docker.io/trinodb/trino:480
Base OS: redhat 10.1clean
Patched Image
ghcr.io/verity-org/trinodb/trino:480
Supply Chain
Full compliance detailsSignedSLSA L3SBOMRekor
Verify this artifact
Cosign signature
cosign verify \ --certificate-identity-regexp "https://github.com/verity-org/verity/.github/workflows/" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ ghcr.io/verity-org/trinodb/trino:480
Build provenance
gh attestation verify \ oci://ghcr.io/verity-org/trinodb/trino:480 \ --owner verity-org
Before patching
Found 107 vulnerabilities — none have upstream fixes available.
1 CRITICAL49 HIGH51 MEDIUM5 LOW1 UNKNOWN
Fix available — pending patch
These vulnerabilities have upstream fixes but could not be automatically patched. Manual remediation may be required.
- CVE-2026-8178CRITICAL
- Package
- com.amazon.redshift:redshift-jdbc42
- Installed
- 2.1.0.30
- Fixed
- 2.2.2
- CVE-2026-54512HIGH
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 3.1.4, 2.21.4
- CVE-2026-54512HIGH
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 3.1.4, 2.21.4
- CVE-2026-54513HIGH
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 2.21.4, 3.1.4
- CVE-2026-54513HIGH
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 2.21.4, 3.1.4
- CVE-2026-44894HIGH
- Package
- io.netty:netty-codec-classes-quic
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final
- CVE-2026-42583HIGH
- Package
- io.netty:netty-codec-compression
- Installed
- 4.2.10.Final
- Fixed
- 4.2.13.Final
- CVE-2026-42579HIGH
- Package
- io.netty:netty-codec-dns
- Installed
- 4.2.10.Final
- Fixed
- 4.2.13.Final, 4.1.133.Final
- CVE-2026-44893HIGH
- Package
- io.netty:netty-codec-haproxy
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-48059HIGH
- Package
- io.netty:netty-codec-haproxy
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-42584HIGH
- Package
- io.netty:netty-codec-http
- Installed
- 4.2.10.Final
- Fixed
- 4.2.13.Final, 4.1.133.Final
- CVE-2026-42587HIGH
- Package
- io.netty:netty-codec-http
- Installed
- 4.2.10.Final
- Fixed
- 4.2.13.Final, 4.1.133.Final
- CVE-2026-33871HIGH
- Package
- io.netty:netty-codec-http2
- Installed
- 4.2.10.Final
- Fixed
- 4.1.132.Final, 4.2.11.Final
- CVE-2026-42587HIGH
- Package
- io.netty:netty-codec-http2
- Installed
- 4.2.10.Final
- Fixed
- 4.2.13.Final, 4.1.133.Final
- CVE-2026-42582HIGH
- Package
- io.netty:netty-codec-http3
- Installed
- 4.2.10.Final
- Fixed
- 4.2.13.Final
- CVE-2026-44892HIGH
- Package
- io.netty:netty-codec-http3
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final
- CVE-2026-48748HIGH
- Package
- io.netty:netty-codec-http3
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final
- CVE-2026-44250HIGH
- Package
- io.netty:netty-codec-redis
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-44890HIGH
- Package
- io.netty:netty-codec-redis
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-48006HIGH
- Package
- io.netty:netty-codec-redis
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-50011HIGH
- Package
- io.netty:netty-codec-redis
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-44249HIGH
- Package
- io.netty:netty-handler
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-45416HIGH
- Package
- io.netty:netty-handler
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-50010HIGH
- Package
- io.netty:netty-handler
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-45674HIGH
- Package
- io.netty:netty-resolver-dns
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-47691HIGH
- Package
- io.netty:netty-resolver-dns
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-42577HIGH
- Package
