar" }, { "Name": "org.glassfish.jersey.inject:jersey-hk2", "Identifier": { "PURL": "pkg:maven/org.glassfish.jersey.inject/jersey-hk2@4.0.2", "UID": "dbd71fb7c356b4df" }, "Version": "4.0.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jersey-hk2-4.0.2.jar", "AnalyzedBy": "jar" }, { "Name": "org.glassfish.jersey.media:jersey-media-json-jackson", "Identifier": { "PURL": "pkg:maven/org.glassfish.jersey.media/jersey-media-json-jackson@4.0.2", "UID": "3d8b5fe0b16d7d60" }, "Version": "4.0.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jersey-media-json-jackson-4.0.2.jar", "AnalyzedBy": "jar" }, { "Name": "org.glassfish:jakarta.json", "Identifier": { "PURL": "pkg:maven/org.glassfish/jakarta.json@2.0.1", "UID": "57903d9be3de95fc" }, "Version": "2.0.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jakarta.json-2.0.1.jar", "AnalyzedBy": "jar" }, { "Name": "org.javassist:javassist", "Identifier": { "PURL": "pkg:maven/org.javassist/javassist@3.30.2-GA", "UID": "375b957519147f04" }, "Version": "3.30.2-GA", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/javassist-3.30.2-GA.jar", "AnalyzedBy": "jar" }, { "Name": "org.jctools:jctools-core", "Identifier": { "PURL": "pkg:maven/org.jctools/jctools-core@2.1.2", "UID": "d5180c42867737d6" }, "Version": "2.1.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jctools-core-2.1.2.jar", "AnalyzedBy": "jar" }, { "Name": "org.jctools:jctools-core", "Identifier": { "PURL": "pkg:maven/org.jctools/jctools-core@4.0.5", "UID": "edb4922e7e96dc43" }, "Version": "4.0.5", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/opentelemetry-sdk-trace-1.51.0.jar", "AnalyzedBy": "jar" }, { "Name": "org.jctools:jctools-core", "Identifier": { "PURL": "pkg:maven/org.jctools/jctools-core@4.0.6", "UID": "bed5c66af9f3173" }, "Version": "4.0.6", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-common-4.2.14.Final.jar", "AnalyzedBy": "jar" }, { "Name": "org.jetbrains:annotations", "Identifier": { "PURL": "pkg:maven/org.jetbrains/annotations@26.1.0", "UID": "9baa2ff3729fe7d9" }, "Version": "26.1.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/annotations-26.1.0.jar", "AnalyzedBy": "jar" }, { "Name": "org.json:json", "Identifier": { "PURL": "pkg:maven/org.json/json@20251224", "UID": "44d11fefdaa5c580" }, "Version": "20251224", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/json-20251224.jar", "AnalyzedBy": "jar" }, { "Name": "org.jspecify:jspecify", "Identifier": { "PURL": "pkg:maven/org.jspecify/jspecify@1.0.0", "UID": "6b660b77f7104c51" }, "Version": "1.0.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jspecify-1.0.0.jar", "AnalyzedBy": "jar" }, { "Name": "org.jxls:jxls", "Identifier": { "PURL": "pkg:maven/org.jxls/jxls@2.14.0", "UID": "c6c26f94d4a4e068" }, "Version": "2.14.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jxls-2.14.0.jar", "AnalyzedBy": "jar" }, { "Name": "org.jxls:jxls-poi", "Identifier": { "PURL": "pkg:maven/org.jxls/jxls-poi@2.14.0", "UID": "78d746ddbccb448c" }, "Version": "2.14.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jxls-poi-2.14.0.jar", "AnalyzedBy": "jar" }, { "Name": "org.liquibase:liquibase-core", "Identifier": { "PURL": "pkg:maven/org.liquibase/liquibase-core@5.0.3", "UID": "f3a4a2fee1b5b9bf" }, "Version": "5.0.3", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/liquibase-core-5.0.3.jar", "AnalyzedBy": "jar" }, { "Name": "org.locationtech.jts:jts-core", "Identifier": { "PURL": "pkg:maven/org.locationtech.jts/jts-core@1.20.0", "UID": "6330ca2daf0533a3" }, "Version": "1.20.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jts-core-1.20.0.jar", "AnalyzedBy": "jar" }, { "Name": "org.locationtech.spatial4j:spatial4j", "Identifier": { "PURL": "pkg:maven/org.locationtech.spatial4j/spatial4j@0.8", "UID": "579e989dc56f2b66" }, "Version": "0.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/spatial4j-0.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.mariadb.jdbc:mariadb-java-client", "Identifier": { "PURL": "pkg:maven/org.mariadb.jdbc/mariadb-java-client@3.5.8", "UID": "6b92d3f2d97a7f6c" }, "Version": "3.5.8", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/mariadb-java-client-3.5.8.jar", "AnalyzedBy": "jar" }, { "Name": "org.mnode.ical4j:ical4j", "Identifier": { "PURL": "pkg:maven/org.mnode.ical4j/ical4j@4.2.5", "UID": "25e6798e759b6d33" }, "Version": "4.2.5", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/ical4j-4.2.5.jar", "AnalyzedBy": "jar" }, { "Name": "org.ow2.asm:asm", "Identifier": { "PURL": "pkg:maven/org.ow2.asm/asm@9.9.1", "UID": "82bd388bbf37c396" }, "Version": "9.9.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/asm-9.9.1.jar", "AnalyzedBy": "jar" }, { "Name": "org.ow2.asm:asm-analysis", "Identifier": { "PURL": "pkg:maven/org.ow2.asm/asm-analysis@9.7.1", "UID": "e99e84bced5e9a06" }, "Version": "9.7.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/asm-analysis-9.7.1.jar", "AnalyzedBy": "jar" }, { "Name": "org.ow2.asm:asm-commons", "Identifier": { "PURL": "pkg:maven/org.ow2.asm/asm-commons@9.9.1", "UID": "b67cfc5810838d43" }, "Version": "9.9.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/asm-commons-9.9.1.jar", "AnalyzedBy": "jar" }, { "Name": "org.ow2.asm:asm-tree", "Identifier": { "PURL": "pkg:maven/org.ow2.asm/asm-tree@9.9.1", "UID": "d71433bdf09db7e7" }, "Version": "9.9.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/asm-tree-9.9.1.jar", "AnalyzedBy": "jar" }, { "Name": "org.ow2.asm:asm-util", "Identifier": { "PURL": "pkg:maven/org.ow2.asm/asm-util@9.7.1", "UID": "8b974de1760e02dc" }, "Version": "9.7.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/asm-util-9.7.1.jar", "AnalyzedBy": "jar" }, { "Name": "org.postgresql:postgresql", "Identifier": { "PURL": "pkg:maven/org.postgresql/postgresql@42.7.11", "UID": "a5bdf32a5def212b" }, "Version": "42.7.11", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/postgresql-42.7.11.jar", "AnalyzedBy": "jar" }, { "Name": "org.reactivestreams:reactive-streams", "Identifier": { "PURL": "pkg:maven/org.reactivestreams/reactive-streams@1.0.4", "UID": "2dce4004d254f843" }, "Version": "1.0.4", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/reactive-streams-1.0.4.jar", "AnalyzedBy": "jar" }, { "Name": "org.slf4j:jcl-over-slf4j", "Identifier": { "PURL": "pkg:maven/org.slf4j/jcl-over-slf4j@1.7.30", "UID": "f4292fbe39efa977" }, "Version": "1.7.30", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jcl-over-slf4j-1.7.30.jar", "AnalyzedBy": "jar" }, { "Name": "org.slf4j:slf4j-api", "Identifier": { "PURL": "pkg:maven/org.slf4j/slf4j-api@2.0.18", "UID": "94fe03bb66fb6097" }, "Version": "2.0.18", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/slf4j-api-2.0.18.jar", "AnalyzedBy": "jar" }, { "Name": "org.slf4j:slf4j-jdk14", "Identifier": { "PURL": "pkg:maven/org.slf4j/slf4j-jdk14@2.0.18", "UID": "54672cc54b9201b5" }, "Version": "2.0.18", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/slf4j-jdk14-2.0.18.jar", "AnalyzedBy": "jar" }, { "Name": "org.threeten:threeten-extra", "Identifier": { "PURL": "pkg:maven/org.threeten/threeten-extra@1.8.0", "UID": "e0a2397ddc491b3f" }, "Version": "1.8.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/threeten-extra-1.8.0.jar", "AnalyzedBy": "jar" }, { "Name": "org.threeten:threetenbp", "Identifier": { "PURL": "pkg:maven/org.threeten/threetenbp@1.7.0", "UID": "e9224e81fbbb43c7" }, "Version": "1.7.0", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/threetenbp-1.7.0.jar", "AnalyzedBy": "jar" }, { "Name": "org.xerial.snappy:snappy-java", "Identifier": { "PURL": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7", "UID": "ddd24e99ea754f81" }, "Version": "1.1.10.7", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/snappy-java-1.1.10.7.jar", "AnalyzedBy": "jar" }, { "Name": "org.yaml:snakeyaml", "Identifier": { "PURL": "pkg:maven/org.yaml/snakeyaml@2.6", "UID": "bb852b25def3eafb" }, "Version": "2.6", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/snakeyaml-2.6.jar", "AnalyzedBy": "jar" }, { "Name": "redis.clients.authentication:redis-authx-core", "Identifier": { "PURL": "pkg:maven/redis.clients.authentication/redis-authx-core@0.1.1-beta2", "UID": "525e5607f81a4184" }, "Version": "0.1.1-beta2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/redis-authx-core-0.1.1-beta2.jar", "AnalyzedBy": "jar" }, { "Name": "redis.clients:jedis", "Identifier": { "PURL": "pkg:maven/redis.clients/jedis@7.5.2", "UID": "d81d7876b4193f78" }, "Version": "7.5.2", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/jedis-7.5.2.