StackRadar

CVE-2014-125087

Critical

Advisory

Published 19 Feb 2023In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.012
67th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
22
of 17,781 indexed, latest versions
Container images
16
deployed by those charts
Fix available
1 of 1
affected package

java-xmlbuilder vulnerable to XML External Entity Reference

Carried by container images the latest versions of 22 of 17,781 indexed charts deploy, on 16 images.

Affected packageAffected versionsFixed inImages
java-xmlbuildermaven0.4, 1.01.216
OSV records
GHSA-3vrc-rrpw-r5pw

Charts affected

22 by stars
ChartLatestAffected imagesRadar Score
sparkmicrosoft1.0.41 of 3See more

spark microsoft 1.0.4

1 of the 3 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
dbanda/livy:0.80ca125e68e53
java-xmlbuilder@1.0
1.2

Open the chart page →

13,738
hivedmwm-bigdataVerified publisher0.1.63 of 5See more

hive dmwm-bigdata 0.1.6

3 of the 5 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
bde2020/hive:2.3.2-postgresql-metastore620267768985
java-xmlbuilder@0.4
1.2
gradiant/hdfs:2.7.73b28784ba41f
java-xmlbuilder@0.4
1.2
gradiant/hive:2.3.2-postgresql-metastoreaae4f8a21f8b
java-xmlbuilder@0.4
1.2

Open the chart page →

20,837
hive-metastoreslamdev0.0.51 of 2See more

hive-metastore slamdev 0.0.5

1 of the 2 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
slamdev/apache-hive:2.3.9-2.10.1b4b029c9b15f
java-xmlbuilder@0.4
1.2

Open the chart page →

8,198
hadoopcloudnativeapp1.1.01 of 1See more

hadoop cloudnativeapp 1.1.0

1 of the 1 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
danisla/hadoop:2.9.0255ba2dd739b
java-xmlbuilder@0.4
1.2

Open the chart page →

5,772
ignitecloudnativeapp1.0.01 of 1See more

ignite cloudnativeapp 1.0.0

1 of the 1 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
apacheignite/ignite:2.7.0d7deab68b8fa
java-xmlbuilder@0.4
1.2

Open the chart page →

7,891
hbasedmwm-bigdataVerified publisher0.1.62 of 5See more

hbase dmwm-bigdata 0.1.6

2 of the 5 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
gradiant/hbase-base:2.0.1a1ee6de94c04
java-xmlbuilder@0.4
1.2
gradiant/hdfs:2.7.73b28784ba41f
java-xmlbuilder@0.4
1.2

Open the chart page →

13,392
hive-metastoredmwm-bigdataVerified publisher0.1.31 of 2See more

hive-metastore dmwm-bigdata 0.1.3

1 of the 2 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
bde2020/hive:2.3.2-postgresql-metastore620267768985
java-xmlbuilder@0.4
1.2

Open the chart page →

6,882
opentsdbdmwm-bigdataVerified publisher0.1.72 of 6See more

opentsdb dmwm-bigdata 0.1.7

2 of the 6 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
gradiant/hbase-base:2.0.1a1ee6de94c04
java-xmlbuilder@0.4
1.2
gradiant/hdfs:2.7.73b28784ba41f
java-xmlbuilder@0.4
1.2

Open the chart page →

17,511
hbasegradiant-bigdataVerified publisher0.1.62 of 5See more

hbase gradiant-bigdata 0.1.6

2 of the 5 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
gradiant/hbase-base:2.0.1a1ee6de94c04
java-xmlbuilder@0.4
1.2
gradiant/hdfs:2.7.73b28784ba41f
java-xmlbuilder@0.4
1.2

Open the chart page →

13,392
gridgaingridgainOfficialVerified publisher1.0.61 of 1See more

gridgain gridgain 1.0.6

1 of the 1 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
gridgain/community:8.9.11d32d182a0e6a
java-xmlbuilder@0.4
1.2

Open the chart page →

4,679
hadoopmiuler1.2.21 of 1See more

hadoop miuler 1.2.2

1 of the 1 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
danisla/hadoop:2.9.0255ba2dd739b
java-xmlbuilder@0.4
1.2

Open the chart page →

5,772
starwhalestarwhaleVerified publisher0.6.151 of 4See more

starwhale starwhale 0.6.15

1 of the 4 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
ghcr.io/star-whale/server:0.6.158368359c8dd0
java-xmlbuilder@0.4
1.2

Open the chart page →

13,486
chart-app-vidapp-vid-chartVerified publisher0.0.71 of 2See more

chart-app-vid app-vid-chart 0.0.7

1 of the 2 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
fimperato/sparkvid-api:1.0.5-RELEASE604012b77841
java-xmlbuilder@0.4
1.2

