{ "document": { "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Stackable GmbH and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "product-security@stackable.tech", "issuing_authority": "The Stackable Security Team is responsible for vulnerability handling across all Stackable offerings.", "name": "Stackable GmbH", "namespace": "https://www.stackable.tech/" }, "title": "Stackable Security Advisory for: CVE-2026-42778", "tracking": { "current_release_date": "2026-07-13T09:48:54.045884Z", "generator": { "engine": { "name": "SecObserve", "version": "1.54.0" } }, "id": "CVE-2026-42778", "initial_release_date": "2026-07-13T09:48:54.045884Z", "revision_history": [ { "date": "2026-07-13T09:48:54.045884Z", "number": "1", "summary": "Initial release" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "1.28.1-stackable26.3.0-amd64", "product": { "name": "nifi:1.28.1-stackable26.3.0-amd64", "product_id": "pkg:oci/nifi@sha256%3A0027f86704eaa5207ee6b28f0b395211981b02c133f1c184ee09a2be7b09cdd6?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_identification_helper": { "purl": "pkg:oci/nifi@sha256:0027f86704eaa5207ee6b28f0b395211981b02c133f1c184ee09a2be7b09cdd6?arch=amd64&repository_url=oci.stackable.tech/sdp/nifi" } } }, { "category": "product_version", "name": "2.6.0-stackable26.3.0-amd64", "product": { "name": "nifi:2.6.0-stackable26.3.0-amd64", "product_id": "pkg:oci/nifi@sha256%3A6c3ff83ff818e3147a4e3215b296b896f28186d54a3c6eb6cddda4fe788d5c21?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_identification_helper": { "purl": "pkg:oci/nifi@sha256:6c3ff83ff818e3147a4e3215b296b896f28186d54a3c6eb6cddda4fe788d5c21?arch=amd64&repository_url=oci.stackable.tech/sdp/nifi" } } }, { "category": "product_version", "name": "2.7.2-stackable26.3.0-amd64", "product": { "name": "nifi:2.7.2-stackable26.3.0-amd64", "product_id": "pkg:oci/nifi@sha256%3A0238904553b3d193dcee9c06d75de8371caaaf0d9846e4dd306e3d135b353be9?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_identification_helper": { "purl": "pkg:oci/nifi@sha256:0238904553b3d193dcee9c06d75de8371caaaf0d9846e4dd306e3d135b353be9?arch=amd64&repository_url=oci.stackable.tech/sdp/nifi" } } }, { "category": "product_version", "name": "1.27.0-stackable25.11.0-amd64", "product": { "name": "nifi:1.27.0-stackable25.11.0-amd64", "product_id": "pkg:oci/nifi@sha256%3A37dc3275b34ef2d8cbdca70a8cfb1656a48d96543a47ec705940445d857d1089?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_identification_helper": { "purl": "pkg:oci/nifi@sha256:37dc3275b34ef2d8cbdca70a8cfb1656a48d96543a47ec705940445d857d1089?arch=amd64&repository_url=oci.stackable.tech/sdp/nifi" } } }, { "category": "product_version", "name": "1.28.1-stackable25.11.0-amd64", "product": { "name": "nifi:1.28.1-stackable25.11.0-amd64", "product_id": "pkg:oci/nifi@sha256%3A8532d621c3edefa81940a2a65f707fb13d064542ea3a87092cd939b5cbce02c2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_identification_helper": { "purl": "pkg:oci/nifi@sha256:8532d621c3edefa81940a2a65f707fb13d064542ea3a87092cd939b5cbce02c2?arch=amd64&repository_url=oci.stackable.tech/sdp/nifi" } } }, { "category": "product_version", "name": "2.4.0-stackable25.11.0-amd64", "product": { "name": "nifi:2.4.0-stackable25.11.0-amd64", "product_id": "pkg:oci/nifi@sha256%3Af438103b7c7a8aacbbcacb9df14c314f9304b2788b845a89f6c8867ba08ee6ae?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_identification_helper": { "purl": "pkg:oci/nifi@sha256:f438103b7c7a8aacbbcacb9df14c314f9304b2788b845a89f6c8867ba08ee6ae?arch=amd64&repository_url=oci.stackable.tech/sdp/nifi" } } }, { "category": "product_version", "name": "2.6.0-stackable25.11.0-amd64", "product": { "name": "nifi:2.6.0-stackable25.11.0-amd64", "product_id": "pkg:oci/nifi@sha256%3A6b63ebf93ddf308084d6121fc9024b07dbc6726572adb1937f574bd647381991?