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:annotations", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/annotations@2.45.1", "UID": "bb2cdf9573922276" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/annotations-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:apache-client", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/apache-client@2.45.1", "UID": "97a28c05e98788ea" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/apache-client-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:auth", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/auth@2.45.1", "UID": "4c6f6ec6a24ed967" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/auth-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:aws-core", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/aws-core@2.45.1", "UID": "dbe9b0a11a13e1cf" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/aws-core-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:aws-query-protocol", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/aws-query-protocol@2.45.1", "UID": "ce547a7c66ff446e" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/aws-query-protocol-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:checksums", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/checksums@2.45.1", "UID": "4cec83ba5310225" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/checksums-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:checksums-spi", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/checksums-spi@2.45.1", "UID": "b35d250fc54561f4" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/checksums-spi-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:endpoints-spi", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/endpoints-spi@2.45.1", "UID": "8972fbb6d789b0b" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/endpoints-spi-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:http-auth", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/http-auth@2.45.1", "UID": "3178eac622e09cd4" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/http-auth-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:http-auth-aws", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/http-auth-aws@2.45.1", "UID": "2af062520ef811" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/http-auth-aws-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:http-auth-aws-eventstream", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/http-auth-aws-eventstream@2.45.1", "UID": "92bd7d9d15b24cb0" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/http-auth-aws-eventstream-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:http-auth-spi", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/http-auth-spi@2.45.1", "UID": "43c50926c2498c01" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/http-auth-spi-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:http-client-spi", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/http-client-spi@2.45.1", "UID": "7b8b6dd12cd49209" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/http-client-spi-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:identity-spi", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/identity-spi@2.45.1", "UID": "71a64797d4754509" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/identity-spi-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:json-utils", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/json-utils@2.45.1", "UID": "9c3e903c3565fcd6" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/json-utils-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:metrics-spi", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/metrics-spi@2.45.1", "UID": "d3a3cf1de5e4a00b" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/metrics-spi-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:netty-nio-client", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/netty-nio-client@2.45.1", "UID": "f35753ee4afb3f9d" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/netty-nio-client-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:profiles", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/profiles@2.45.1", "UID": "1c6813fd4ad83261" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/profiles-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:protocol-core", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/protocol-core@2.45.1", "UID": "2bd55471a4c2a539" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/protocol-core-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:regions", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/regions@2.45.1", "UID": "4576c5d2b41c4a1b" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/regions-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:retries", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/retries@2.45.1", "UID": "e3601d3aa512d166" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/retries-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:retries-spi", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/retries-spi@2.45.1", "UID": "c63fd267d9d6f423" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/retries-spi-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:sdk-core", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/sdk-core@2.45.1", "UID": "ef42e2019a2dc925" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/sdk-core-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:sns", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/sns@2.45.1", "UID": "9f04f9418ed6d992" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/sns-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:third-party-jackson-core", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/third-party-jackson-core@2.45.1", "UID": "f4d5130b0a1deede" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/third-party-jackson-core-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:utils", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/utils@2.45.1", "UID": "610ab6440b3645b" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/utils-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.awssdk:utils-lite", "Identifier": { "PURL": "pkg:maven/software.amazon.awssdk/utils-lite@2.45.1", "UID": "da46ad2e76da221b" }, "Version": "2.45.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/utils-lite-2.45.1.jar", "AnalyzedBy": "jar" }, { "Name": "software.amazon.eventstream:eventstream", "Identifier": { "PURL": "pkg:maven/software.amazon.eventstream/eventstream@1.0.1", "UID": "4064d2c450ec49fa" }, "Version": "1.0.1", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "FilePath": "opt/traccar/lib/eventstream-1.0.1.jar", "AnalyzedBy": "jar" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-106451", "VendorIDs": [ "GHSA-mcr4-qmvw-px4g" ], "PkgName": "at.yawk.lz4:lz4-java", "PkgPath": "opt/traccar/lib/lz4-java-1.10.2.jar", "PkgIdentifier": { "PURL": "pkg:maven/at.yawk.lz4/lz4-java@1.10.2", "UID": "1b92f33cd184c9fb" }, "InstalledVersion": "1.10.2", "FixedVersion": "1.11.4", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-106451", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:b293466889d622a8386eba9584dadc9431bc308ad9f75a434bf0b9c79a14ef42", "Title": "org.lz4/lz4-java: lz4-java: Arbitrary code execution via insecure temporary file handling", "Description": "yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without exclusive creation, allowing another local user with access to the same shared temporary directory to create or replace the library file before System.load() uses it. Successful exploitation depends on shared-directory permissions, host protections, and winning the race, and can execute native code as the victim; hardened systems may instead cause library loading to fail and fall back to Java implementations. Configurations using a system library, a private java.io.tmpdir, or Java-only implementations are not affected. This issue is fixed in version 1.11.4.", "Severity": "HIGH", "CweIDs": [ "CWE-367", "CWE-377" ], "VendorSeverity": { "ghsa": 3, "redhat": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-106451", "https://advisory.echohq.com/cve/CVE-2026-106451", "https://github.com/advisories/GHSA-mcr4-qmvw-px4g", "https://github.com/yawkat/lz4-java", "https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3", "https://github.com/yawkat/lz4-java/releases/tag/v1.11.4", "https://github.com/yawkat/lz4-java/security/advisories/GHSA-mcr4-qmvw-px4g", "https://nvd.nist.gov/vuln/detail/CVE-2026-106451", "https://www.cve.org/CVERecord?id=CVE-2026-106451" ], "PublishedDate": "2026-10-06T20:17:27.173Z", "LastModifiedDate": "2026-10-07T19:17:32.463Z" }, { "VulnerabilityID": "CVE-2026-68494", "VendorIDs": [ "GHSA-r7wm-3cxj-wff9" ], "PkgName": "com.fasterxml.jackson.core:jackson-core", "PkgPath": "opt/traccar/lib/jackson-core-2.21.2.jar", "PkgIdentifier": { "PURL": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2", "UID": "88074c2bfde3aa7a" }, "InstalledVersion": "2.21.2", "FixedVersion": "2.18.8, 2.21.4", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68494", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:c2ee4175f26233a6664cbdf60be1349a6823983261921db2278be47ce64bf5d9", "Title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "Description": "The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.\n\nThe earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.\n\nAs a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.\n\nThe equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.\n\nImpact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.