- io.netty:netty-transport-native-epoll
- Installed
- 4.2.10.Final
- Fixed
- 4.2.13.Final
- CVE-2026-42577HIGH
- Package
- io.netty:netty-transport-native-epoll
- Installed
- 4.2.10.Final
- Fixed
- 4.2.13.Final
- CVE-2026-42577HIGH
- Package
- io.netty:netty-transport-native-epoll
- Installed
- 4.2.10.Final
- Fixed
- 4.2.13.Final
- CVE-2026-46340HIGH
- Package
- io.netty:netty-transport-sctp
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-40542HIGH
- Package
- org.apache.httpcomponents.client5:httpclient5
- Installed
- 5.6
- Fixed
- 5.6.1
- CVE-2025-48977HIGH
- Package
- org.apache.ignite:ignite-core
- Installed
- 2.17.0
- Fixed
- 2.18.0
- CVE-2026-43869HIGH
- Package
- org.apache.thrift:libthrift
- Installed
- 0.22.0
- Fixed
- 0.23.0
- CVE-2026-2332HIGH
- Package
- org.eclipse.jetty:jetty-http
- Installed
- 11.0.26
- Fixed
- 12.1.7, 12.0.33
- CVE-2026-42198HIGH
- Package
- org.postgresql:postgresql
- Installed
- 42.7.10
- Fixed
- 42.7.11
- GHSA-2m67-wjpj-xhg9HIGH
- Package
- tools.jackson.core:jackson-core
- Installed
- 3.1.0
- Fixed
- 3.1.1
- CVE-2026-54512HIGH
- Package
- tools.jackson.core:jackson-databind
- Installed
- 3.1.0
- Fixed
- 3.1.4
- CVE-2026-54513HIGH
- Package
- tools.jackson.core:jackson-databind
- Installed
- 3.1.0
- Fixed
- 3.1.4
- CVE-2026-27145HIGH
- Package
- stdlib
- Installed
- v1.26.1
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-32280HIGH
- Package
- stdlib
- Installed
- v1.26.1
- Fixed
- 1.25.9, 1.26.2
- CVE-2026-32281HIGH
- Package
- stdlib
- Installed
- v1.26.1
- Fixed
- 1.25.9, 1.26.2
- CVE-2026-32283HIGH
- Package
- stdlib
- Installed
- v1.26.1
- Fixed
- 1.25.9, 1.26.2
- CVE-2026-33810HIGH
- Package
- stdlib
- Installed
- v1.26.1
- Fixed
- 1.26.2
- CVE-2026-33811HIGH
- Package
- stdlib
- Installed
- v1.26.1
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-33814HIGH
- Package
- stdlib
- Installed
- v1.26.1
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-39820HIGH
- Package
- stdlib
- Installed
- v1.26.1
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-39822HIGH
- Package
- stdlib
- Installed
- v1.26.1
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39836HIGH
- Package
- stdlib
- Installed
- v1.26.1
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-42499HIGH
- Package
- stdlib
- Installed
- v1.26.1
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-42504HIGH
- Package
- stdlib
- Installed
- v1.26.1
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-54514MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 2.21.4, 3.1.4
- CVE-2026-54514MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 2.21.4, 3.1.4
- CVE-2026-54515MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 3.1.4, 2.18.9, 2.21.5, 2.22.1
- CVE-2026-54515MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 3.1.4, 2.18.9, 2.21.5, 2.22.1
- CVE-2026-54516MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4, 3.1.4
- CVE-2026-54516MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4, 3.1.4
- CVE-2026-54517MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4, 3.1.4
- CVE-2026-54517MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4, 3.1.4
- CVE-2026-54518MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4
- CVE-2026-54518MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4
- CVE-2023-2976MEDIUM
- Package
- com.google.guava:guava
- Installed
- 29.0-android
- Fixed
- 32.0.0-android
- CVE-2026-50009MEDIUM
- Package
- io.netty:netty-codec-classes-quic
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final
- CVE-2026-41417MEDIUM
- Package
- io.netty:netty-codec-http
- Installed
- 4.2.10.Final
