Vulnerabilities

[cskita]

Hello everyone,

We're currently using Microcks and have identified several security vulnerabilities in the distributed container images. As part of our investigation, we tested both the microcks and microcks-uber images, including newer tags available in the repository, but we were not able to find versions that fully address the reported vulnerabilities.

Could you share whether there is an ongoing effort or a planned release to remediate these vulnerabilities? Is there an estimated timeline for updated images to be published?

Some of the vulnerabilities reported by our security scans include:

• CVE-2026-7210 (Critical) – Python 3.9.25 (fixed in 3.15.0)
• CVE-2026-43512 (Critical) – Tomcat Embedded Core 11.0.21 (fixed in 11.0.22)
• CVE-2026-41293 (Critical) – Tomcat Embedded Core 11.0.21 (fixed in 11.0.22)
• CVE-2025-13462 (Critical) – Python 3.9.25 (fixed in 3.14.4 / 3.13.13)
• CVE-2026-43515 (Critical) – Tomcat Embedded Core 11.0.21 (fixed in 11.0.22)
• CVE-2026-43513 (High) – Tomcat Embedded Core 11.0.21 (fixed in 11.0.22)
• CVE-2026-4274 (High) – Python 3.9.25 (fixed in 3.14.4 / 3.13.13)
• CVE-2026-41851 (High) – Spring Core / Spring Web 7.0.7 (fixed in 7.0.8)
• CVE-2026-41284 (High) – Tomcat Embedded Core 11.0.21 (fixed in 11.0.22)
• CVE-2026-3644 (High) – Python 3.9.25 (fixed in 3.14.4 / 3.13.13)
• CVE-2025-13836 (High) – Python 3.9.25 (fixed in newer Python releases)
• CVE-2026-42498 (High) – Tomcat Embedded Core 11.0.21 (fixed in 11.0.22)
• CVE-2026-6019 (Medium) – Python 3.9.25 (fixed in 3.15.0)

Any information regarding planned fixes, recommended workarounds, or upcoming releases would be greatly appreciated.

Thank you for your support.

[lbroudoux]

Hi @cskita,

Thank you for opening the discussion. Glad to read you're using Microcks ;-)

The nightly tagged image is the most up-to-date regarding security issues. We're monitoring them using GitHub Dependabot alerts, Quay.io scans, and Docker Scout, and are aware that some libraries or base container images need to be refreshed. Typically, the microcks and microcks-uber should receive updates on Spring Boot (to solve the Tomcat-related CVEs) and on the ubi9-minimal base container image (to solve the Python-related ones).

Within a version development iteration (you may check RELEASE.md for more details on our release lifecycle), we typically do at least 2 updates of base libraries and container images

• One at the beginning of the iteration - this one is usually related to big updates on frameworks. Example: we moved from Spring Boot 3.5 to Spring Boot 4.0 for Microcks 1.15.0 to come,
• One at the end of the iteration to adjust on latest minors from libraries or base container images.

A first RC of 1.15.0 will probably land next week (see #2159), and we expect to have an update just before. So the above CVEs should be addressed pretty soon.

Hope it helps!

[lbroudoux]

I have created #2164 to track the Spring Boot upgrade.

[cskita]

Hi, @lbroudoux !

Thanks for the feedback!