chore(findings): opensource/apache/hop/hop-web

Summary

opensource/apache/hop/hop-web has 1 new findings discovered during continuous monitoring.

More information can be found in the VAT located here: https://vat.dso.mil/vat/image?imageName=opensource/apache/hop/hop-web&tag=2.15.0&branch=master

EPSS (Exploit Prediction Scoring System) provides an estimate of the likelihood that a vulnerability will be exploited in the wild.

KEV (Known Exploited Vulnerabilities) indicates whether a vulnerability is actively being exploited according to CISA.

id	source	severity	package	impact	workaround	epss_score	kev
CVE-2025-58056	Twistlock CVE	High	io.netty_netty-codec-http-4.1.122.Final			N/A	false

More information can be found in the VAT located here: https://vat.dso.mil/vat/image?imageName=opensource/apache/hop/hop-web&tag=2.15.0&branch=master

Novel Tidelift Findings (Experimental)

opensource/apache/hop/hop-web has 46 novel Tidelift findings discovered during continuous monitoring.

NOTE: This table is for Iron Bank evaluation and testing purposes. No action required by vendors.

id	cvss score	package	impact	workaround	epss_score	kev
CVE-2021-34429	5.3	org.eclipse.jetty:jetty-webapp-9.4.41.v20210516	Jetty server users are vulnerable to UTF16 encoding of u to bypass all uri constraints.		0.93720	false
CVE-2016-1000027	9.8	org.springframework:spring-core-5.3.27			0.59211	false
CVE-2023-26048	5.3	org.eclipse.jetty:jetty-server-9.4.41.v20210516	Low effort request can result in an OutOfMemoryError	Do not use defaults for Servlet Multipart Configs.Specify values for fileSizeThreshold, location, maxFileSize, and maxRequestSize	0.36142	false
CVE-2016-5699	6.1	urllib3-1.24.2	Its unlikely for an attacker to control URLs.	Reject URLs with rn or encode those characters.	0.10605	false
CVE-2019-9740	6.1	urllib3-1.24.2	Its unlikely for an attacker to control the URL youre fetching.		0.10210	false
CVE-2024-6345	8.8	setuptools-39.2.0	Most users have migrated off of the code paths that are affected. The affected code paths are actively deprecated and planned for turn down. Only specialized and legacy workflows are affected.	Use recommended installers pip, uv, build, system package managers to install all packages from trusted indexes. If working with untrusted content in private indexes, consider scanning for malicious code in the package index pages.	0.09839	false
CVE-2023-32681	6.1	requests-2.20.0	Requires that deployment or integration of requests is being used to a connect to untrusted hosts b is connecting over HTTPS and c is using proxies to do so.		0.06277	false
CVE-2018-12545	7.5	org.eclipse.jetty:jetty-server-9.4.41.v20210516	Very easy to exploit. Many malicious tools exist to exploit this this vulnerability.	Disable use of HTTP2 on server and client	0.04755	false
CVE-2023-40167	5.3	org.eclipse.jetty:jetty-http-9.4.41.v20210516	Trivially easy to trigger, request smuggling likely scenario.		0.02699	false
CVE-2019-11324	7.5	urllib3-1.24.2	cacerts is a commonly used parameter.		0.01449	false
CVE-2022-2048	7.5	org.eclipse.jetty:jetty-http-9.4.41.v20210516	While somewhat tricky to intentionally trigger, it is trivially easy to accidentally trigger, esp with mobile client connections.	Do not use HTTP2 on vulnerable versions	0.01411	false
CVE-2023-36478	7.5	org.eclipse.jetty:jetty-http-9.4.41.v20210516	Very tricky to trigger intentionally. No exploit is known for this vulnerability.		0.01086	false
CVE-2019-9947	6.1	urllib3-1.24.2	Its unlikely for an attacker to control an URL.	Reject URLs with rn or encode those characters.	0.00990	false
CVE-2022-2047	2.7	org.eclipse.jetty:jetty-http-9.4.41.v20210516	Can be caused by a carefully crafted client request		0.00878	false
CVE-2021-33503	7.5	urllib3-1.24.2	Attackers dont usually control the URLs that urllib3 fetches.	Its possible but inconvenient to filter URLs with many .	0.00863	false
CVE-2024-9823	5.3	org.eclipse.jetty:jetty-servlets-9.4.41.v20210516	Any use of DosFilter with trackSessions to true is vulnerable.	The DoSFilter can be configured to not use sessions for tracking usage by setting the trackSessions init parameter to false. This will then use only the IP tracking mechanism, which is not vulnerable.	0.00803	false
CVE-2019-11236	6.1	urllib3-1.24.2	Its unlikely for an attacker to control an URL.	Reject queries with rn or encode those characters.	0.00636	false
CVE-2023-36479	4.3	org.eclipse.jetty:jetty-servlets-9.4.41.v20210516	Very easy to exploit. Class is deprecated in Jetty 7 thru Jetty 11, and fully removed in Jetty 12.		0.00627	false
CVE-2023-43804	8.1	urllib3-1.24.2	Usage of the Cookie header is rare with urllib3. This is more common and useful in browsers. Redirections to another origin are also not the common case.		0.00472	false
CVE-2009-4610		org.mortbay.jetty:jetty-6.1.26			0.00389	false