\n\nExploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08).", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-68494", "https://advisory.echohq.com/cve/CVE-2026-68494", "https://github.com/FasterXML/jackson-core", "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd", "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641", "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8", "https://github.com/FasterXML/jackson-core/pull/1611", "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9", "https://github.com/advisories/GHSA-72hv-8253-57qq", "https://nvd.nist.gov/vuln/detail/CVE-2026-68494", "https://www.cve.org/CVERecord?id=CVE-2026-18401", "https://www.cve.org/CVERecord?id=CVE-2026-68494" ], "PublishedDate": "2026-08-04T15:16:41.443Z", "LastModifiedDate": "2026-10-23T23:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-89407", "VendorIDs": [ "GHSA-p6pp-m3f8-5c89" ], "PkgName": "com.fasterxml.jackson.core:jackson-core", "PkgPath": "opt/traccar/lib/jackson-core-2.21.2.jar", "PkgIdentifier": { "PURL": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2", "UID": "88074c2bfde3aa7a" }, "InstalledVersion": "2.21.2", "FixedVersion": "2.18.11, 2.21.7, 2.22.3", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89407", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:0985202d7217b9501d5a324bdb64af1c4532ae8fe6b9b21f9a8d50dd703cd2f2", "Title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "Description": "NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. \n\n\n\nMatching cost therefore grows with the square of the input length. \n\n\n\nAn attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). \n\n\n\nBecause StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. \n\n\n\nTesting by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. \n\n\n\nThe affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. \n\n\n\nThe fix replaces both regular expressions with a hand-rolled single-pass scan.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-1333" ], "VendorSeverity": { "alma": 2, "amazon": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 2, "rocky": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:86706", "https://access.redhat.com/security/cve/CVE-2026-89407", "https://advisory.echohq.com/cve/CVE-2026-89407", "https://bugzilla.redhat.com/2538720", "https://bugzilla.redhat.com/2539084", "https://bugzilla.redhat.com/show_bug.cgi?id=2538720", "https://bugzilla.redhat.com/show_bug.cgi?id=2539084", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89407", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89425", "https://errata.almalinux.org/9/ALSA-2026-86706.html", "https://errata.rockylinux.org/RLSA-2026:86706", "https://getsafety.com/vulnerabilities/SFTY-20260922-89449/CVE-2026-89407", "https://github.com/FasterXML/jackson-core", "https://github.com/FasterXML/jackson-core/commit/731e794f62623aa0d86ced52490166be903fbb1d", "https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff", "https://github.com/FasterXML/jackson-core/issues/1649", "https://github.com/FasterXML/jackson-core/pull/1650", "https://github.com/FasterXML/jackson-core/pull/1701", "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89", "https://linux.oracle.com/cve/CVE-2026-89407.html", "https://linux.oracle.com/errata/ELSA-2026-92408.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89407", "https://www.cve.org/CVERecord?id=CVE-2026-89407" ], "PublishedDate": "2026-09-22T15:17:21.053Z", "LastModifiedDate": "2026-09-22T20:00:03.713Z" }, { "VulnerabilityID": "CVE-2026-89425", "VendorIDs": [ "GHSA-7hhh-6rmp-j9qf" ], "PkgName": "com.fasterxml.jackson.core:jackson-core", "PkgPath": "opt/traccar/lib/jackson-core-2.21.2.jar", "PkgIdentifier": { "PURL": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2", "UID": "88074c2bfde3aa7a" }, "InstalledVersion": "2.21.2", "FixedVersion": "2.21.7, 2.22.3, 2.18.11", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89425", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:43fb2c0823a5da43117927904ee0902aece4fb6e9e984eba9e83aef00b177c9d", "Title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "Description": "UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770" ], "VendorSeverity": { "alma": 2, "amazon": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:86706", "https://access.redhat.com/security/cve/CVE-2026-89425", "https://advisory.echohq.com/cve/CVE-2026-89425", "https://bugzilla.redhat.com/2538720", "https://bugzilla.redhat.com/2539084", "https://bugzilla.redhat.com/show_bug.cgi?id=2538720", "https://bugzilla.redhat.com/show_bug.cgi?id=2539084", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89407", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89425", "https://errata.almalinux.org/9/ALSA-2026-86706.html", "https://errata.rockylinux.org/RLSA-2026:86706", "https://github.com/FasterXML/jackson-core", "https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3", "https://github.com/FasterXML/jackson-core/pull/1698", "https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11", "https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3", "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf", "https://linux.oracle.com/cve/CVE-2026-89425.html", "https://linux.oracle.com/errata/ELSA-2026-90909.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89425", "https://www.cve.org/CVERecord?id=CVE-2026-89425" ], "PublishedDate": "2026-09-23T03:17:04.357Z", "LastModifiedDate": "2026-09-24T20:43:32.537Z" }, { "VulnerabilityID": "CVE-2026-54512", "VendorIDs": [ "GHSA-j3rv-43j4-c7qm" ], "PkgName": "com.fasterxml.jackson.core:jackson-databind", "PkgPath": "opt/traccar/lib/jackson-databind-2.21.2.jar", "PkgIdentifier": { "PURL": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "UID": "edd04e3383cf7ac0" }, "InstalledVersion": "2.21.2", "FixedVersion": "2.18.8, 3.1.4, 2.21.4", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54512", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:e5986274b689f6ac5871d701e7321dc09dabb060b35f78863ca27c2400647b8f", "Title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "Description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains \u003c), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before \u003c) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList\u003ccom.evil.Gadget\u003e when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.", "Severity": "HIGH", "CweIDs": [ "CWE-184", "CWE-502" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:40895", "https://access.redhat.com/security/cve/CVE-2026-54512", "https://advisory.echohq.com/cve/CVE-2026-54512", "https://bugzilla.redhat.com/2492010", "https://bugzilla.redhat.com/2492015", "https://bugzilla.redhat.com/show_bug.cgi?id=2492010", "https://bugzilla.redhat.com/show_bug.cgi?id=2492015", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54512", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54513", "https://errata.almalinux.org/9/ALSA-2026-40895.html", "https://errata.rockylinux.org/RLSA-2026:40895", "https://github.com/FasterXML/jackson-databind", "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5", "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5%20%28jackson-databind-2.18.8%29", "https://github.com/FasterXML/jackson-databind/issues/5988", "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm", "https://linux.oracle.com/cve/CVE-2026-54512.html", "https://linux.oracle.com/errata/ELSA-2026-43400.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-54512", "https://www.cve.org/CVERecord?id=CVE-2026-54512" ], "PublishedDate": "2026-06-23T21:17:02.203Z", "LastModifiedDate": "2026-10-25T23:10:00.167Z" }, { "VulnerabilityID": "CVE-2026-54513", "VendorIDs": [ "GHSA-rmj7-2vxq-3g9f" ], "PkgName": "com.fasterxml.jackson.core:jackson-databind", "PkgPath": "opt/traccar/lib/jackson-databind-2.21.2.jar", "PkgIdentifier": { "PURL": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "UID": "edd04e3383cf7ac0" }, "InstalledVersion": "2.21.2", "FixedVersion": "2.18.8, 2.21.4, 3.1.4", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54513", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:e09a4a8eeb62097ff0472578dc994b3bbc1e9212e74fe67a3090acbd70e33f2e", "Title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "Description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.", "Severity": "HIGH", "CweIDs": [ "CWE-184" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:36839", "https://access.redhat.com/errata/RHSA-2026:40895", "https://access.redhat.com/errata/RHSA-2026:41951", "https://access.redhat.com/errata/RHSA-2026:43218", "https://access.redhat.com/errata/RHSA-2026:43400", "https://access.redhat.com/errata/RHSA-2026:44061", "https://access.redhat.com/errata/RHSA-2026:44062", "https://access.redhat.com/errata/RHSA-2026:44063", "https://access.redhat.com/errata/RHSA-2026:44064", "https://access.redhat.com/errata/RHSA-2026:44065", "https://access.redhat.com/errata/RHSA-2026:44066", "https://access.redhat.com/errata/RHSA-2026:44271", "https://access.redhat.com/errata/RHSA-2026:48095", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:50846", "https://access.redhat.com/errata/RHSA-2026:50847", "https://access.redhat.com/errata/RHSA-2026:50848", "https://access.redhat.com/errata/RHSA-2026:50849", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54622", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:66488", "https://access.redhat.com/errata/RHSA-2026:66545", "https://access.redhat.com/security/cve/CVE-2026-54513", "https://advisory.echohq.com/cve/CVE-2026-54513", "https://bugzilla.redhat.com/2492010", "https://bugzilla.redhat.com/2492015", "https://bugzilla.redhat.com/show_bug.cgi?id=2492010", "https://bugzilla.redhat.com/show_bug.cgi?id=2492015", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54512", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54513", "https://errata.almalinux.org/9/ALSA-2026-40895.html", "https://errata.rockylinux.org/RLSA-2026:40895", "https://github.com/FasterXML/jackson-databind", "https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5", "https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5%20%28jackson-databind-2.18.8%29", "https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e", "https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e%20%28jackson-databind-3.1.4%29", "https://github.com/FasterXML/jackson-databind/issues/5981", "https://github.com/FasterXML/jackson-databind/issues/5983", "https://github.com/FasterXML/jackson-databind/pull/5983", "https://github.com/FasterXML/jackson-databind/pull/5984", "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f", "https://linux.oracle.com/cve/CVE-2026-54513.html", "https://linux.oracle.com/errata/ELSA-2026-43400.