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_identification_helper": { "purl": "pkg:oci/nifi@sha256:6b63ebf93ddf308084d6121fc9024b07dbc6726572adb1937f574bd647381991?arch=amd64&repository_url=oci.stackable.tech/sdp/nifi" } } } ], "category": "product_name", "name": "nifi" } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "1.28.1-stackable26.3.0-arm64", "product": { "name": "nifi:1.28.1-stackable26.3.0-arm64", "product_id": "pkg:oci/nifi@sha256%3A6e44ddff87c1ec73c6c304de0bb623258f2156111f68a9da8259d1c97dd0b733?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_identification_helper": { "purl": "pkg:oci/nifi@sha256:6e44ddff87c1ec73c6c304de0bb623258f2156111f68a9da8259d1c97dd0b733?arch=arm64&repository_url=oci.stackable.tech/sdp/nifi" } } }, { "category": "product_version", "name": "2.6.0-stackable26.3.0-arm64", "product": { "name": "nifi:2.6.0-stackable26.3.0-arm64", "product_id": "pkg:oci/nifi@sha256%3Ace993fec00718e182c3db95deb5b253d48eeb1479fbca95ac987b16d9b105684?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_identification_helper": { "purl": "pkg:oci/nifi@sha256:ce993fec00718e182c3db95deb5b253d48eeb1479fbca95ac987b16d9b105684?arch=arm64&repository_url=oci.stackable.tech/sdp/nifi" } } }, { "category": "product_version", "name": "2.7.2-stackable26.3.0-arm64", "product": { "name": "nifi:2.7.2-stackable26.3.0-arm64", "product_id": "pkg:oci/nifi@sha256%3A28fe303036f6aa3ecca3b3ad6b7f5c156fd6b2b28bd23010b1b95866d1545764?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_identification_helper": { "purl": "pkg:oci/nifi@sha256:28fe303036f6aa3ecca3b3ad6b7f5c156fd6b2b28bd23010b1b95866d1545764?arch=arm64&repository_url=oci.stackable.tech/sdp/nifi" } } }, { "category": "product_version", "name": "1.27.0-stackable25.11.0-arm64", "product": { "name": "nifi:1.27.0-stackable25.11.0-arm64", "product_id": "pkg:oci/nifi@sha256%3A94724f6c19f64a1567dc570e4f8ba842bfd18ebda1295c153ecf6640642d6236?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_identification_helper": { "purl": "pkg:oci/nifi@sha256:94724f6c19f64a1567dc570e4f8ba842bfd18ebda1295c153ecf6640642d6236?arch=arm64&repository_url=oci.stackable.tech/sdp/nifi" } } }, { "category": "product_version", "name": "1.28.1-stackable25.11.0-arm64", "product": { "name": "nifi:1.28.1-stackable25.11.0-arm64", "product_id": "pkg:oci/nifi@sha256%3A789cc75638f0ba10ac05cf5126ee71d1b1ff4509e3dc7f7186b7eed38a244090?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_identification_helper": { "purl": "pkg:oci/nifi@sha256:789cc75638f0ba10ac05cf5126ee71d1b1ff4509e3dc7f7186b7eed38a244090?arch=arm64&repository_url=oci.stackable.tech/sdp/nifi" } } }, { "category": "product_version", "name": "2.4.0-stackable25.11.0-arm64", "product": { "name": "nifi:2.4.0-stackable25.11.0-arm64", "product_id": "pkg:oci/nifi@sha256%3A048599bd56fda0f6442870f01aed6233bb4ca1a1e718d5ef857f7270ccd255f6?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_identification_helper": { "purl": "pkg:oci/nifi@sha256:048599bd56fda0f6442870f01aed6233bb4ca1a1e718d5ef857f7270ccd255f6?arch=arm64&repository_url=oci.stackable.tech/sdp/nifi" } } }, { "category": "product_version", "name": "2.6.0-stackable25.11.0-arm64", "product": { "name": "nifi:2.6.0-stackable25.11.0-arm64", "product_id": "pkg:oci/nifi@sha256%3A881d0754d004ea5e20e2b3c46ef01b759a5f763fe6d99791d95f849000e14ede?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_identification_helper": { "purl": "pkg:oci/nifi@sha256:881d0754d004ea5e20e2b3c46ef01b759a5f763fe6d99791d95f849000e14ede?arch=arm64&repository_url=oci.stackable.tech/sdp/nifi" } } } ], "category": "product_name", "name": "nifi" } ], "category": "architecture", "name": "arm64" } ], "category": "vendor", "name": "Stackable" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "2.1.6", "product": { "name": "mina-core:2.1.6", "product_id": "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar", "product_identification_helper": { "purl": "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar" } } }, { "category": "product_version", "name": "2.2.4", "product": { "name": "mina-core:2.2.4", "product_id": "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar", "product_identification_helper": { "purl": "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar" } } }, { "category": "product_version", "name": "2.2.5", "product": { "name": "mina-core:2.2.5", "product_id": "pkg:maven/org.apache.mina/mina-core@2.2.5?type=jar", "product_identification_helper": { "purl": "pkg:maven/org.apache.mina/mina-core@2.2.5?type=jar" } } } ], "category": "product_name", "name": "mina-core" } ], "category": "vendor", "name": "org.apache.mina" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A0027f86704eaa5207ee6b28f0b395211981b02c133f1c184ee09a2be7b09cdd6?