- Fixed
- 4.1.133.Final, 4.2.13.Final
- CVE-2026-42580MEDIUM
- Package
- io.netty:netty-codec-http
- Installed
- 4.2.10.Final
- Fixed
- 4.2.13.Final, 4.1.133.Final
- CVE-2026-42581MEDIUM
- Package
- io.netty:netty-codec-http
- Installed
- 4.2.10.Final
- Fixed
- 4.2.13.Final, 4.1.133.Final
- CVE-2026-42585MEDIUM
- Package
- io.netty:netty-codec-http
- Installed
- 4.2.10.Final
- Fixed
- 4.2.13.Final, 4.1.133.Final
- CVE-2026-50020MEDIUM
- Package
- io.netty:netty-codec-http
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-47244MEDIUM
- Package
- io.netty:netty-codec-http2
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-48043MEDIUM
- Package
- io.netty:netty-codec-http2
- Installed
- 4.2.10.Final
- Fixed
- 4.1.135.Final, 4.2.15.Final
- CVE-2026-50560MEDIUM
- Package
- io.netty:netty-codec-http2
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-44248MEDIUM
- Package
- io.netty:netty-codec-mqtt
- Installed
- 4.2.10.Final
- Fixed
- 4.2.13.Final, 4.1.133.Final
- CVE-2026-42586MEDIUM
- Package
- io.netty:netty-codec-redis
- Installed
- 4.2.10.Final
- Fixed
- 4.2.13.Final, 4.1.133.Final
- CVE-2026-45673MEDIUM
- Package
- io.netty:netty-resolver-dns
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-45536MEDIUM
- Package
- io.netty:netty-transport-native-epoll
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-45536MEDIUM
- Package
- io.netty:netty-transport-native-epoll
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-45536MEDIUM
- Package
- io.netty:netty-transport-native-epoll
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-45536MEDIUM
- Package
- io.netty:netty-transport-native-kqueue
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-45536MEDIUM
- Package
- io.netty:netty-transport-native-kqueue
- Installed
- 4.2.10.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-45292MEDIUM
- Package
- io.opentelemetry:opentelemetry-api
- Installed
- 1.60.1
- Fixed
- 1.62.0
- CVE-2026-45292MEDIUM
- Package
- io.opentelemetry:opentelemetry-api
- Installed
- 1.60.1
- Fixed
- 1.62.0
- CVE-2026-45292MEDIUM
- Package
- io.opentelemetry:opentelemetry-extension-trace-propagators
- Installed
- 1.60.1
- Fixed
- 1.62.0
- CVE-2026-46718MEDIUM
- Package
- org.apache.calcite:calcite-core
- Installed
- 1.37.0
- Fixed
- 1.42.0
- CVE-2026-45205MEDIUM
- Package
- org.apache.commons:commons-configuration2
- Installed
- 2.13.0
- Fixed
- 2.15.0
- CVE-2024-6763MEDIUM
- Package
- org.eclipse.jetty:jetty-http
- Installed
- 11.0.26
- Fixed
- 12.0.12
- CVE-2024-52980MEDIUM
- Package
- org.elasticsearch:elasticsearch
- Installed
- 7.17.29
- Fixed
- 8.15.1
- CVE-2025-37727MEDIUM
- Package
- org.elasticsearch:elasticsearch
- Installed
- 7.17.29
- Fixed
- 8.18.8, 8.19.5, 9.0.8, 9.1.5
- CVE-2025-37731MEDIUM
- Package
- org.elasticsearch:elasticsearch
- Installed
- 7.17.29
- Fixed
- 8.19.8, 9.1.8, 9.2.2
- CVE-2026-54514MEDIUM
- Package
- tools.jackson.core:jackson-databind
- Installed
- 3.1.0
- Fixed
- 2.21.4, 3.1.4
- CVE-2026-54515MEDIUM
- Package
- tools.jackson.core:jackson-databind
- Installed
- 3.1.0
- Fixed
- 3.1.4
- CVE-2026-54516MEDIUM
- Package
- tools.jackson.core:jackson-databind
- Installed
- 3.1.0
- Fixed
- 3.1.4
- CVE-2026-54517MEDIUM
- Package
- tools.jackson.core:jackson-databind
- Installed
- 3.1.0
- Fixed
- 3.1.4
- CVE-2026-54518MEDIUM
- Package
- tools.jackson.core:jackson-databind
- Installed
- 3.1.0
- Fixed
- 3.1.4
- CVE-2026-32282MEDIUM
- Package
- stdlib
- Installed
- v1.26.1
- Fixed
- 1.25.9, 1.26.2
- CVE-2026-32288MEDIUM
- Package
- stdlib
- Installed
- v1.26.1
- Fixed
- 1.25.9, 1.26.2
- CVE-2026-32289MEDIUM
- Package
- stdlib
