StackRadar

CVE-2018-11039

Medium

Advisory

Published 16 Oct 2018In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.027
85th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
11
of 17,781 indexed, latest versions
Container images
12
deployed by those charts
Fix available
1 of 1
affected package

Spring Framework Cross Site Tracing (XST)

Carried by container images the latest versions of 11 of 17,781 indexed charts deploy, on 12 images.

Affected packageAffected versionsFixed inImages
spring-webmaven4.3.1.RELEASE, 4.3.2.RELEASE, 4.3.3.RELEASE, 4.3.6.RELEASE+5 more4.3.18, 5.0.712
OSV records
GHSA-9gcm-f4x3-8jpw

Charts affected

11 by stars
ChartLatestAffected imagesRadar Score
skywalkingkubesphere-testVerified publisher3.1.01 of 4See more

skywalking kubesphere-test 3.1.0

1 of the 4 container images this version deploys carry CVE-2018-11039.

Container imageDigestPackageFixed in
apache/skywalking-ui:8.1.067d50e4deff4
spring-web@4.3.15.RELEASE
4.3.18

Open the chart page →

18,042
event-store-servicechoerodon0.8.01 of 2See more

event-store-service choerodon 0.8.0

1 of the 2 container images this version deploys carry CVE-2018-11039.

Container imageDigestPackageFixed in
choerodon/event-store-service:0.8.03c94c97f6f69
spring-web@4.3.8.RELEASE
4.3.18

Open the chart page →

9,808
pulsarcnieg1.0.81 of 2See more

pulsar cnieg 1.0.8

1 of the 2 container images this version deploys carry CVE-2018-11039.

Container imageDigestPackageFixed in
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
spring-web@5.0.6.RELEASE
5.0.7

Open the chart page →

16,860
my-chartfleet-web-app0.1.02 of 6See more

my-chart fleet-web-app 0.1.0

2 of the 6 container images this version deploys carry CVE-2018-11039.

Container imageDigestPackageFixed in
richardchesterwood/k8s-fleetman-api-gateway:release2518f946b9f05
spring-web@4.3.7.RELEASE
4.3.18
richardchesterwood/k8s-fleetman-position-tracker:release336c43961214c
spring-web@4.3.2.RELEASE
4.3.18

Open the chart page →

24,296
hapi-fhirhapi-fhirVerified publisher0.1.01 of 1See more

hapi-fhir hapi-fhir 0.1.0

1 of the 1 container images this version deploys carry CVE-2018-11039.

Container imageDigestPackageFixed in
polyakov/hapi-fhir-jpaserver-example:latestdbcef69146b8
spring-web@4.3.1.RELEASE
4.3.18

Open the chart page →

6,362
ibm-microclimateibm-charts0.1.02 of 8See more

ibm-microclimate ibm-charts 0.1.0

2 of the 8 container images this version deploys carry CVE-2018-11039.

Container imageDigestPackageFixed in
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
spring-web@4.3.9.RELEASE
4.3.18
ibmcom/microclimate-theia:lateste17bdccc5030
spring-web@4.3.9.RELEASE
4.3.18

Open the chart page →

57,669
pulsarv2milvus-helm2.7.81 of 4See more

pulsarv2 milvus-helm 2.7.8

1 of the 4 container images this version deploys carry CVE-2018-11039.

Container imageDigestPackageFixed in
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
spring-web@5.0.6.RELEASE
5.0.7

Open the chart page →

15,855
polyglotncsaVerified publisher0.1.11 of 18See more

polyglot ncsa 0.1.1

1 of the 18 container images this version deploys carry CVE-2018-11039.

Container imageDigestPackageFixed in
craigwillis/c2metadata-bd:latestae317d7e4724
spring-web@4.3.3.RELEASE
4.3.18

Open the chart page →

55,726
cdn-remoteopencord0.2.41 of 3See more

cdn-remote opencord 0.2.4

1 of the 3 container images this version deploys carry CVE-2018-11039.

Container imageDigestPackageFixed in
omecproject/cdn-antmedia:1.0.0b4ae7d0d6b74
spring-web@4.3.6.RELEASE
4.3.18

Open the chart page →

63,223
ves-agentopencord1.0.21 of 1See more

ves-agent opencord 1.0.2

1 of the 1 container images this version deploys carry CVE-2018-11039.

Container imageDigestPackageFixed in
opencord/ves-agent:1.0.04187e2a8c918
spring-web@5.0.6.RELEASE
5.0.7

Open the chart page →

6,350
streamastreama1.0.11 of 2See more

streama streama 1.0.1

1 of the 2 container images this version deploys carry CVE-2018-11039.

Container imageDigestPackageFixed in
just1not2/streama:1.10.48a2305192dec
spring-web@4.3.6.RELEASE
4.3.18

Open the chart page →

8,554

Container images carrying it

12 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
spring-web@5.0.6.RELEASE
5.0.7
2
apache/skywalking-ui:8.1.067d50e4deff4
spring-web@4.3.15.RELEASE
4.3.18
1
choerodon/event-store-service:0.8.03c94c97f6f69
spring-web@4.3.8.RELEASE
4.3.18
1
craigwillis/c2metadata-bd:latestae317d7e4724
spring-web@4.3.3.RELEASE
4.3.18
1
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
spring-web@4.3.9.RELEASE
4.3.18
1
ibmcom/microclimate-theia:lateste17bdccc5030
spring-web@4.3.9.RELEASE
4.3.18
1
just1not2/streama:1.10.48a2305192dec
spring-web@4.3.6.RELEASE
4.3.18
1
omecproject/cdn-antmedia:1.0.0b4ae7d0d6b74
spring-web@4.3.6.RELEASE
4.3.18
1
opencord/ves-agent:1.0.04187e2a8c918
spring-web@5.0.6.RELEASE
5.0.7
1
polyakov/hapi-fhir-jpaserver-example:latestdbcef69146b8
spring-web@4.3.1.RELEASE
4.3.18
1
richardchesterwood/k8s-fleetman-api-gateway:release2518f946b9f05
spring-web@4.3.7.RELEASE
4.3.18
1
richardchesterwood/k8s-fleetman-position-tracker:release336c43961214c
spring-web@4.3.2.RELEASE
4.3.18
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.