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_id": "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A0027f86704eaa5207ee6b28f0b395211981b02c133f1c184ee09a2be7b09cdd6?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, "product_reference": "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar", "relates_to_product_reference": "pkg:oci/nifi@sha256%3A0027f86704eaa5207ee6b28f0b395211981b02c133f1c184ee09a2be7b09cdd6?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3A6c3ff83ff818e3147a4e3215b296b896f28186d54a3c6eb6cddda4fe788d5c21?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_id": "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3A6c3ff83ff818e3147a4e3215b296b896f28186d54a3c6eb6cddda4fe788d5c21?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, "product_reference": "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar", "relates_to_product_reference": "pkg:oci/nifi@sha256%3A6c3ff83ff818e3147a4e3215b296b896f28186d54a3c6eb6cddda4fe788d5c21?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.apache.mina/mina-core@2.2.5?type=jar@pkg:oci/nifi@sha256%3A0238904553b3d193dcee9c06d75de8371caaaf0d9846e4dd306e3d135b353be9?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_id": "pkg:maven/org.apache.mina/mina-core@2.2.5?type=jar@pkg:oci/nifi@sha256%3A0238904553b3d193dcee9c06d75de8371caaaf0d9846e4dd306e3d135b353be9?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, "product_reference": "pkg:maven/org.apache.mina/mina-core@2.2.5?type=jar", "relates_to_product_reference": "pkg:oci/nifi@sha256%3A0238904553b3d193dcee9c06d75de8371caaaf0d9846e4dd306e3d135b353be9?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A6e44ddff87c1ec73c6c304de0bb623258f2156111f68a9da8259d1c97dd0b733?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_id": "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A6e44ddff87c1ec73c6c304de0bb623258f2156111f68a9da8259d1c97dd0b733?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, "product_reference": "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar", "relates_to_product_reference": "pkg:oci/nifi@sha256%3A6e44ddff87c1ec73c6c304de0bb623258f2156111f68a9da8259d1c97dd0b733?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3Ace993fec00718e182c3db95deb5b253d48eeb1479fbca95ac987b16d9b105684?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_id": "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3Ace993fec00718e182c3db95deb5b253d48eeb1479fbca95ac987b16d9b105684?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, "product_reference": "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar", "relates_to_product_reference": "pkg:oci/nifi@sha256%3Ace993fec00718e182c3db95deb5b253d48eeb1479fbca95ac987b16d9b105684?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.apache.mina/mina-core@2.2.5?type=jar@pkg:oci/nifi@sha256%3A28fe303036f6aa3ecca3b3ad6b7f5c156fd6b2b28bd23010b1b95866d1545764?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_id": "pkg:maven/org.apache.mina/mina-core@2.2.5?type=jar@pkg:oci/nifi@sha256%3A28fe303036f6aa3ecca3b3ad6b7f5c156fd6b2b28bd23010b1b95866d1545764?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, "product_reference": "pkg:maven/org.apache.mina/mina-core@2.2.5?type=jar", "relates_to_product_reference": "pkg:oci/nifi@sha256%3A28fe303036f6aa3ecca3b3ad6b7f5c156fd6b2b28bd23010b1b95866d1545764?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A37dc3275b34ef2d8cbdca70a8cfb1656a48d96543a47ec705940445d857d1089?