- Installed
- v1.26.1
- Fixed
- 1.25.9, 1.26.2
- CVE-2026-39823MEDIUM
- Package
- stdlib
- Installed
- v1.26.1
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-39825MEDIUM
- Package
- stdlib
- Installed
- v1.26.1
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-39826MEDIUM
- Package
- stdlib
- Installed
- v1.26.1
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-42505MEDIUM
- Package
- stdlib
- Installed
- v1.26.1
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42507MEDIUM
- Package
- stdlib
- Installed
- v1.26.1
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-10532LOW
- Package
- ch.qos.logback:logback-core
- Installed
- 1.5.32
- Fixed
- 1.5.35
- CVE-2026-9828LOW
- Package
- ch.qos.logback:logback-core
- Installed
- 1.5.32
- Fixed
- 1.5.33
- CVE-2020-8908LOW
- Package
- com.google.guava:guava
- Installed
- 29.0-android
- Fixed
- 32.0.0-android
- CVE-2026-42578LOW
- Package
- io.netty:netty-handler-proxy
- Installed
- 4.2.10.Final
- Fixed
- 4.1.133.Final, 4.2.13.Final
- CVE-2025-11143LOW
- Package
- org.eclipse.jetty:jetty-http
- Installed
- 11.0.26
- Fixed
- 12.0.31, 12.1.5
- CVE-2026-39824UNKNOWN
- Package
- golang.org/x/sys
- Installed
- v0.42.0
- Fixed
- 0.44.0
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2026-8178 | com.amazon.redshift:redshift-jdbc42 | 2.1.0.30 | 2.2.2 | CRITICAL |
| CVE-2026-54512 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 3.1.4, 2.21.4 | HIGH |
| CVE-2026-54512 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 3.1.4, 2.21.4 | HIGH |
| CVE-2026-54513 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 2.21.4, 3.1.4 | HIGH |
| CVE-2026-54513 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 2.21.4, 3.1.4 | HIGH |
| CVE-2026-44894 | io.netty:netty-codec-classes-quic | 4.2.10.Final | 4.2.15.Final | HIGH |
| CVE-2026-42583 | io.netty:netty-codec-compression | 4.2.10.Final | 4.2.13.Final | HIGH |
| CVE-2026-42579 | io.netty:netty-codec-dns | 4.2.10.Final | 4.2.13.Final, 4.1.133.Final | HIGH |
| CVE-2026-44893 | io.netty:netty-codec-haproxy | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-48059 | io.netty:netty-codec-haproxy | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-42584 | io.netty:netty-codec-http | 4.2.10.Final | 4.2.13.Final, 4.1.133.Final | HIGH |
| CVE-2026-42587 | io.netty:netty-codec-http | 4.2.10.Final | 4.2.13.Final, 4.1.133.Final | HIGH |
| CVE-2026-33871 | io.netty:netty-codec-http2 | 4.2.10.Final | 4.1.132.Final, 4.2.11.Final | HIGH |
| CVE-2026-42587 | io.netty:netty-codec-http2 | 4.2.10.Final | 4.2.13.Final, 4.1.133.Final | HIGH |
| CVE-2026-42582 | io.netty:netty-codec-http3 | 4.2.10.Final | 4.2.13.Final | HIGH |
| CVE-2026-44892 | io.netty:netty-codec-http3 | 4.2.10.Final | 4.2.15.Final | HIGH |
| CVE-2026-48748 | io.netty:netty-codec-http3 | 4.2.10.Final | 4.2.15.Final | HIGH |
| CVE-2026-44250 | io.netty:netty-codec-redis | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-44890 | io.netty:netty-codec-redis | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-48006 | io.netty:netty-codec-redis | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-50011 | io.netty:netty-codec-redis | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-44249 | io.netty:netty-handler | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-45416 | io.netty:netty-handler | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-50010 | io.netty:netty-handler | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-45674 | io.netty:netty-resolver-dns | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-47691 | io.netty:netty-resolver-dns | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-42577 | io.netty:netty-transport-native-epoll | 4.2.10.Final | 4.2.13.Final | HIGH |
