chore(findings): opensource/joern/joern

Summary

opensource/joern/joern has 1 new findings discovered during continuous monitoring.

More information can be found in the VAT located here: https://vat.dso.mil/vat/image?imageName=opensource/joern/joern&tag=v4.0.453&branch=master

EPSS (Exploit Prediction Scoring System) provides an estimate of the likelihood that a vulnerability will be exploited in the wild.

KEV (Known Exploited Vulnerabilities) indicates whether a vulnerability is actively being exploited according to CISA.

id	source	severity	package	impact	workaround	epss_score	kev
CVE-2025-66293	Twistlock CVE	Low	libpng-1.6.51-r0			0.00042	false

More information can be found in the VAT located here: https://vat.dso.mil/vat/image?imageName=opensource/joern/joern&tag=v4.0.453&branch=master

Novel Tidelift Findings (Experimental)

opensource/joern/joern has 20 novel Tidelift findings discovered during continuous monitoring.

NOTE: This table is for Iron Bank evaluation and testing purposes. No action required by vendors.

id	cvss score	package	impact	workaround	epss_score	kev
CVE-2021-0341	7.5	com.squareup.okhttp3:okhttp-4.7.2			0.01174	false
CVE-2024-26308	5.5	org.apache.commons:commons-compress-1.21	If you unpack a file in the Pack200 format, and that file has been specially crafted or corrupted, the library will attempt to allocate more memory than is available.		0.00448	false
CVE-2023-3635	7.5	com.squareup.okio:okio-2.6.0			0.00335	false
CVE-2025-9784	7.5	io.undertow:undertow-core-2.3.18.Final			0.00319	false
CVE-2021-22569	5.5	com.google.protobuf:protobuf-java-3.18.0			0.00291	false
CVE-2024-47554	4.3	commons-io:commons-io-2.11.0	Either an application is using the class org.apache.commons.io.input.XmlStreamReader or it is not if the class is in use then attackers can craft malicious input to make the application vulnerable if that application accepts input to XmlStreamReader from the world at large. If an application can be relatively certain that its XmlStreamReader input can be trusted, the risk could be lowered from a vulnerability to a bug.	An application could mitigate this vulnerability by validating the input given to the class.	0.00177	false
CVE-2022-3509	7.5	com.google.protobuf:protobuf-java-3.18.0			0.00131	false
CVE-2024-23078		org.jgrapht:jgrapht-core-1.5.1			0.00128	false
CVE-2022-3171	7.5	com.google.protobuf:protobuf-java-3.18.0			0.00090	false
CVE-2025-8916	6.3	org.bouncycastle:bcprov-jdk18on-1.78			0.00087	false
CVE-2025-8916	6.3	org.bouncycastle:bctls-jdk18on-1.78			0.00087	false
CVE-2025-8916	6.3	org.bouncycastle:bcpkix-jdk18on-1.78			0.00087	false
CVE-2024-7254	8.7	com.google.protobuf:protobuf-java-3.21.8			0.00085	false
CVE-2024-7254	8.7	com.google.protobuf:protobuf-java-3.18.0			0.00085	false
CVE-2022-3510	7.5	com.google.protobuf:protobuf-java-3.18.0			0.00066	false
CVE-2023-0833	5.5	com.squareup.okhttp3:okhttp-4.7.2			0.00036	false
CVE-2024-23079		org.jgrapht:jgrapht-core-1.5.1			0.00026	false
CVE-2024-25710	5.5	org.apache.commons:commons-compress-1.21	If you read a DUMP file that is specially crafted or corrupted, the library will enter an infinite loop.		0.00019	false
CVE-2025-48924	6.5	org.apache.commons:commons-lang3-3.17.0	An application or library would need to not only use the API or one of its call sites but also allow for very long inputs for a class name. Alternatively, if the app or library accepts input from the user or a configuration file, the app stack may be vulnerable.		0.00014	false
CVE-2025-48924	6.5	org.apache.commons:commons-lang3-3.12.0	An application or library would need to not only use the API or one of its call sites but also allow for very long inputs for a class name. Alternatively, if the app or library accepts input from the user or a configuration file, the app stack may be vulnerable.		0.00014	false

Tasks

Contributor:

• Apply the StatusReview label to this issue for a merge request review and wait for feedback

OR

• Provide justifications for findings in the VAT (docs)
• Apply the StatusVerification label to this issue for a VAT justifications review and wait for feedback

Iron Bank:

• Review findings and justifications

Note: If the above process is rejected for any reason, the Review or Verification label will be removed and the issue will be sent back to To-Do. Any comments will be listed in this issue for you to address. Once they have been addressed, you must re-add the Review or Verification label.

Questions?

Contact the Iron Bank team by commenting on this issue with your questions or concerns. If you do not receive a response, add /cc @ironbank-notifications/onboarding.

Additionally, Iron Bank hosts an AMA working session every Wednesday from 1630-1730EST to answer questions.