Open the chart page →

8,866
spark-shuffleduyet0.2.01 of 1See more

spark-shuffle duyet 0.2.0

1 of the 1 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
snappydatainc/spark-shuffle:v2.2.0-kubernetes-0.5.1fd4b2070466f
java-xmlbuilder@1.0
1.2

Open the chart page →

5,639
hdfsgradiant-bigdataVerified publisher0.1.101 of 2See more

hdfs gradiant-bigdata 0.1.10

1 of the 2 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
gradiant/hdfs:2.7.73b28784ba41f
java-xmlbuilder@0.4
1.2

Open the chart page →

7,073
hivegradiant-bigdataVerified publisher0.1.63 of 5See more

hive gradiant-bigdata 0.1.6

3 of the 5 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
bde2020/hive:2.3.2-postgresql-metastore620267768985
java-xmlbuilder@0.4
1.2
gradiant/hdfs:2.7.73b28784ba41f
java-xmlbuilder@0.4
1.2
gradiant/hive:2.3.2-postgresql-metastoreaae4f8a21f8b
java-xmlbuilder@0.4
1.2

Open the chart page →

20,837
hive-metastoregradiant-bigdataVerified publisher0.1.31 of 2See more

hive-metastore gradiant-bigdata 0.1.3

1 of the 2 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
bde2020/hive:2.3.2-postgresql-metastore620267768985
java-xmlbuilder@0.4
1.2

Open the chart page →

6,882
opentsdbgradiant-bigdataVerified publisher0.1.72 of 6See more

opentsdb gradiant-bigdata 0.1.7

2 of the 6 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
gradiant/hbase-base:2.0.1a1ee6de94c04
java-xmlbuilder@0.4
1.2
gradiant/hdfs:2.7.73b28784ba41f
java-xmlbuilder@0.4
1.2

Open the chart page →

17,511
hbasehbase0.1.71 of 4See more

hbase hbase 0.1.7

1 of the 4 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
ghcr.io/fleeksoft/hbase/hbase-base:2.4.13.2c144bdd688d7
java-xmlbuilder@0.4
1.2

Open the chart page →

10,540
ibm-business-automation-insights-devibm-charts3.2.01 of 6See more

ibm-business-automation-insights-dev ibm-charts 3.2.0

1 of the 6 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
ibmcom/bai-flink-dev:19.0.2e31ff09e8aad
java-xmlbuilder@0.4
1.2

Open the chart page →

39,349
delta-sharing-serverinseefrlab1.2.11 of 1See more

delta-sharing-server inseefrlab 1.2.1

1 of the 1 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
deltaio/delta-sharing-server:0.2.08b75118187c5
java-xmlbuilder@0.4
1.2

Open the chart page →

6,174
pinotinseefrlab0.2.01 of 2See more

pinot inseefrlab 0.2.0

1 of the 2 container images this version deploys carry CVE-2014-125087.

Container imageDigestPackageFixed in
apachepinot/pinot:latest-jdk110018bb04ced7
java-xmlbuilder@0.4
1.2

Open the chart page →

10,777

Container images carrying it

16 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
gradiant/hdfs:2.7.73b28784ba41f
java-xmlbuilder@0.4
1.2
7
bde2020/hive:2.3.2-postgresql-metastore620267768985
java-xmlbuilder@0.4
1.2
4
gradiant/hbase-base:2.0.1a1ee6de94c04
java-xmlbuilder@0.4
1.2
4
danisla/hadoop:2.9.0255ba2dd739b
java-xmlbuilder@0.4
1.2
2
gradiant/hive:2.3.2-postgresql-metastoreaae4f8a21f8b
java-xmlbuilder@0.4
1.2
2
apacheignite/ignite:2.7.0d7deab68b8fa
java-xmlbuilder@0.4
1.2
1
apachepinot/pinot:latest-jdk110018bb04ced7
java-xmlbuilder@0.4
1.2
1
dbanda/livy:0.80ca125e68e53
java-xmlbuilder@1.0
1.2
1
deltaio/delta-sharing-server:0.2.08b75118187c5
java-xmlbuilder@0.4
1.2
1
fimperato/sparkvid-api:1.0.5-RELEASE604012b77841
java-xmlbuilder@0.4
1.2
1
gridgain/community:8.9.11d32d182a0e6a
java-xmlbuilder@0.4
1.2
1
ibmcom/bai-flink-dev:19.0.2e31ff09e8aad
java-xmlbuilder@0.4
1.2
1
slamdev/apache-hive:2.3.9-2.10.1b4b029c9b15f
java-xmlbuilder@0.4
1.2
1
snappydatainc/spark-shuffle:v2.2.0-kubernetes-0.5.1fd4b2070466f
java-xmlbuilder@1.0
1.2
1
ghcr.io/fleeksoft/hbase/hbase-base:2.4.13.2c144bdd688d7
java-xmlbuilder@0.4
1.2
1
ghcr.io/star-whale/server:0.6.158368359c8dd0
java-xmlbuilder@0.4
1.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.