| CVE-2026-42577 | io.netty:netty-transport-native-epoll | 4.2.10.Final | 4.2.13.Final | HIGH |
| CVE-2026-42577 | io.netty:netty-transport-native-epoll | 4.2.10.Final | 4.2.13.Final | HIGH |
| CVE-2026-46340 | io.netty:netty-transport-sctp | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-40542 | org.apache.httpcomponents.client5:httpclient5 | 5.6 | 5.6.1 | HIGH |
| CVE-2025-48977 | org.apache.ignite:ignite-core | 2.17.0 | 2.18.0 | HIGH |
| CVE-2026-43869 | org.apache.thrift:libthrift | 0.22.0 | 0.23.0 | HIGH |
| CVE-2026-2332 | org.eclipse.jetty:jetty-http | 11.0.26 | 12.1.7, 12.0.33 | HIGH |
| CVE-2026-42198 | org.postgresql:postgresql | 42.7.10 | 42.7.11 | HIGH |
| GHSA-2m67-wjpj-xhg9 | tools.jackson.core:jackson-core | 3.1.0 | 3.1.1 | HIGH |
| CVE-2026-54512 | tools.jackson.core:jackson-databind | 3.1.0 | 3.1.4 | HIGH |
| CVE-2026-54513 | tools.jackson.core:jackson-databind | 3.1.0 | 3.1.4 | HIGH |
| CVE-2026-27145 | stdlib | v1.26.1 | 1.25.11, 1.26.4 | HIGH |
| CVE-2026-32280 | stdlib | v1.26.1 | 1.25.9, 1.26.2 | HIGH |
| CVE-2026-32281 | stdlib | v1.26.1 | 1.25.9, 1.26.2 | HIGH |
| CVE-2026-32283 | stdlib | v1.26.1 | 1.25.9, 1.26.2 | HIGH |
| CVE-2026-33810 | stdlib | v1.26.1 | 1.26.2 | HIGH |
| CVE-2026-33811 | stdlib | v1.26.1 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-33814 | stdlib | v1.26.1 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-39820 | stdlib | v1.26.1 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-39822 | stdlib | v1.26.1 | 1.25.12, 1.26.5, 1.27.0-rc.2 | HIGH |
| CVE-2026-39836 | stdlib | v1.26.1 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-42499 | stdlib | v1.26.1 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-42504 | stdlib | v1.26.1 | 1.25.11, 1.26.4 | HIGH |
| CVE-2026-54514 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54514 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54515 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 3.1.4, 2.18.9, 2.21.5, 2.22.1 | MEDIUM |
| CVE-2026-54515 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 3.1.4, 2.18.9, 2.21.5, 2.22.1 | MEDIUM |
| CVE-2026-54516 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54516 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54517 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54517 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54518 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4 | MEDIUM |
| CVE-2026-54518 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4 | MEDIUM |
| CVE-2023-2976 | com.google.guava:guava | 29.0-android | 32.0.0-android | MEDIUM |
| CVE-2026-50009 | io.netty:netty-codec-classes-quic | 4.2.10.Final | 4.2.15.Final | MEDIUM |
| CVE-2026-41417 | io.netty:netty-codec-http | 4.2.10.Final | 4.1.133.Final, 4.2.13.Final | MEDIUM |
| CVE-2026-42580 | io.netty:netty-codec-http | 4.2.10.Final | 4.2.13.Final, 4.1.133.Final | MEDIUM |
| CVE-2026-42581 | io.netty:netty-codec-http | 4.2.10.Final | 4.2.13.Final, 4.1.133.Final | MEDIUM |
| CVE-2026-42585 | io.netty:netty-codec-http | 4.2.10.Final | 4.2.13.Final, 4.1.133.Final | MEDIUM |
| CVE-2026-50020 | io.netty:netty-codec-http | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | MEDIUM |
| CVE-2026-47244 | io.netty:netty-codec-http2 | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | MEDIUM |
| CVE-2026-48043 | io.netty:netty-codec-http2 | 4.2.10.Final | 4.1.135.Final, 4.2.15.Final | MEDIUM |
| CVE-2026-50560 | io.netty:netty-codec-http2 | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | MEDIUM |
