Security Report - eizen-agent-gateway

🔴 Vulnerabilities (3)
Severity	CVE ID	Package	Installed	Fixed In	Description
CRITICAL	CVE-2025-66516	org.apache.tika:tika-core	2.9.1	3.2.2	tika-core: tika-parsers: tika-parser-pdf-module: Apache Tika core, Apache Tika parsers, Apache Tika
HIGH	CVE-2026-41731	org.springframework.kafka:spring-kafka	3.2.1	4.0.6, 3.3.16	spring-kafka: Spring for Apache Kafka: Arbitrary code execution via insecure deserialization of craf
MEDIUM	CVE-2026-41726	org.springframework.kafka:spring-kafka	3.2.1	4.0.6, 3.3.16	spring-kafka: Spring-kafka: Denial of Service due to unbounded heap growth via unique header values
🔑 Secrets (0)
Type	File	Line	Match
✅ No secrets found
⚙️ Misconfigurations (1)
Severity	ID	Check	File	Message
HIGH	DS002	Image user should not be 'root'	Dockerfile	Specify at least 1 USER command in Dockerfile with non-root user as argument
📄 Raw JSON Report (click to expand)
{
  "SchemaVersion": 2,
  "CreatedAt": "2026-06-24T06:58:03.0270012Z",
  "ArtifactName": "/src",
  "ArtifactType": "filesystem",
  "Metadata": {
    "ImageConfig": {
      "architecture": "",
      "created": "0001-01-01T00:00:00Z",
      "os": "",
      "rootfs": {
        "type": "",
        "diff_ids": null
      },
      "config": {}
    }
  },
  "Results": [
    {
      "Target": "pom.xml",
      "Class": "lang-pkgs",
      "Type": "pom",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2025-66516",
          "PkgID": "org.apache.tika:tika-core:2.9.1",
          "PkgName": "org.apache.tika:tika-core",
          "PkgIdentifier": {
            "PURL": "pkg:maven/org.apache.tika/tika-core@2.9.1"
          },
          "InstalledVersion": "2.9.1",
          "FixedVersion": "3.2.2",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-66516",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "tika-core: tika-parsers: tika-parser-pdf-module: Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected",
          "Description": "Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. \n\nThis CVE covers the same vulnerability as in\u00a0CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. \n\nFirst, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. \n\nSecond, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the \"org.apache.tika:tika-parsers\" module.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-611"
          ],
          "VendorSeverity": {
            "ghsa": 4,
            "nvd": 4,
            "redhat": 4,
            "ubuntu": 2
          },
          "CVSS": {
            "ghsa": {},
            "nvd": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "V3Score": 10
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2025-66516",
            "https://cve.org/CVERecord?id=CVE-2025-54988",
            "https://github.com/apache/tika",
            "https://lists.apache.org/thread/s5x3k93nhbkqzztp1olxotoyjpdlps9k",
            "https://nvd.nist.gov/vuln/detail/CVE-2025-66516",
            "https://ubuntu.com/security/notices/USN-8324-1",
            "https://www.cve.org/CVERecord?id=CVE-2025-66516"
          ],
          "PublishedDate": "2025-12-04T17:15:57.12Z",
          "LastModifiedDate": "2026-06-17T09:56:58.233Z"
        },
        {
          "VulnerabilityID": "CVE-2026-41731",
          "PkgID": "org.springframework.kafka:spring-kafka:3.2.1",
          "PkgName": "org.springframework.kafka:spring-kafka",
          "PkgIdentifier": {
            "PURL": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.1"
          },
          "InstalledVersion": "3.2.1",
          "FixedVersion": "4.0.6, 3.3.16",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-41731",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "spring-kafka: Spring for Apache Kafka: Arbitrary code execution via insecure deserialization of crafted header values",
          "Description": "JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted header values that caused the consumer to deserialize arbitrary JDK types.\n\nAffected versions:\nSpring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-502"
          ],
          "VendorSeverity": {
            "ghsa": 3,
            "redhat": 3
          },
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 8.1
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 8.1
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2026-41731",
            "https://github.com/spring-projects/spring-kafka",
            "https://nvd.nist.gov/vuln/detail/CVE-2026-41731",
            "https://spring.io/security/cve-2026-41731",
            "https://www.cve.org/CVERecord?id=CVE-2026-41731"
          ],
          "PublishedDate": "2026-06-10T00:16:52.597Z",
          "LastModifiedDate": "2026-06-22T12:58:52.047Z"
        },
        {
          "VulnerabilityID": "CVE-2026-41726",
          "PkgID": "org.springframework.kafka:spring-kafka:3.2.1",
          "PkgName": "org.springframework.kafka:spring-kafka",
          "PkgIdentifier": {
            "PURL": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.1"
          },
          "InstalledVersion": "3.2.1",
          "FixedVersion": "4.0.6, 3.3.16",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-41726",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "spring-kafka: Spring-kafka: Denial of Service due to unbounded heap growth via unique header values",
          "Description": "When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError.\n\nAffected versions:\nSpring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.",
          "Severity": "MEDIUM",
          "CweIDs": [
            "CWE-770"
          ],
          "VendorSeverity": {
            "ghsa": 2,
            "redhat": 2
          },
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 6.5
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 6.5
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2026-41726",
            "https://github.com/spring-projects/spring-kafka",
            "https://github.com/spring-projects/spring-kafka/commit/ca2337ba789c5778a10197bda17a62915247ff6c",
            "https://github.com/spring-projects/spring-kafka/issues/4489",
            "https://nvd.nist.gov/vuln/detail/CVE-2026-41726",
            "https://spring.io/security/cve-2026-41726",
            "https://www.cve.org/CVERecord?id=CVE-2026-41726"
          ],
          "PublishedDate": "2026-06-10T00:16:52.03Z",
          "LastModifiedDate": "2026-06-17T10:47:04.83Z"
        }
      ]
    },
    {
      "Target": "Dockerfile",
      "Class": "config",
      "Type": "dockerfile",
      "MisconfSummary": {
        "Successes": 23,
        "Failures": 1,
        "Exceptions": 0
      },
      "Misconfigurations": [
        {
          "Type": "Dockerfile Security Check",
          "ID": "DS002",
          "AVDID": "AVD-DS-0002",
          "Title": "Image user should not be 'root'",
          "Description": "Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.",
          "Message": "Specify at least 1 USER command in Dockerfile with non-root user as argument",
          "Namespace": "builtin.dockerfile.DS002",
          "Query": "data.builtin.dockerfile.DS002.deny",
          "Resolution": "Add 'USER <non root user name>' line to the Dockerfile",
          "Severity": "HIGH",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ds002",
          "References": [
            "https://docs.docker.com/develop/develop-images/dockerfile_best-practices/",
            "https://avd.aquasec.com/misconfig/ds002"
          ],
          "Status": "FAIL",
          "Layer": {},
          "CauseMetadata": {
            "Provider": "Dockerfile",
            "Service": "general",
            "Code": {
              "Lines": null
            }
          }
        }
      ]
    }
  ]
}
🛡️ Security Scan Report

1

2

1

0

0

1