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_id": "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A37dc3275b34ef2d8cbdca70a8cfb1656a48d96543a47ec705940445d857d1089?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, "product_reference": "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar", "relates_to_product_reference": "pkg:oci/nifi@sha256%3A37dc3275b34ef2d8cbdca70a8cfb1656a48d96543a47ec705940445d857d1089?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A8532d621c3edefa81940a2a65f707fb13d064542ea3a87092cd939b5cbce02c2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_id": "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A8532d621c3edefa81940a2a65f707fb13d064542ea3a87092cd939b5cbce02c2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, "product_reference": "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar", "relates_to_product_reference": "pkg:oci/nifi@sha256%3A8532d621c3edefa81940a2a65f707fb13d064542ea3a87092cd939b5cbce02c2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3Af438103b7c7a8aacbbcacb9df14c314f9304b2788b845a89f6c8867ba08ee6ae?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_id": "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3Af438103b7c7a8aacbbcacb9df14c314f9304b2788b845a89f6c8867ba08ee6ae?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, "product_reference": "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar", "relates_to_product_reference": "pkg:oci/nifi@sha256%3Af438103b7c7a8aacbbcacb9df14c314f9304b2788b845a89f6c8867ba08ee6ae?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3A6b63ebf93ddf308084d6121fc9024b07dbc6726572adb1937f574bd647381991?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_id": "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3A6b63ebf93ddf308084d6121fc9024b07dbc6726572adb1937f574bd647381991?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, "product_reference": "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar", "relates_to_product_reference": "pkg:oci/nifi@sha256%3A6b63ebf93ddf308084d6121fc9024b07dbc6726572adb1937f574bd647381991?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A94724f6c19f64a1567dc570e4f8ba842bfd18ebda1295c153ecf6640642d6236?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_id": "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A94724f6c19f64a1567dc570e4f8ba842bfd18ebda1295c153ecf6640642d6236?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, "product_reference": "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar", "relates_to_product_reference": "pkg:oci/nifi@sha256%3A94724f6c19f64a1567dc570e4f8ba842bfd18ebda1295c153ecf6640642d6236?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A789cc75638f0ba10ac05cf5126ee71d1b1ff4509e3dc7f7186b7eed38a244090?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_id": "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A789cc75638f0ba10ac05cf5126ee71d1b1ff4509e3dc7f7186b7eed38a244090?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, "product_reference": "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar", "relates_to_product_reference": "pkg:oci/nifi@sha256%3A789cc75638f0ba10ac05cf5126ee71d1b1ff4509e3dc7f7186b7eed38a244090?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3A048599bd56fda0f6442870f01aed6233bb4ca1a1e718d5ef857f7270ccd255f6?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_id": "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3A048599bd56fda0f6442870f01aed6233bb4ca1a1e718d5ef857f7270ccd255f6?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, "product_reference": "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar", "relates_to_product_reference": "pkg:oci/nifi@sha256%3A048599bd56fda0f6442870f01aed6233bb4ca1a1e718d5ef857f7270ccd255f6?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3A881d0754d004ea5e20e2b3c46ef01b759a5f763fe6d99791d95f849000e14ede?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "product_id": "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3A881d0754d004ea5e20e2b3c46ef01b759a5f763fe6d99791d95f849000e14ede?