docker.io/apache/kafka:4.3.0
Base OS: alpine 3.23.463 vulnerabilities fixed
Patched Image
ghcr.io/verity-org/apache/kafka:4.3.0
Supply Chain
Full compliance detailsSignedSLSA L3SBOMRekor
Verify this artifact
Cosign signature
cosign verify \ --certificate-identity-regexp "https://github.com/verity-org/verity/.github/workflows/" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ ghcr.io/verity-org/apache/kafka:4.3.0
Build provenance
gh attestation verify \ oci://ghcr.io/verity-org/apache/kafka:4.3.0 \ --owner verity-org
Before patching
Found 72 vulnerabilities in the original image. 63 fixed by Copa. 9 remaining after patching.
10 HIGH27 MEDIUM31 LOW4 UNKNOWN
Fix available — pending patch
These vulnerabilities have upstream fixes but could not be automatically patched. Manual remediation may be required.
- CVE-2026-54512HIGH
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 3.1.4, 2.21.4
- CVE-2026-54513HIGH
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 2.21.4, 3.1.4
- GHSA-2r2c-cx56-8933HIGH
- Package
- org.jline:jline-remote-telnet
- Installed
- 3.30.4
- Fixed
- 4.2.1
- GHSA-47qp-hqvx-6r3fHIGH
- Package
- org.jline:jline-remote-telnet
- Installed
- 3.30.4
- Fixed
- 4.2.1
- CVE-2026-54514MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 2.21.4, 3.1.4
- CVE-2026-54515MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 3.1.4, 2.18.9, 2.21.5, 2.22.1
- CVE-2026-54516MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4, 3.1.4
- CVE-2026-54517MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4, 3.1.4
- CVE-2026-54518MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2026-54512 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 3.1.4, 2.21.4 | HIGH |
| CVE-2026-54513 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 2.21.4, 3.1.4 | HIGH |
| GHSA-2r2c-cx56-8933 | org.jline:jline-remote-telnet | 3.30.4 | 4.2.1 | HIGH |
| GHSA-47qp-hqvx-6r3f | org.jline:jline-remote-telnet | 3.30.4 | 4.2.1 | HIGH |
| CVE-2026-54514 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54515 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 3.1.4, 2.18.9, 2.21.5, 2.22.1 | MEDIUM |
| CVE-2026-54516 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54517 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54518 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4 | MEDIUM |
Original image reference
docker.io/apache/kafka:4.3.0