| CVE-2026-44248 | io.netty:netty-codec-mqtt | 4.2.10.Final | 4.2.13.Final, 4.1.133.Final | MEDIUM |
| CVE-2026-42586 | io.netty:netty-codec-redis | 4.2.10.Final | 4.2.13.Final, 4.1.133.Final | MEDIUM |
| CVE-2026-45673 | io.netty:netty-resolver-dns | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | MEDIUM |
| CVE-2026-45536 | io.netty:netty-transport-native-epoll | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | MEDIUM |
| CVE-2026-45536 | io.netty:netty-transport-native-epoll | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | MEDIUM |
| CVE-2026-45536 | io.netty:netty-transport-native-epoll | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | MEDIUM |
| CVE-2026-45536 | io.netty:netty-transport-native-kqueue | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | MEDIUM |
| CVE-2026-45536 | io.netty:netty-transport-native-kqueue | 4.2.10.Final | 4.2.15.Final, 4.1.135.Final | MEDIUM |
| CVE-2026-45292 | io.opentelemetry:opentelemetry-api | 1.60.1 | 1.62.0 | MEDIUM |
| CVE-2026-45292 | io.opentelemetry:opentelemetry-api | 1.60.1 | 1.62.0 | MEDIUM |
| CVE-2026-45292 | io.opentelemetry:opentelemetry-extension-trace-propagators | 1.60.1 | 1.62.0 | MEDIUM |
| CVE-2026-46718 | org.apache.calcite:calcite-core | 1.37.0 | 1.42.0 | MEDIUM |
| CVE-2026-45205 | org.apache.commons:commons-configuration2 | 2.13.0 | 2.15.0 | MEDIUM |
| CVE-2024-6763 | org.eclipse.jetty:jetty-http | 11.0.26 | 12.0.12 | MEDIUM |
| CVE-2024-52980 | org.elasticsearch:elasticsearch | 7.17.29 | 8.15.1 | MEDIUM |
| CVE-2025-37727 | org.elasticsearch:elasticsearch | 7.17.29 | 8.18.8, 8.19.5, 9.0.8, 9.1.5 | MEDIUM |
| CVE-2025-37731 | org.elasticsearch:elasticsearch | 7.17.29 | 8.19.8, 9.1.8, 9.2.2 | MEDIUM |
| CVE-2026-54514 | tools.jackson.core:jackson-databind | 3.1.0 | 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54515 | tools.jackson.core:jackson-databind | 3.1.0 | 3.1.4 | MEDIUM |
| CVE-2026-54516 | tools.jackson.core:jackson-databind | 3.1.0 | 3.1.4 | MEDIUM |
| CVE-2026-54517 | tools.jackson.core:jackson-databind | 3.1.0 | 3.1.4 | MEDIUM |
| CVE-2026-54518 | tools.jackson.core:jackson-databind | 3.1.0 | 3.1.4 | MEDIUM |
| CVE-2026-32282 | stdlib | v1.26.1 | 1.25.9, 1.26.2 | MEDIUM |
| CVE-2026-32288 | stdlib | v1.26.1 | 1.25.9, 1.26.2 | MEDIUM |
| CVE-2026-32289 | stdlib | v1.26.1 | 1.25.9, 1.26.2 | MEDIUM |
| CVE-2026-39823 | stdlib | v1.26.1 | 1.25.10, 1.26.3 | MEDIUM |
| CVE-2026-39825 | stdlib | v1.26.1 | 1.25.10, 1.26.3 | MEDIUM |
| CVE-2026-39826 | stdlib | v1.26.1 | 1.25.10, 1.26.3 | MEDIUM |
| CVE-2026-42505 | stdlib | v1.26.1 | 1.25.12, 1.26.5, 1.27.0-rc.2 | MEDIUM |
| CVE-2026-42507 | stdlib | v1.26.1 | 1.25.11, 1.26.4 | MEDIUM |
| CVE-2026-10532 | ch.qos.logback:logback-core | 1.5.32 | 1.5.35 | LOW |
| CVE-2026-9828 | ch.qos.logback:logback-core | 1.5.32 | 1.5.33 | LOW |
| CVE-2020-8908 | com.google.guava:guava | 29.0-android | 32.0.0-android | LOW |
| CVE-2026-42578 | io.netty:netty-handler-proxy | 4.2.10.Final | 4.1.133.Final, 4.2.13.Final | LOW |
| CVE-2025-11143 | org.eclipse.jetty:jetty-http | 11.0.26 | 12.0.31, 12.1.5 | LOW |
| CVE-2026-39824 | golang.org/x/sys | v0.42.0 | 0.44.0 | UNKNOWN |
Awaiting upstream fix
No fix is available yet for these vulnerabilities. They can be suppressed in your compliance tooling until an upstream fix is released.
- CVE-2025-48924MEDIUM
- Package
- commons-lang:commons-lang
- Installed
- 2.6
- Fixed
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2025-48924 | commons-lang:commons-lang | 2.6 | MEDIUM |
Original image reference
docker.io/trinodb/trino:480