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" }, "product_reference": "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar", "relates_to_product_reference": "pkg:oci/nifi@sha256%3A881d0754d004ea5e20e2b3c46ef01b759a5f763fe6d99791d95f849000e14ede?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-42778", "flags": [ { "label": "vulnerable_code_not_in_execute_path", "product_ids": [ "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A0027f86704eaa5207ee6b28f0b395211981b02c133f1c184ee09a2be7b09cdd6?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3A6c3ff83ff818e3147a4e3215b296b896f28186d54a3c6eb6cddda4fe788d5c21?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.5?type=jar@pkg:oci/nifi@sha256%3A0238904553b3d193dcee9c06d75de8371caaaf0d9846e4dd306e3d135b353be9?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A6e44ddff87c1ec73c6c304de0bb623258f2156111f68a9da8259d1c97dd0b733?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3Ace993fec00718e182c3db95deb5b253d48eeb1479fbca95ac987b16d9b105684?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.5?type=jar@pkg:oci/nifi@sha256%3A28fe303036f6aa3ecca3b3ad6b7f5c156fd6b2b28bd23010b1b95866d1545764?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A37dc3275b34ef2d8cbdca70a8cfb1656a48d96543a47ec705940445d857d1089?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A8532d621c3edefa81940a2a65f707fb13d064542ea3a87092cd939b5cbce02c2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3Af438103b7c7a8aacbbcacb9df14c314f9304b2788b845a89f6c8867ba08ee6ae?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3A6b63ebf93ddf308084d6121fc9024b07dbc6726572adb1937f574bd647381991?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A94724f6c19f64a1567dc570e4f8ba842bfd18ebda1295c153ecf6640642d6236?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A789cc75638f0ba10ac05cf5126ee71d1b1ff4509e3dc7f7186b7eed38a244090?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3A048599bd56fda0f6442870f01aed6233bb4ca1a1e718d5ef857f7270ccd255f6?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3A881d0754d004ea5e20e2b3c46ef01b759a5f763fe6d99791d95f849000e14ede?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" ] } ], "notes": [ { "category": "description", "text": "The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:\n\n\n\n\nThe fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.\n\n\n\n\nAffected versions are Apache MINA 2.1.0 <= 2.1.11, and 2.2.0 <= 2.2.6.\n\n\n\n\nThe problem is resolved in Apache MINA 2.1.12, and 2.2.7 by \napplying the classname allowlist earlier.\n\n\n\n\nAffected are applications using Apache MINA that call IoBuffer.getObject().\n\n\n\n\nApplications using Apache MINA are advised to upgrade\n\n\n\n\n\n\nThe fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.\n\n\n\n\nAffected versions are Apache MINA 2.1.0 <= 2.1.110, and 2.2.0 <= 2.2.6.\n\n\n\n\nThe problem is resolved in Apache MINA 2.1.12, and 2.2.7 by \napplying the classname allowlist earlier.\n\n\n\n\nAffected are applications using Apache MINA that call IoBuffer.getObject().\n\n\n\n\nApplications using Apache MINA are advised to upgrade", "title": "Vulnerability description" } ], "product_status": { "known_not_affected": [ "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A0027f86704eaa5207ee6b28f0b395211981b02c133f1c184ee09a2be7b09cdd6?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3A6c3ff83ff818e3147a4e3215b296b896f28186d54a3c6eb6cddda4fe788d5c21?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.5?type=jar@pkg:oci/nifi@sha256%3A0238904553b3d193dcee9c06d75de8371caaaf0d9846e4dd306e3d135b353be9?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A6e44ddff87c1ec73c6c304de0bb623258f2156111f68a9da8259d1c97dd0b733?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3Ace993fec00718e182c3db95deb5b253d48eeb1479fbca95ac987b16d9b105684?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.5?type=jar@pkg:oci/nifi@sha256%3A28fe303036f6aa3ecca3b3ad6b7f5c156fd6b2b28bd23010b1b95866d1545764?