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-54513", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json", "https://www.cve.org/CVERecord?id=CVE-2026-54513" ], "PublishedDate": "2026-06-23T21:17:02.333Z", "LastModifiedDate": "2026-10-25T23:10:00.167Z" }, { "VulnerabilityID": "CVE-2026-68497", "VendorIDs": [ "GHSA-q4xh-88c3-wmh7" ], "PkgName": "com.fasterxml.jackson.core:jackson-databind", "PkgPath": "opt/traccar/lib/jackson-databind-2.21.2.jar", "PkgIdentifier": { "PURL": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "UID": "edd04e3383cf7ac0" }, "InstalledVersion": "2.21.2", "FixedVersion": "2.18.10, 2.21.6, 2.22.2", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68497", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:284e12ebda4b7378151bccf2b8a8daa6f23df4ca13c7e20d1fe87e9c5c453725", "Title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "Description": "jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-1333" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:80504", "https://access.redhat.com/security/cve/CVE-2026-68497", "https://advisory.echohq.com/cve/CVE-2026-68497", "https://bugzilla.redhat.com/2531964", "https://bugzilla.redhat.com/show_bug.cgi?id=2531964", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68497", "https://errata.almalinux.org/9/ALSA-2026-80504.html", "https://errata.rockylinux.org/RLSA-2026:80504", "https://github.com/FasterXML/jackson-databind", "https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd", "https://github.com/FasterXML/jackson-databind/pull/6127", "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10", "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6", "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2", "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6", "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2", "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7", "https://linux.oracle.com/cve/CVE-2026-68497.html", "https://linux.oracle.com/errata/ELSA-2026-80504.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-68497", "https://www.cve.org/CVERecord?id=CVE-2026-68497" ], "PublishedDate": "2026-09-11T16:17:39.61Z", "LastModifiedDate": "2026-09-18T19:34:36.657Z" }, { "VulnerabilityID": "CVE-2026-91776", "VendorIDs": [ "GHSA-wv8q-qhhj-9h54" ], "PkgName": "com.fasterxml.jackson.core:jackson-databind", "PkgPath": "opt/traccar/lib/jackson-databind-2.21.2.jar", "PkgIdentifier": { "PURL": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "UID": "edd04e3383cf7ac0" }, "InstalledVersion": "2.21.2", "FixedVersion": "2.18.11, 2.21.7, 2.22.3", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-91776", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:2f06df8f547ef7c5963183749e3e8581512629b613c74fdd4474f5774dfb8899", "Title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "Description": "TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-91776", "https://advisory.echohq.com/cve/CVE-2026-91776", "https://github.com/FasterXML/jackson-databind", "https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577", "https://github.com/FasterXML/jackson-databind/issues/6203", "https://github.com/FasterXML/jackson-databind/pull/6203", "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11", "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7", "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3", "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7", "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3", "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54", "https://nvd.nist.gov/vuln/detail/CVE-2026-91776", "https://www.cve.org/CVERecord?id=CVE-2026-91776" ], "PublishedDate": "2026-09-23T03:17:04.62Z", "LastModifiedDate": "2026-09-24T20:43:32.537Z" }, { "VulnerabilityID": "CVE-2026-91777", "VendorIDs": [ "GHSA-cxp5-3px4-pw24" ], "PkgName": "com.fasterxml.jackson.core:jackson-databind", "PkgPath": "opt/traccar/lib/jackson-databind-2.21.2.jar", "PkgIdentifier": { "PURL": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "UID": "edd04e3383cf7ac0" }, "InstalledVersion": "2.21.2", "FixedVersion": "2.21.7, 2.18.11, 2.22.3", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-91777", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:830735bb820e3a1b54b0d3daacf72569f4d93cf33f7367db9aa285016f2b55e7", "Title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "Description": "Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:85231", "https://access.redhat.com/security/cve/CVE-2026-91777", "https://advisory.echohq.com/cve/CVE-2026-91777", "https://bugzilla.redhat.com/2539085", "https://bugzilla.redhat.com/show_bug.cgi?id=2539085", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-91777", "https://errata.almalinux.org/9/ALSA-2026-85231.html", "https://errata.rockylinux.org/RLSA-2026:85231", "https://github.com/FasterXML/jackson-databind", "https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67", "https://github.com/FasterXML/jackson-databind/issues/6204", "https://github.com/FasterXML/jackson-databind/pull/6204", "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11", "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7", "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3", "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7", "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3", "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24", "https://linux.oracle.com/cve/CVE-2026-91777.html", "https://linux.oracle.com/errata/ELSA-2026-90909.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-91777", "https://www.cve.org/CVERecord?id=CVE-2026-91777" ], "PublishedDate": "2026-09-23T03:17:04.783Z", "LastModifiedDate": "2026-09-24T20:43:32.537Z" }, { "VulnerabilityID": "CVE-2026-102554", "VendorIDs": [ "GHSA-xxph-c9ww-hj94" ], "PkgName": "com.google.guava:guava", "PkgPath": "opt/traccar/lib/guava-33.5.0-jre.jar", "PkgIdentifier": { "PURL": "pkg:maven/com.google.guava/guava@33.5.0-jre", "UID": "2046ef8c0aea6e9d" }, "InstalledVersion": "33.5.0-jre", "FixedVersion": "33.7.2", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-102554", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:8e437cf2a4b375708ad27bddb86bc0fbd3cef9cd134853012cceca80ec2313eb", "Title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "Description": "Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.", "Severity": "HIGH", "CweIDs": [ "CWE-502", "CWE-770" ], "VendorSeverity": { "azure": 2, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 5.9, "V40Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-102554", "https://advisory.echohq.com/cve/CVE-2026-102554", "https://github.com/advisories/GHSA-xxph-c9ww-hj94", "https://github.com/google/guava", "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe", "https://github.com/google/guava/releases/tag/v33.7.2", "https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94", "https://nvd.nist.gov/vuln/detail/CVE-2026-102554", "https://www.cve.org/CVERecord?id=CVE-2026-102554" ], "PublishedDate": "2026-10-09T16:17:20.41Z", "LastModifiedDate": "2026-10-09T18:17:01.38Z" }, { "VulnerabilityID": "CVE-2026-63337", "VendorIDs": [ "GHSA-6g32-pxv4-2wfj" ], "PkgName": "com.rabbitmq:amqp-client", "PkgPath": "opt/traccar/lib/amqp-client-5.31.0.jar", "PkgIdentifier": { "PURL": "pkg:maven/com.rabbitmq/amqp-client@5.31.0", "UID": "8cdf2ca37fe2b141" }, "InstalledVersion": "5.31.0", "FixedVersion": "5.33.0", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63337", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:9ba89d181a131f09e6e720385c47a79c5bd3be717d96cc82e68c85d319c9dab8", "Title": "com.rabbitmq/amqp-client: RabbitMQ Java client: Arbitrary class loading via unvalidated input in JSON-RPC.", "Description": "The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill, setJavaReturnType, and computeReturnTypeAsJavaClass to Class.forName(javaReturnType) with initialization enabled. An attacker able to answer the JsonRpcClient request through a shared broker or network interception can select a class already present in the victim JVM and trigger its static initializer, while JsonRpcClient.java later passes getReturnType output to mapper.parse and may also create type confusion. Successful exploitation can affect confidentiality, integrity, and availability in the client process. This issue is fixed in version 5.33.0.", "Severity": "HIGH", "CweIDs": [ "CWE-470" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L", "V40Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63337", "https://advisory.echohq.com/cve/CVE-2026-63337", "https://github.com/rabbitmq/rabbitmq-java-client", "https://github.com/rabbitmq/rabbitmq-java-client/commit/0032f75f9dc3df847f94b2b85a16119250bf63cb", "https://github.com/rabbitmq/rabbitmq-java-client/commit/9f8e7efd0c648f235dc0e96232ae7efa75ea4fa8", "https://github.com/rabbitmq/rabbitmq-java-client/pull/2000", "https://github.com/rabbitmq/rabbitmq-java-client/pull/2002", "https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.0", "https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-6g32-pxv4-2wfj", "https://nvd.nist.gov/vuln/detail/CVE-2026-63337", "https://www.cve.org/CVERecord?id=CVE-2026-63337" ], "PublishedDate": "2026-08-18T17:17:00.423Z", "LastModifiedDate": "2026-10-22T22:10:00.25Z" }, { "VulnerabilityID": "CVE-2026-69219", "VendorIDs": [ "GHSA-68mj-5wr7-6fgg" ], "PkgName": "com.rabbitmq:amqp-client", "PkgPath": "opt/traccar/lib/amqp-client-5.31.0.jar", "PkgIdentifier": { "PURL": "pkg:maven/com.rabbitmq/amqp-client@5.31.0", "UID": "8cdf2ca37fe2b141" }, "InstalledVersion": "5.31.0", "FixedVersion": "5.33.1", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-69219", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:f30c64e8b09c187400dfe74165972a3ee0f72b96869ba4285e0b3dbfb8c27259", "Title": "com.rabbitmq/amqp-client: RabbitMQ Java client: Denial of Service via oversized memory allocation during pre-authentication", "Description": "The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAX_VALUE and allocate a byte array before checking the bytes available in the frame. A malicious AMQP peer can send a LongString or byte-array field with type tag S and a declared length such as 0x7FFFFFFE during the pre-authentication connection.start server-properties table, causing an approximately 2 GB allocation and OutOfMemoryError before readFully consumes data. The resulting memory exhaustion can terminate the JVM and cause denial of service. This issue is fixed in version 5.33.1.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-69219", "https://advisory.echohq.com/cve/CVE-2026-69219", "https://github.com/rabbitmq/rabbitmq-java-client", "https://github.com/rabbitmq/rabbitmq-java-client/commit/388209356c6478088efce4d8a07b68e73837a7a0", "https://github.com/rabbitmq/rabbitmq-java-client/commit/6a87a8dcdc8b4cc4b961a7cdd388276446e5dfb2", "https://github.com/rabbitmq/rabbitmq-java-client/pull/2007", "https://github.com/rabbitmq/rabbitmq-java-client/pull/2008", "https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.1", "https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-68mj-5wr7-6fgg", "https://nvd.nist.gov/vuln/detail/CVE-2026-69219", "https://www.cve.org/CVERecord?id=CVE-2026-69219" ], "PublishedDate": "2026-08-18T17:17:01.353Z", "LastModifiedDate": "2026-10-22T22:10:00.25Z" }, { "VulnerabilityID": "CVE-2026-69220", "VendorIDs": [ "GHSA-93j5-89vc-pph4" ], "PkgName": "com.rabbitmq:amqp-client", "PkgPath": "opt/traccar/lib/amqp-client-5.31.0.jar", "PkgIdentifier": { "PURL": "pkg:maven/com.rabbitmq/amqp-client@5.31.0", "UID": "8cdf2ca37fe2b141" }, "InstalledVersion": "5.31.0", "FixedVersion": "5.33.1", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-69220", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:0c73eed9f6f6517c3329c4a9e66991918603bed442faef62931985e227ba145e", "Title": "The RabbitMQ Java client library allows Java and JVM-based application ...", "Description": "The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively for AMQP table type F and AMQP array type A values without a nesting-depth limit. A malicious AMQP server or network intermediary can send approximately 580 nested table levels in the pre-authentication connection.start frame, fitting within the default 131072-byte frame maximum, to trigger StackOverflowError. The error terminates the client input processing thread and causes denial of service. This issue is fixed in version 5.33.1.", "Severity": "HIGH", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 } }, "References": [ "https://advisory.echohq.com/cve/CVE-2026-69220", "https://github.com/rabbitmq/rabbitmq-java-client", "https://github.com/rabbitmq/rabbitmq-java-client/commit/09af76fce136f3136931654a0a1d43095c80e2f0", "https://github.com/rabbitmq/rabbitmq-java-client/commit/db89e34809fbc6ba4e946615f297f3684ccd0acc", "https://github.com/rabbitmq/rabbitmq-java-client/pull/2007", "https://github.com/rabbitmq/rabbitmq-java-client/pull/2008", "https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.1", "https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-93j5-89vc-pph4" ], "PublishedDate": "2026-08-18T17:17:01.497Z", "LastModifiedDate": "2026-10-22T22:10:00.25Z" }, { "VulnerabilityID": "CVE-2026-75516", "VendorIDs": [ "GHSA-jh4v-gfqj-7rhx" ], "PkgName": "com.rabbitmq:amqp-client", "PkgPath": "opt/traccar/lib/amqp-client-5.31.0.jar", "PkgIdentifier": { "PURL": "pkg:maven/com.rabbitmq/amqp-client@5.31.0", "UID": "8cdf2ca37fe2b141" }, "InstalledVersion": "5.31.0", "FixedVersion": "5.34.0", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75516", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:12ddc01f87d4abc4016c9ac3a4709e023b2729faa9e055bb305530d8b8791b91", "Title": "com.rabbitmq/amqp-client: RabbitMQ Java client: Denial of Service via oversized frames", "Description": "The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start() applies Math.min(maxInboundMessageBodySize, frameMax) after Connection.Tune negotiation even though AMQP defines frameMax value zero as unlimited and ConnectionFactory.DEFAULT_FRAME_MAX is zero. When the client default and server-negotiated value are both zero, the result is passed to Utils.framePayloadLimit(int), which interprets zero as Integer.MAX_VALUE and disables the configured maxInboundMessageBodySize cap. A malicious AMQP server, or a man-in-the-middle attacker able to modify Connection.Tune and inject frames into the connection, can then send an oversized frame of any frame type, causing Frame.readFrom() to allocate a large byte array before content-level validation and potentially terminate the client process through memory exhaustion. This issue is fixed in version 5.34.0.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75516", "https://advisory.echohq.com/cve/CVE-2026-75516", "https://github.com/rabbitmq/rabbitmq-java-client", "https://github.com/rabbitmq/rabbitmq-java-client/commit/6d7c2bfe89796ca34d3531098fb59dd657fea39e", "https://github.com/rabbitmq/rabbitmq-java-client/commit/e7f10bf99aee103dd9f64b3e52a725fc9f9d3763", "https://github.com/rabbitmq/rabbitmq-java-client/pull/2015", "https://github.com/rabbitmq/rabbitmq-java-client/pull/2016", "https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.34.0", "https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-jh4v-gfqj-7rhx", "https://nvd.nist.gov/vuln/detail/CVE-2026-75516", "https://www.cve.org/CVERecord?id=CVE-2026-75516" ], "PublishedDate": "2026-09-16T19:17:33.56Z", "LastModifiedDate": "2026-09-24T21:16:28.12Z" }, { "VulnerabilityID": "CVE-2025-48734", "VendorIDs": [ "GHSA-wxr5-93ph-8wr9" ], "PkgName": "commons-beanutils:commons-beanutils", "PkgPath": "opt/traccar/lib/commons-beanutils-1.9.4.jar", "PkgIdentifier": { "PURL": "pkg:maven/commons-beanutils/commons-beanutils@1.9.4", "UID": "790f20ab45a3c6f2" }, "InstalledVersion": "1.9.4", "FixedVersion": "1.11.0", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-48734", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:458ad6c1e23e9f1f993db17279defabee7d9eacd47e4672bfe26ee350b243666", "Title": "commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default", "Description": "Improper Access Control vulnerability in Apache Commons.\n\n\n\nA special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.\n\n\n\n\n\nReleases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().\nStarting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.\n\nThis issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils\n\n 1.x are recommended to upgrade to version 1.11.0, which fixes the issue.\n\n\nUsers of the artifact org.apache.commons:commons-beanutils2\n\n 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.", "Severity": "HIGH", "CweIDs": [ "CWE-284" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2025/05/28/6", "https://access.redhat.com/errata/RHSA-2025:9114", "https://access.redhat.com/errata/RHSA-2025:9318", "https://access.redhat.com/security/cve/CVE-2025-48734", "https://advisory.echohq.com/cve/CVE-2025-48734", "https://bugzilla.redhat.com/2368956", "https://bugzilla.redhat.com/show_bug.cgi?id=1767483", "https://bugzilla.redhat.com/show_bug.cgi?id=2368956", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10086", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48734", "https://dlcdn.apache.org/commons/beanutils/RELEASE-NOTES.txt", "https://errata.almalinux.org/9/ALSA-2025-9114.html", "https://errata.rockylinux.org/RLSA-2025:9318", "https://github.com/advisories/GHSA-wxr5-93ph-8wr9", "https://github.com/apache/commons-beanutils", "https://github.com/apache/commons-beanutils/commit/28ad955a1613ed5885870cc7da52093c1ce739dc", "https://github.com/apache/commons-beanutils/commit/bd20740da25b69552ddef8523beec0837297eaf9", "https://linux.oracle.com/cve/CVE-2025-48734.html", "https://linux.oracle.com/errata/ELSA-2025-9318.html", "https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9", "https://lists.debian.org/debian-lts-announce/2025/06/msg00027.