Package
knative-kafka-broker-fips-1.22-dispatcher-loom
Component
vertx-core
Latest update
Fixed version
1.22.1-r5
5.3
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
1.22.1-r5Status
Impact
The vulnerable component is the Maven artifact io.vertx:vertx-core. Per the GitHub Security Advisory at https://github.com/advisories/GHSA-3g76-f9xq-8vp6, every affected version range listed for io.vertx:vertx-core (covering the 4.3.x, 4.4.x, 4.5.x and 5.0.x release lines, including the range >=4.3.4,<=4.3.8 that knative-kafka-broker-fips-1.22 ships) is declared as affected with no firstPatchedVersion. Without an upstream patched release of io.vertx:vertx-core, this issue cannot be closed by routine dependency-bump automation. A pending-upstream-fix advisory event is justified: the issue should reflect that we are awaiting upstream Eclipse Vert.x maintainers to publish a fixed release on at least one of the supported branches.
Status