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A37dc3275b34ef2d8cbdca70a8cfb1656a48d96543a47ec705940445d857d1089?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A8532d621c3edefa81940a2a65f707fb13d064542ea3a87092cd939b5cbce02c2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3Af438103b7c7a8aacbbcacb9df14c314f9304b2788b845a89f6c8867ba08ee6ae?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3A6b63ebf93ddf308084d6121fc9024b07dbc6726572adb1937f574bd647381991?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A94724f6c19f64a1567dc570e4f8ba842bfd18ebda1295c153ecf6640642d6236?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A789cc75638f0ba10ac05cf5126ee71d1b1ff4509e3dc7f7186b7eed38a244090?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3A048599bd56fda0f6442870f01aed6233bb4ca1a1e718d5ef857f7270ccd255f6?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3A881d0754d004ea5e20e2b3c46ef01b759a5f763fe6d99791d95f849000e14ede?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" ] }, "references": [ { "category": "external", "summary": "Security Advisory", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778" } ], "threats": [ { "category": "impact", "details": "CVE-2026-42778, an incomplete-fix regression of CVE-2024-52046, is a Java deserialization flaw in Apache MINA's AbstractIoBuffer.getObject(). The advisory notes it only affects applications that call IoBuffer.getObject().\n\nIn these NiFi images, mina-core is a purely transitive dependency, pulled in only via Apache FtpServer (ftpserver-core), which backs the ListenFTP processor's embedded FTP server. NiFi's own code contains no reference to org.apache.mina, IoBuffer, ObjectSerializationDecoder, or getObject(), verified across the NiFi 1.x and 2.x source trees.\n\nApache FtpServer drives its MINA pipeline with a text-based FTP command codec, parsing ASCII commands such as USER, PASS, RETR, and STOR. It never installs MINA's ObjectSerialization codec, so IoBuffer.getObject() is never invoked. The vulnerable deserialization sink is never reached at runtime, and no attacker-controlled bytes flow into getObject().", "product_ids": [ "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A0027f86704eaa5207ee6b28f0b395211981b02c133f1c184ee09a2be7b09cdd6?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3A6c3ff83ff818e3147a4e3215b296b896f28186d54a3c6eb6cddda4fe788d5c21?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.5?type=jar@pkg:oci/nifi@sha256%3A0238904553b3d193dcee9c06d75de8371caaaf0d9846e4dd306e3d135b353be9?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A6e44ddff87c1ec73c6c304de0bb623258f2156111f68a9da8259d1c97dd0b733?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3Ace993fec00718e182c3db95deb5b253d48eeb1479fbca95ac987b16d9b105684?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.5?type=jar@pkg:oci/nifi@sha256%3A28fe303036f6aa3ecca3b3ad6b7f5c156fd6b2b28bd23010b1b95866d1545764?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A37dc3275b34ef2d8cbdca70a8cfb1656a48d96543a47ec705940445d857d1089?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A8532d621c3edefa81940a2a65f707fb13d064542ea3a87092cd939b5cbce02c2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3Af438103b7c7a8aacbbcacb9df14c314f9304b2788b845a89f6c8867ba08ee6ae?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3A6b63ebf93ddf308084d6121fc9024b07dbc6726572adb1937f574bd647381991?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A94724f6c19f64a1567dc570e4f8ba842bfd18ebda1295c153ecf6640642d6236?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.1.6?type=jar@pkg:oci/nifi@sha256%3A789cc75638f0ba10ac05cf5126ee71d1b1ff4509e3dc7f7186b7eed38a244090?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3A048599bd56fda0f6442870f01aed6233bb4ca1a1e718d5ef857f7270ccd255f6?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi", "pkg:maven/org.apache.mina/mina-core@2.2.4?type=jar@pkg:oci/nifi@sha256%3A881d0754d004ea5e20e2b3c46ef01b759a5f763fe6d99791d95f849000e14ede?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi" ] } ], "title": "CVE-2026-42778" } ] }