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-48734", "https://ubuntu.com/security/notices/USN-8322-1", "https://www.cve.org/CVERecord?id=CVE-2025-48734", "https://www.openwall.com/lists/oss-security/2025/05/28/6" ], "PublishedDate": "2025-05-28T14:15:34.07Z", "LastModifiedDate": "2026-11-03T22:17:41.467Z" }, { "VulnerabilityID": "CVE-2026-59901", "VendorIDs": [ "GHSA-558v-64gr-wgg4" ], "PkgName": "io.netty:netty-codec-compression", "PkgPath": "opt/traccar/lib/netty-codec-compression-4.2.14.Final.jar", "PkgIdentifier": { "PURL": "pkg:maven/io.netty/netty-codec-compression@4.2.14.Final", "UID": "4a1bf97e5d6f0984" }, "InstalledVersion": "4.2.14.Final", "FixedVersion": "4.2.16.Final", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59901", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:d60c20e9ef9d27e35c123b002450067b398dad8871ae0d6296c41883980db51f", "Title": "io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)", "Description": "Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-59901", "https://advisory.echohq.com/cve/CVE-2026-59901", "https://github.com/netty/netty", "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final", "https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4", "https://nvd.nist.gov/vuln/detail/CVE-2026-59901", "https://www.cve.org/CVERecord?id=CVE-2026-59901" ], "PublishedDate": "2026-07-29T18:16:56.467Z", "LastModifiedDate": "2026-08-06T20:29:27.587Z" }, { "VulnerabilityID": "CVE-2026-55831", "VendorIDs": [ "GHSA-6jqx-86gh-f27w" ], "PkgName": "io.netty:netty-codec-http", "PkgPath": "opt/traccar/lib/netty-codec-http-4.2.14.Final.jar", "PkgIdentifier": { "PURL": "pkg:maven/io.netty/netty-codec-http@4.2.14.Final", "UID": "a109ef1fc23a0af6" }, "InstalledVersion": "4.2.14.Final", "FixedVersion": "4.2.16.Final, 4.1.136.Final", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-55831", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:744aa22bcfce54c70f4559f36c70a2b297f18ead591d6b32cb12c1e2f1abfddd", "Title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing", "Description": "Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-55831", "https://advisory.echohq.com/cve/CVE-2026-55831", "https://github.com/netty/netty", "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b", "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6", "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final", "https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w", "https://nvd.nist.gov/vuln/detail/CVE-2026-55831", "https://www.cve.org/CVERecord?id=CVE-2026-55831" ], "PublishedDate": "2026-07-21T00:17:35.383Z", "LastModifiedDate": "2026-07-23T15:17:16.78Z" }, { "VulnerabilityID": "CVE-2026-55833", "VendorIDs": [ "GHSA-mvh2-crg5-v77c" ], "PkgName": "io.netty:netty-codec-http", "PkgPath": "opt/traccar/lib/netty-codec-http-4.2.14.Final.jar", "PkgIdentifier": { "PURL": "pkg:maven/io.netty/netty-codec-http@4.2.14.Final", "UID": "a109ef1fc23a0af6" }, "InstalledVersion": "4.2.14.Final", "FixedVersion": "4.2.16.Final, 4.1.136.Final", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-55833", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:6c2dedd7befbadcc43d965680ab37b837642e228ea2465319b343bd191cfadc4", "Title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification", "Description": "Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-55833", "https://advisory.echohq.com/cve/CVE-2026-55833", "https://github.com/netty/netty", "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b", "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6", "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final", "https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c", "https://nvd.nist.gov/vuln/detail/CVE-2026-55833", "https://www.cve.org/CVERecord?id=CVE-2026-55833" ], "PublishedDate": "2026-07-21T00:17:35.537Z", "LastModifiedDate": "2026-07-23T13:34:45.383Z" }, { "VulnerabilityID": "CVE-2026-56745", "VendorIDs": [ "GHSA-jppx-w49h-x2qq" ], "PkgName": "io.netty:netty-codec-http", "PkgPath": "opt/traccar/lib/netty-codec-http-4.2.14.Final.jar", "PkgIdentifier": { "PURL": "pkg:maven/io.netty/netty-codec-http@4.2.14.Final", "UID": "a109ef1fc23a0af6" }, "InstalledVersion": "4.2.14.Final", "FixedVersion": "4.2.16.Final, 4.1.136.Final", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56745", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:2944c3feda4d49114bdd4592d9034eb4554a38134c64379c59a06f917e1ed1cc", "Title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec", "Description": "Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56745", "https://advisory.echohq.com/cve/CVE-2026-56745", "https://github.com/netty/netty", "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b", "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6", "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final", "https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq", "https://nvd.nist.gov/vuln/detail/CVE-2026-56745", "https://www.cve.org/CVERecord?id=CVE-2026-56745" ], "PublishedDate": "2026-07-21T22:17:14.5Z", "LastModifiedDate": "2026-07-30T14:46:55.073Z" }, { "VulnerabilityID": "CVE-2026-56819", "VendorIDs": [ "GHSA-93wv-jw9v-4972" ], "PkgName": "io.netty:netty-codec-http2", "PkgPath": "opt/traccar/lib/netty-codec-http2-4.1.133.Final.jar", "PkgIdentifier": { "PURL": "pkg:maven/io.netty/netty-codec-http2@4.1.133.Final", "UID": "c685c0a72139ff34" }, "InstalledVersion": "4.1.133.Final", "FixedVersion": "4.2.16.Final, 4.1.136.Final", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56819", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:d10babf190dd03e0074b06564bfc0a129b9ef5976d6a026fe5e053ddb14bc155", "Title": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak", "Description": "Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-401" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56819", "https://advisory.echohq.com/cve/CVE-2026-56819", "https://github.com/netty/netty", "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b", "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bhttps://github.com/netty/netty/releases/tag/netty-4.2.16.Final", "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6", "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final", "https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972", "https://nvd.nist.gov/vuln/detail/CVE-2026-56819", "https://www.cve.org/CVERecord?id=CVE-2026-56819" ], "PublishedDate": "2026-07-21T23:17:52.263Z", "LastModifiedDate": "2026-07-30T14:46:35.563Z" }, { "VulnerabilityID": "CVE-2026-75595", "VendorIDs": [ "GHSA-c4c3-7fpv-j4q5" ], "PkgName": "io.netty:netty-handler", "PkgPath": "opt/traccar/lib/netty-handler-4.2.14.Final.jar", "PkgIdentifier": { "PURL": "pkg:maven/io.netty/netty-handler@4.2.14.Final", "UID": "8d517df8484f9e2d" }, "InstalledVersion": "4.2.14.Final", "FixedVersion": "4.2.17.Final, 4.1.137.Final", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75595", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:70ade291eb58c41b91050c1f94863ac296f24a418f58a33b4c1f7f3e178afdd3", "Title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "Description": "Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.", "Severity": "CRITICAL", "CweIDs": [ "CWE-754" ], "VendorSeverity": { "ghsa": 4, "nvd": 4, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 9.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75595", "https://advisory.echohq.com/cve/CVE-2026-75595", "https://github.com/netty/netty", "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7", "https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961", "https://github.com/netty/netty/pull/17213", "https://github.com/netty/netty/pull/17217", "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final", "https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5", "https://nvd.nist.gov/vuln/detail/CVE-2026-75595", "https://www.cve.org/CVERecord?id=CVE-2026-75595" ], "PublishedDate": "2026-08-19T21:17:37.563Z", "LastModifiedDate": "2026-10-26T10:10:00.14Z" }, { "VulnerabilityID": "CVE-2026-44249", "VendorIDs": [ "GHSA-3qp7-7mw8-wx86" ], "PkgName": "io.netty:netty-handler", "PkgPath": "opt/traccar/lib/netty-handler-4.2.14.Final.jar", "PkgIdentifier": { "PURL": "pkg:maven/io.netty/netty-handler@4.2.14.Final", "UID": "8d517df8484f9e2d" }, "InstalledVersion": "4.2.14.Final", "FixedVersion": "4.2.15.Final, 4.1.135.Final", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-44249", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:222bd740e0586724223208ce06b5b82980d7d60da89fac00c11438ea43045824", "Title": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation", "Description": "Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "Severity": "HIGH", "CweIDs": [ "CWE-284", "CWE-697", "CWE-1287" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26017", "https://access.redhat.com/errata/RHSA-2026:26018", "https://access.redhat.com/errata/RHSA-2026:26586", "https://access.redhat.com/errata/RHSA-2026:28573", "https://access.redhat.com/errata/RHSA-2026:34608", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:37390", "https://access.redhat.com/errata/RHSA-2026:41951", "https://access.redhat.com/errata/RHSA-2026:48124", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:49700", "https://access.redhat.com/errata/RHSA-2026:49701", "https://access.redhat.com/errata/RHSA-2026:50085", "https://access.redhat.com/errata/RHSA-2026:53644", "https://access.redhat.com/errata/RHSA-2026:53645", "https://access.redhat.com/errata/RHSA-2026:53646", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66488", "https://access.redhat.com/errata/RHSA-2026:66545", "https://access.redhat.com/security/cve/CVE-2026-44249", "https://advisory.echohq.com/cve/CVE-2026-44249", "https://bugzilla.redhat.com/show_bug.cgi?id=2488081", "https://github.com/netty/netty", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final", "https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86", "https://nvd.nist.gov/vuln/detail/CVE-2026-44249", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json", "https://www.cve.org/CVERecord?id=CVE-2026-44249" ], "PublishedDate": "2026-06-11T22:16:56.707Z", "LastModifiedDate": "2026-09-18T13:18:23.463Z" }, { "VulnerabilityID": "CVE-2026-45416", "VendorIDs": [ "GHSA-x4gw-5cx5-pgmh" ], "PkgName": "io.netty:netty-handler", "PkgPath": "opt/traccar/lib/netty-handler-4.2.14.Final.jar", "PkgIdentifier": { "PURL": "pkg:maven/io.netty/netty-handler@4.2.14.Final", "UID": "8d517df8484f9e2d" }, "InstalledVersion": "4.2.14.Final", "FixedVersion": "4.2.15.Final, 4.1.135.Final", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45416", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:6c886871f3995fb8bc1788cb3760869e935f5d30b6b66e5f5f6d8b4b8a4866b0", "Title": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake", "Description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength \u003e maxClientHelloLength \u0026\u0026 maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26017", "https://access.redhat.com/errata/RHSA-2026:26018", "https://access.redhat.com/errata/RHSA-2026:26586", "https://access.redhat.com/errata/RHSA-2026:28573", "https://access.redhat.com/errata/RHSA-2026:34608", "https://access.redhat.com/errata/RHSA-2026:37390", "https://access.redhat.com/errata/RHSA-2026:41951", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:49700", "https://access.redhat.com/errata/RHSA-2026:49701", "https://access.redhat.com/errata/RHSA-2026:50085", "https://access.redhat.com/errata/RHSA-2026:53644", "https://access.redhat.com/errata/RHSA-2026:53645", "https://access.redhat.com/errata/RHSA-2026:53646", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66488", "https://access.redhat.com/errata/RHSA-2026:66545", "https://access.redhat.com/security/cve/CVE-2026-45416", "https://advisory.echohq.com/cve/CVE-2026-45416", "https://bugzilla.redhat.com/show_bug.cgi?id=2488391", "https://github.com/netty/netty", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final", "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh", "https://nvd.nist.gov/vuln/detail/CVE-2026-45416", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json", "https://www.cve.org/CVERecord?id=CVE-2026-45416" ], "PublishedDate": "2026-06-12T15:16:26.94Z", "LastModifiedDate": "2026-09-18T13:18:25.647Z" }, { "VulnerabilityID": "CVE-2026-50010", "VendorIDs": [ "GHSA-c653-97m9-rcg9" ], "PkgName": "io.netty:netty-handler", "PkgPath": "opt/traccar/lib/netty-handler-4.2.14.Final.jar", "PkgIdentifier": { "PURL": "pkg:maven/io.netty/netty-handler@4.2.14.Final", "UID": "8d517df8484f9e2d" }, "InstalledVersion": "4.2.14.Final", "FixedVersion": "4.2.15.Final, 4.1.135.Final", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50010", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:211afd53b5992c61f4173eca09864e84590c24bbf6b462b991ebc88fe3a2fd9b", "Title": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass", "Description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm=\"HTTPS\" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "Severity": "HIGH", "CweIDs": [ "CWE-347" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26017", "https://access.redhat.com/errata/RHSA-2026:26018", "https://access.redhat.com/errata/RHSA-2026:26586", "https://access.redhat.com/errata/RHSA-2026:28573", "https://access.redhat.com/errata/RHSA-2026:34608", "https://access.redhat.com/errata/RHSA-2026:37390", "https://access.redhat.com/errata/RHSA-2026:41951", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:49700", "https://access.redhat.com/errata/RHSA-2026:49701", "https://access.redhat.com/errata/RHSA-2026:50085", "https://access.redhat.com/errata/RHSA-2026:53644", "https://access.redhat.com/errata/RHSA-2026:53645", "https://access.redhat.com/errata/RHSA-2026:53646", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66488", "https://access.redhat.com/errata/RHSA-2026:66545", "https://access.redhat.com/security/cve/CVE-2026-50010", "https://advisory.echohq.com/cve/CVE-2026-50010", "https://bugzilla.redhat.com/show_bug.cgi?id=2488429", "https://github.com/netty/netty", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final", "https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9", "https://nvd.nist.gov/vuln/detail/CVE-2026-50010", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50010.json", "https://www.cve.org/CVERecord?id=CVE-2026-50010" ], "PublishedDate": "2026-06-12T16:16:31.18Z", "LastModifiedDate": "2026-09-18T13:18:31.64Z" }, { "VulnerabilityID": "CVE-2026-45674", "VendorIDs": [ "GHSA-676x-f7gg-47vc" ], "PkgName": "io.netty:netty-resolver-dns", "PkgPath": "opt/traccar/lib/netty-resolver-dns-4.2.14.Final.jar", "PkgIdentifier": { "PURL": "pkg:maven/io.netty/netty-resolver-dns@4.2.14.Final", "UID": "e79dfdf4c9cffc19" }, "InstalledVersion": "4.2.14.Final", "FixedVersion": "4.2.15.Final, 4.1.135.Final", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45674", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:a2f8da85a99258f7c08c33298ae0c19d5ae88049f4f2214befec355f34eddcbe", "Title": "netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation", "Description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "Severity": "HIGH", "CweIDs": [ "CWE-345", "CWE-346" ], "VendorSeverity": { "ghsa": 3, "nvd": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "V3Score": 10 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26017", "https://access.redhat.com/errata/RHSA-2026:26018", "https://access.redhat.com/errata/RHSA-2026:26586", "https://access.redhat.com/errata/RHSA-2026:34608", "https://access.redhat.com/errata/RHSA-2026:37390", "https://access.redhat.com/errata/RHSA-2026:41951", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:49700", "https://access.redhat.com/errata/RHSA-2026:49701", "https://access.redhat.com/errata/RHSA-2026:50085", "https://access.redhat.com/errata/RHSA-2026:53644", "https://access.redhat.com/errata/RHSA-2026:53645", "https://access.redhat.com/errata/RHSA-2026:53646", "https://access.redhat.com/errata/RHSA-2026:53806", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/security/cve/CVE-2026-45674", "https://advisory.echohq.com/cve/CVE-2026-45674", "https://bugzilla.redhat.com/show_bug.cgi?id=2488400", "https://github.com/netty/netty", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final", "https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc", "https://nvd.nist.gov/vuln/detail/CVE-2026-45674", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45674.json", "https://www.cve.org/CVERecord?id=CVE-2026-45674" ], "PublishedDate": "2026-06-12T15:16:27.55Z", "LastModifiedDate": "2026-09-18T13:18:26.863Z" }, { "VulnerabilityID": "CVE-2026-47691", "VendorIDs": [ "GHSA-5pvg-856g-cp85" ], "PkgName": "io.netty:netty-resolver-dns", "PkgPath": "opt/traccar/lib/netty-resolver-dns-4.2.14.Final.jar", "PkgIdentifier": { "PURL": "pkg:maven/io.netty/netty-resolver-dns@4.2.14.Final", "UID": "e79dfdf4c9cffc19" }, "InstalledVersion": "4.2.14.Final", "FixedVersion": "4.2.15.Final, 4.1.135.Final", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-47691", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:7c6493b2f5c8de66e9b6c924f30b159a6aba84e40c69f7376d14e2f043774cf4", "Title": "io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records", "Description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "Severity": "HIGH", "CweIDs": [ "CWE-345", "CWE-346" ], "VendorSeverity": { "ghsa": 3, "nvd": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "V3Score": 10 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26017", "https://access.redhat.com/errata/RHSA-2026:26018", "https://access.redhat.com/errata/RHSA-2026:26586", "https://access.redhat.com/errata/RHSA-2026:34608", "https://access.redhat.com/errata/RHSA-2026:37390", "https://access.redhat.com/errata/RHSA-2026:41951", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:49700", "https://access.redhat.com/errata/RHSA-2026:49701", "https://access.redhat.com/errata/RHSA-2026:50085", "https://access.redhat.com/errata/RHSA-2026:53644", "https://access.redhat.com/errata/RHSA-2026:53645", "https://access.redhat.com/errata/RHSA-2026:53646", "https://access.redhat.com/errata/RHSA-2026:53806", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/security/cve/CVE-2026-47691", "https://advisory.echohq.com/cve/CVE-2026-47691", "https://bugzilla.redhat.com/show_bug.cgi?id=2488439", "https://github.com/netty/netty", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final", "https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85", "https://nvd.nist.gov/vuln/detail/CVE-2026-47691", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47691.json", "https://ubuntu.com/security/notices/USN-8742-1", "https://www.cve.org/CVERecord?id=CVE-2026-47691" ], "PublishedDate": "2026-06-12T16:16:30.31Z", "LastModifiedDate": "2026-09-18T13:18:28.497Z" }, { "VulnerabilityID": "CVE-2026-54399", "VendorIDs": [ "GHSA-hf6x-8p5f-cgmf" ], "PkgName": "org.apache.httpcomponents.core5:httpcore5", "PkgPath": "opt/traccar/lib/httpcore5-5.2.4.jar", "PkgIdentifier": { "PURL": "pkg:maven/org.apache.httpcomponents.core5/httpcore5@5.2.4", "UID": "3755fe56fd8ed4a4" }, "InstalledVersion": "5.2.4", "FixedVersion": "5.4.3, 5.5-beta2", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54399", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:19f01a687b4cf0813e10cd7af43fc34c58e330d05235b1562182c5120d88e808", "Title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers", "Description": "Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/01/4", "https://access.redhat.com/security/cve/CVE-2026-54399", "https://advisory.echohq.com/cve/CVE-2026-54399", "https://github.com/apache/httpcomponents-core", "https://github.com/apache/httpcomponents-core/commit/d96a00fec9b2e19f8005e35681df5f6cd6e21a9e", "https://github.com/apache/httpcomponents-core/commit/fdc53a32fe0fccf098cc67e71cd125e447c759ed", "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy", "https://nvd.nist.gov/vuln/detail/CVE-2026-54399", "https://www.cve.org/CVERecord?id=CVE-2026-54399" ], "PublishedDate": "2026-07-01T17:16:36.357Z", "LastModifiedDate": "2026-10-25T17:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-54428", "VendorIDs": [ "GHSA-v3jc-474w-2wm6" ], "PkgName": "org.apache.httpcomponents.core5:httpcore5-h2", "PkgPath": "opt/traccar/lib/httpcore5-h2-5.2.4.jar", "PkgIdentifier": { "PURL": "pkg:maven/org.apache.httpcomponents.core5/httpcore5-h2@5.2.4", "UID": "ff06854d8c64c696" }, "InstalledVersion": "5.2.4", "FixedVersion": "5.4.3, 5.5-beta2", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54428", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:681e6347beb67128e16ee0320ed3522e633100fedd370e84babfec44f2242e7b", "Title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks", "Description": "Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/01/3", "https://access.redhat.com/security/cve/CVE-2026-54428", "https://advisory.echohq.com/cve/CVE-2026-54428", "https://github.com/apache/httpcomponents-core", "https://github.com/apache/httpcomponents-core/commit/1ea1239bbbe3442a8382a87279c0a8119a7e358e", "https://github.com/apache/httpcomponents-core/commit/cc30ee058a7b10cbf4ad3dd6270ab6d1f6a74c49", "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd", "https://nvd.nist.gov/vuln/detail/CVE-2026-54428", "https://www.cve.org/CVERecord?id=CVE-2026-54428" ], "PublishedDate": "2026-07-01T18:16:34.507Z", "LastModifiedDate": "2026-10-25T17:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-10050", "VendorIDs": [ "GHSA-2fvj-hgj9-j2gr" ], "PkgName": "org.eclipse.jetty:jetty-security", "PkgPath": "opt/traccar/lib/jetty-security-12.1.8.jar", "PkgIdentifier": { "PURL": "pkg:maven/org.eclipse.jetty/jetty-security@12.1.8", "UID": "8c6caab2462987ec" }, "InstalledVersion": "12.1.8", "FixedVersion": "9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-10050", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:c1ba898a5e642abfb9908c40ca7e0c1c498e7d32c0bf391172780452a70d1f87", "Title": "jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision", "Description": "In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.\n\n\n\nThis was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.\n\n\n\nIf the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`.\n\n\n\nAn attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters.\n\n\n\nRecent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.", "Severity": "HIGH", "CweIDs": [ "CWE-173", "CWE-303" ], "VendorSeverity": { "ghsa": 3, "nvd": 4, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-10050", "https://advisory.echohq.com/cve/CVE-2026-10050", "https://github.com/jetty/jetty.project", "https://github.com/jetty/jetty.project/commit/4bcdbc7db387ce9e20e2c7571a7250280466221d", "https://github.com/jetty/jetty.project/commit/d0bb829ccecbf19e3ad3d32f2649b2800f01222d", "https://github.com/jetty/jetty.project/issues/15136", "https://github.com/jetty/jetty.project/pull/15160", "https://github.com/jetty/jetty.project/pull/15183", "https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.36", "https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.10", "https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/120", "https://nvd.nist.gov/vuln/detail/CVE-2026-10050", "https://www.cve.org/CVERecord?id=CVE-2026-10050" ], "PublishedDate": "2026-08-04T11:22:43.883Z", "LastModifiedDate": "2026-08-08T00:38:56.66Z" }, { "VulnerabilityID": "CVE-2026-54291", "VendorIDs": [ "GHSA-j92g-9f8w-j867" ], "PkgName": "org.postgresql:postgresql", "PkgPath": "opt/traccar/lib/postgresql-42.7.11.jar", "PkgIdentifier": { "PURL": "pkg:maven/org.postgresql/postgresql@42.7.11", "UID": "a5bdf32a5def212b" }, "InstalledVersion": "42.7.11", "FixedVersion": "42.7.12", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54291", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:8afb3eb3a7d35c84cc8e39ca038022b20fdc7da7a15c989835149aac43fb72b1", "Title": "org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade", "Description": "pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.", "Severity": "HIGH", "CweIDs": [ "CWE-636", "CWE-757" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N", "V40Score": 8.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N", "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 5.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-54291", "https://advisory.echohq.com/cve/CVE-2026-54291", "https://github.com/ongres/scram/releases/tag/3.3", "https://github.com/pgjdbc/pgjdbc", "https://github.com/pgjdbc/pgjdbc/commit/77df98e4e66c12936ded3478a0954f6f580bad99", "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867", "https://nvd.nist.gov/vuln/detail/CVE-2026-54291", "https://www.cve.org/CVERecord?id=CVE-2026-54291" ], "PublishedDate": "2026-07-06T19:17:08.407Z", "LastModifiedDate": "2026-07-09T13:16:25.717Z" }, { "VulnerabilityID": "CVE-2026-108106", "VendorIDs": [ "GHSA-q233-g92q-qxp6" ], "PkgName": "org.xerial.snappy:snappy-java", "PkgPath": "opt/traccar/lib/snappy-java-1.1.10.7.jar", "PkgIdentifier": { "PURL": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7", "UID": "ddd24e99ea754f81" }, "InstalledVersion": "1.1.10.7", "FixedVersion": "1.1.10.9", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-108106", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:63538cc7f73162840b439f246daa5c7d3ddeaa2f32ceb768e400911f726f1d57", "Title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "Description": "Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-108106", "https://advisory.echohq.com/cve/CVE-2026-108106", "https://github.com/advisories/GHSA-94x4-5g3f-jjxp", "https://github.com/xerial/snappy-java", "https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L517", "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75", "https://github.com/xerial/snappy-java/pull/739", "https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9", "https://github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6", "https://nvd.nist.gov/vuln/detail/CVE-2026-108106", "https://www.cve.org/CVERecord?id=CVE-2026-108106", "https://www.vulncheck.com/advisories/xerial-snappy-java-before-1.1.10.9-unbounded-memory-allocation-denial-of-service" ], "PublishedDate": "2026-10-09T15:17:11.55Z", "LastModifiedDate": "2026-10-13T17:17:19.13Z" }, { "VulnerabilityID": "CVE-2026-93451", "VendorIDs": [ "GHSA-gwq9-9ffj-mvrv" ], "PkgName": "org.xerial.snappy:snappy-java", "PkgPath": "opt/traccar/lib/snappy-java-1.1.10.7.jar", "PkgIdentifier": { "PURL": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7", "UID": "ddd24e99ea754f81" }, "InstalledVersion": "1.1.10.7", "FixedVersion": "1.1.10.9", "Status": "fixed", "Layer": { "DiffID": "sha256:be24a1b4a382c132065961de26f5c41ddceaee86d311d04751d195799bcc6006" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-93451", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Fingerprint": "sha256:6565ce6b7954a696f546ab4a6c055f3fbb91ba86c42e6bf1a12a5cb54b69be4d", "Title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "Description": "snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "ghsa": 3, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-93451", "https://advisory.echohq.com/cve/CVE-2026-93451", "https://github.com/advisories/GHSA-wm36-87w8-wg22", "https://github.com/xerial/snappy-java", "https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L802", "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75", "https://github.com/xerial/snappy-java/issues/729", "https://github.com/xerial/snappy-java/pull/739", "https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9", "https://github.com/xerial/snappy-java/security/advisories/GHSA-gwq9-9ffj-mvrv", "https://nvd.nist.gov/vuln/detail/CVE-2026-93451", "https://www.cve.org/CVERecord?id=CVE-2026-93451", "https://www.vulncheck.com/advisories/snappy-java-through-1.1.10.8-buffer-overflow-via-typed-uncompress-methods" ], "PublishedDate": "2026-09-18T00:17:49.38Z", "LastModifiedDate": "2026-10-08T16:18:00.33Z" } ] } ] }