StackRadar

CVE-2024-47554

High

Advisory

Published 3 Oct 2024In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.013
69th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
355
of 17,781 indexed, latest versions
Container images
389
deployed by those charts
Fix available
1 of 1
affected package

Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

Carried by container images the latest versions of 355 of 17,781 indexed charts deploy, on 389 images.

Affected packageAffected versionsFixed inImages
commons-iomaven2.0, 2.1, 2.2, 2.3+10 more2.14.0389
OSV records
GHSA-78wr-2p64-hpwj

Charts affected

355 by stars
ChartLatestAffected imagesRadar Score
workshop-pipelinesworkshop-pipelines0.1.61 of 2See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2024-47554.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/workshop-pipelines:lateste383ba3e0966
commons-io@2.6
2.14.0

Open the chart page →

11,577
is-pattern-1wso2is-pattern15.11.01 of 2See more

is-pattern-1 wso2is-pattern1 5.11.0

1 of the 2 container images this version deploys carry CVE-2024-47554.

Container imageDigestPackageFixed in
massimolauri/wso2is:5.11.0-centose08abf0ce767
commons-io@2.0
2.14.0

Open the chart page →

6,213
zahori-processzahoriVerified publisher1.0.11 of 1See more

zahori-process zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2024-47554.

Container imageDigestPackageFixed in
zahoriaut/zahori-process:0.1.13351f8a220ed7
commons-io@2.12.0
2.14.0

Open the chart page →

3,480
zahori-serverzahoriVerified publisher1.0.11 of 2See more

zahori-server zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2024-47554.

Container imageDigestPackageFixed in
zahoriaut/zahori-server:0.1.17b2de13916f3e
commons-io@2.11.0
2.14.0

Open the chart page →

5,846
keycloakxzaks2.2.01 of 1See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2024-47554.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:20.0.3b8f2a453a17a
commons-io@2.7
2.14.0

Open the chart page →

6,016

Container images carrying it

389 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
airbyte/cron:0.40.17caf4f551c546
commons-io@2.7
2.14.0
1
airsonicadvanced/airsonic-advanced:latestf7cbafac2806
commons-io@2.6
2.14.0
1
aktosecurity/data-ingestion-service213aded7adc5
commons-io@2.6
2.14.0
1
aktosecurity/data-ingestion-service:1.4.946ed5bcb04b2
commons-io@2.6
2.14.0
1
andrianrf/backoffice-be:latest6036614803d4
commons-io@2.11.0
2.14.0
1
andrianrf/iso-server:latest7da47f525c7d
commons-io@2.11.0
2.14.0
1
anguda/ant-media:2.5c435285fc241
commons-io@2.6
2.14.0
1
apache/activemq-artemis:2.37.0bae523439ee3
commons-io@2.11.0
2.14.0
1
apache/bookkeeper:4.14.5a7d9970c148f
commons-io@2.7
2.14.0
1
apache/camel-k:1.10.43bb13d14f64a
commons-io@2.6
2.14.0
1
apache/drill:1.21.11f96558fd292
commons-io@2.7
2.14.0
1
apache/druid:29.0.10cef139b6bf1
commons-io@2.8.0
2.14.0
1
apache/gravitino-iceberg-rest:1.3.080136ae753ee
commons-io@2.8.0
2.14.0
1
apache/hadoop:3af361b20bec0
commons-io@2.8.0
2.14.0
1
apacheignite/ignite:2.7.0d7deab68b8fa
commons-io@2.5
2.14.0
1
apache/iotdb:0.11.28647309f95d1
commons-io@2.5
2.14.0
1
apache/iotdb:0.13.3-nodeafa47bf1692a
commons-io@2.11.0
2.14.0
1
apache/nifi-registry:1.14.0090b7f87ec7f
commons-io@2.10.0
2.14.0
1
apache/nifi-registry:0.8.0974efa2f21da
commons-io@2.5
2.14.0
1
apachepinot/pinot:latest-jdk110018bb04ced7
commons-io@2.11.0
2.14.0
1
apachepulsar/pulsar:3.1.016f9fdab3fa6
commons-io@2.8.0
2.14.0
1
apachepulsar/pulsar:2.10.03b262ab7a7d9
commons-io@2.8.0
2.14.0
1
apachepulsar/pulsar:2.6.14db6ff0b4045
commons-io@2.5
2.14.0
1
apachepulsar/pulsar:2.9.0d056c89b7131
commons-io@2.8.0
2.14.0
1
apachepulsar/pulsar:2.8.2d538416d5afe
commons-io@2.8.0
2.14.0
1
apache/ranger:2.7.076c176e8a0e4
commons-io@2.11.0
2.14.0
1
apache/rocketmq:5.3.0434d8398f996
commons-io@2.7
2.14.0
1
apache/shenyu-admin:2.5.1e2be712fc4f4
commons-io@2.11.0
2.14.0
1
apache/shenyu-bootstrap:2.5.11bd5756f6273
commons-io@2.11.0
2.14.0
1
apache/skywalking-oap-server:9.2.0133d35d2c263
commons-io@2.7
2.14.0
1
apache/skywalking-oap-server:8.1.0-es7641237e0299b
commons-io@2.6
2.14.0
1
apache/skywalking-oap-server:8.9.1b4ec8c18d079
commons-io@2.6
2.14.0
1
apache/skywalking-ui:8.1.067d50e4deff4
commons-io@2.4
2.14.0
1
apache/tika:2.9.0.092d055a84e9e
commons-io@2.13.0
2.14.0
1
apicurio/apicurio-registry-kafkasql:2.1.0.Finala97d67487532
commons-io@2.6
2.14.0
1
apicurio/apicurio-studio-api:0.2.62.Final302d202ed149
commons-io@2.13.0
2.14.0
1
apicurio/apicurio-studio-ui:0.2.62.Final349c845270c2
commons-io@2.13.0
2.14.0
1
apicurio/apicurio-studio-ws:0.2.62.Final27a91978a388
commons-io@2.11.0
2.14.0
1
arturisimo/planner:v1.0fff9de644941
commons-io@2.6
2.14.0
1
assistiot/automated_configuration:latest23f195a7a26a
commons-io@2.6
2.14.0
1
assistiot/cybersecurity-monitoring_id-elk:latestba1d85ec3739
commons-io@2.3
2.14.0
1
assistiot/cybersecurity-monitoring_ir-ctx:latestae8b3d72eb5d
commons-io@2.5
2.14.0
1
assistiot/cybersecurity-monitoring_ir-thv:latestc8b6c7eaa0cd
commons-io@2.8.0
2.14.0
1
assistiot/identity-manager_kc:latest0df4b4fa899a
commons-io@2.8.0
2.14.0
1
assistiot/sdn_controller:2.4.0ea254b6d8a31
commons-io@2.6
2.14.0
1
assistiot/tacticle_dashboard:api-lateste4414cb72dc4
commons-io@2.11.0
2.14.0
1
atlassian/confluence-server:7.10.03b9222ab32ef
commons-io@2.6
2.14.0
1
atlassian/jira-software:8.14.037bc46cbec1a
commons-io@2.6
2.14.0
1
atlassian/jira-software:9.7.264a75aa4ec4e
commons-io@2.8.0
2.14.0
1
atomix/atomix:3.1.127738ff4f5c63
commons-io@2.5
2.14.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.