CVE-2009-4609		org.mortbay.jetty:jetty-6.1.26			0.00376	false
CVE-2024-21634	7.5	software.amazon.ion:ion-java-1.0.2			0.00330	false
CVE-2022-40897	7.5	setuptools-39.2.0	Code path is deprecated.		0.00318	false
CVE-2024-38808	4.3	org.springframework:spring-expression-5.3.27			0.00310	false
CVE-2025-48924	6.5	org.apache.commons:commons-lang3-3.14.0	An application or library would need to not only use the API or one of its call sites but also allow for very long inputs for a class name. Alternatively, if the app or library accepts input from the user or a configuration file, the app stack may be vulnerable.		0.00309	false
CVE-2025-48924	6.5	commons-lang:commons-lang-2.6			0.00309	false
CVE-2025-31672	6.9	org.apache.poi:poi-ooxml-5.3.0	The issue should normally only occur if a malicious actor chooses to put duplicate zip entries in the document or spreadsheet. Excel, Word, Powerpoint should not create files like this. You should normally only accept files from trusted users.		0.00304	false
CVE-2024-35255	5.5	com.azure:azure-identity-1.9.1			0.00295	false
CVE-2023-26049	5.3	org.eclipse.jetty:jetty-server-9.4.41.v20210516	Trivially easy to exploit. Several malicious tools exists to exploit this vulnerability	No workaround	0.00263	false
CVE-2020-26137	6.5	urllib3-1.24.2	Its unlikely to use putrequest which is not documented as part of urllib3s API, but only inherited from http.client.		0.00245	false
CVE-2024-37891	4.4	urllib3-1.24.2	Theres no reason to set ProxyAuthorization without using urllib3s proxy support.	Using the ProxyAuthorization header with urllib3s ProxyManager. Disabling HTTP redirects using redirectsFalse when sending requests. Not using the ProxyAuthorization header.	0.00193	false
CVE-2024-38828	5.3	org.springframework:spring-core-5.3.27			0.00192	false
CVE-2025-47273	7.7	setuptools-39.2.0			0.00139	false
CVE-2024-8184	6.5	org.eclipse.jetty:jetty-server-9.4.41.v20210516	Do not use ThreadLimitHandler.Consider use of QoSHandler instead to artificially limit resource utilization.		0.00113	false
CVE-2024-38827	4.8	org.springframework:spring-expression-5.3.27			0.00111	false
CVE-2024-38827	4.8	org.springframework:spring-core-5.3.27			0.00111	false
CVE-2024-6763	3.7	org.eclipse.jetty:jetty-http-9.4.41.v20210516	If using the Jetty internal HttpURI as part of Jetty server and Jetty client you are not vulnerable.If using HttpURI in your application directly, then you are vulnerable if you use the results of HttpURI to apply filtering based on the given URI.		0.00090	false
CVE-2023-52428	7.5	com.nimbusds:nimbus-jose-jwt-9.30.2			0.00078	false
CVE-2025-48734	8.8	commons-beanutils:commons-beanutils-1.9.4	An application or library can be vulnerable if it allows inputs or configurations from untrusted sources.		0.00056	false
CVE-2025-55163	8.2	io.netty:netty-codec-http2-4.1.122.Final	Although this vulnerability is legit, it is relatively hard to exploit this vulnerability to cause actual server instability, because modern hardware will not spend much resources to handle bogus RSTSTREAM frames.	A user can attach an Http2FrameListener implementation that disconnects a client that sends too many RSTSTREAM or any other invalid frames in a certain amount of time.	0.00055	false
CVE-2023-45803	4.2	urllib3-1.24.2	No exploits from real world were reported	Disable redirects for services that you arent expecting to respond with redirects with redirectsFalse.Disable automatic redirects with redirectsFalse and handle 303 redirects manually by stripping the HTTP request body.	0.00055	false
CVE-2025-53864	5.8	com.nimbusds:nimbus-jose-jwt-9.30.2			0.00042	false
CVE-2024-13009	7.2	org.eclipse.jetty:jetty-server-9.4.41.v20210516	If using GzipHandler, it is not possible to avoid this vulnerability on impacted versions of Jetty.	Dont use an EOL version of Jetty.Dont use GzipHandler.	0.00040	false
CVE-2025-50182	5.3	urllib3-1.24.2	Pyodide is extremely rare configuration for users in production.		0.00013	false
CVE-2025-58057	6.9	io.netty:netty-codec-4.1.122.Final			N/A	false
CVE-2025-58056	8.2	io.netty:netty-codec-http-4.1.122.Final			N/A	false

Tasks

Contributor:

• Provide justifications for findings in the VAT (docs)
• Apply the StatusVerification label to this issue and wait for feedback

Iron Bank:

• Review findings and justifications

Note: If the above process is rejected for any reason, the Verification label will be removed and the issue will be sent back to Open. Any comments will be listed in this issue for you to address. Once they have been addressed, you must re-add the Verification label.

Questions?

Contact the Iron Bank team by commenting on this issue with your questions or concerns. If you do not receive a response, add /cc @ironbank-notifications/onboarding.

Additionally, Iron Bank hosts an AMA working session every Wednesday from 1630-1730EST to answer questions.