CVE-2024-47554
HighAdvisory
Published 3 Oct 2024In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.013
- 69th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 355
- of 17,781 indexed, latest versions
- Container images
- 389
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader
Carried by container images the latest versions of 355 of 17,781 indexed charts deploy, on 389 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| commons-iomaven | 2.0, 2.1, 2.2, 2.3+10 more | 2.14.0 | 389 |
- OSV records
- GHSA-78wr-2p64-hpwj
Charts affected
355 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| workshop-pipelinesworkshop-pipelines | 0.1.6 | 1 of 2See more | 11,577 |
| is-pattern-1wso2is-pattern1 | 5.11.0 | 1 of 2See more | 6,213 |
| zahori-processzahoriVerified publisher | 1.0.1 | 1 of 1See more | 3,480 |
| zahori-serverzahoriVerified publisher | 1.0.1 | 1 of 2See more | 5,846 |
| keycloakxzaks | 2.2.0 | 1 of 1See more | 6,016 |
Container images carrying it
389 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| freeipa/ | c87d77342bf5 | commons-io | 2.14.0 | 1 |
| gchq/ | c460bb587d6d | commons-io | 2.14.0 | 1 |
| geonetwork/ | 20c9bb761f67 | commons-io | 2.14.0 | 1 |
| geoservercloud/ | 5dc0c93a1710 | commons-io | 2.14.0 | 1 |
| geoservercloud/ | 47ae1bdb4bcc | commons-io | 2.14.0 | 1 |
| geoservercloud/ | 28c3e5a8c5a3 | commons-io | 2.14.0 | 1 |
| geoservercloud/ | 8c70ee06d5ab | commons-io | 2.14.0 | 1 |
| geoservercloud/ | 42775ba6a4da | commons-io | 2.14.0 | 1 |
| gocd/ | 53588bd3221f | commons-io | 2.14.0 | 1 |
| gocd/ | 2da45cb09d57 | commons-io | 2.14.0 | 1 |
| gotson/ | 9b15ea6bfc30 | commons-io | 2.14.0 | 1 |
| gradiant/ | e3bf364fe713 | commons-io | 2.14.0 | 1 |
| graviteeio/ | 07b7f6dc267a | commons-io | 2.14.0 | 1 |
| graviteeio/ | a8eb04ee0c70 | commons-io | 2.14.0 | 1 |
| graylog2/ | 8ff28c66e6c1 | commons-io | 2.14.0 | 1 |
| graylog/ | 8a1f641cd7aa | commons-io | 2.14.0 | 1 |
| gresearchdev/ | 91863a50afb7 | commons-io | 2.14.0 | 1 |
| gridgain/ | d32d182a0e6a | commons-io | 2.14.0 | 1 |
| gurolakman/ | 9abb3882bcbd | commons-io | 2.14.0 | 1 |
| gurolakman/ | 6537e8ed8de8 | commons-io | 2.14.0 | 1 |
| gurolakman/ | ce23b20a8a17 | commons-io | 2.14.0 | 1 |
| gurolakman/ | b22e746edd5d | commons-io | 2.14.0 | 1 |
| gurolakman/ | bf18525c5ad9 | commons-io | 2.14.0 | 1 |
| gurolakman/ | 8739565c3ea2 | commons-io | 2.14.0 | 1 |
| hazelcast/ | 8fe26efde8e1 | commons-io | 2.14.0 | 1 |
| hazelcast/ | a825ecbe9fda | commons-io | 2.14.0 | 1 |
| hazelcast/ | f9d34300d330 | commons-io | 2.14.0 | 1 |
| hivemq/ | 4d194450d48e | commons-io | 2.14.0 | 1 |
| housewrecker/ | f417dd0a7547 | commons-io | 2.14.0 | 1 |
| huertaslopez/ | e2c18bd65472 | commons-io | 2.14.0 | 1 |
| hugohg34/ | 171f61e8d7e2 | commons-io | 2.14.0 | 1 |
| iamdorsah/ | db83a0254d81 | commons-io | 2.14.0 | 1 |
| ibmcom/ | e31ff09e8aad | commons-io | 2.14.0 | 1 |
| ibmcom/ | b558f2b444ae | commons-io | 2.14.0 | 1 |
| ibmcom/ | ab3fd1fdfa18 | commons-io | 2.14.0 | 1 |
| ibmcom/ | ed5505e5c7ec | commons-io | 2.14.0 | 1 |
| ibmcom/ | e17bdccc5030 | commons-io | 2.14.0 | 1 |
| jacobalberty/ | 4a3616625dda | commons-io | 2.14.0 | 1 |
| jacobalberty/ | b3edc809a3ff | commons-io | 2.14.0 | 1 |
| jacobalberty/ | c409924e2463 | commons-io | 2.14.0 | 1 |
| jenkinsci/ | a1f33f004659 | commons-io | 2.14.0 | 1 |
| jingking/ | 43e74ab234e1 | commons-io | 2.14.0 | 1 |
| just1not2/ | 8a2305192dec | commons-io | 2.14.0 | 1 |
| kafkace/ | 7adc206bf5a4 | commons-io | 2.14.0 | 1 |
| kafkakraft/ | 062d697db7e5 | commons-io | 2.14.0 | 1 |
| kafkakraft/ | f261ad288fce | commons-io | 2.14.0 | 1 |
| kafkakraft/ | 2e4b593b878b | commons-io | 2.14.0 | 1 |
| keyfactor/ | 798fbbe00283 | commons-io | 2.14.0 | 1 |
| krontechnology/ | 7feef7d2ab42 | commons-io | 2.14.0 | 1 |
| ladeit/ | 962b665ffe82 | commons-io | 2.14.0 | 1 |