Vulnerable Library - google-cloud-secretmanager-2.39.0.jar
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/opentelemetry/opentelemetry-api/1.36.0/opentelemetry-api-1.36.0.jar
Found in HEAD commit: 21c100d3b0fee337e9a99e3a324b449f35be9262
Vulnerabilities
| Vulnerability |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (google-cloud-secretmanager version) |
Remediation Possible** |
| CVE-2025-55163 |
 High |
7.5 |
grpc-netty-shaded-1.62.2.jar |
Transitive |
N/A* |
❌ |
| CVE-2024-7254 |
High |
7.5 |
protobuf-java-3.25.2.jar |
Transitive |
2.55.0 |
❌ |
| CVE-2026-45292 |
 Medium |
5.3 |
opentelemetry-api-1.36.0.jar |
Transitive |
N/A* |
❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2025-55163
Vulnerable Library - grpc-netty-shaded-1.62.2.jar
gRPC: Netty Shaded
Library home page: https://github.com/grpc/grpc-java
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/grpc/grpc-netty-shaded/1.62.2/grpc-netty-shaded-1.62.2.jar
Dependency Hierarchy:
- google-cloud-secretmanager-2.39.0.jar (Root Library)
- ❌ grpc-netty-shaded-1.62.2.jar (Vulnerable Library)
Found in HEAD commit: 21c100d3b0fee337e9a99e3a324b449f35be9262
Found in base branch: master
Vulnerability Details
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.
Publish Date: 2025-08-13
URL: CVE-2025-55163
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2025-08-13
Fix Resolution: https://github.com/netty/netty.git - 4.2.4.Final,https://github.com/netty/netty.git - netty-4.1.124.Final,io.netty:netty-codec-http2:4.1.124.Final,io.netty:netty-codec-http2:4.2.4.Final
Step up your Open Source Security Game with Mend here
CVE-2024-7254
Vulnerable Library - protobuf-java-3.25.2.jar
Core Protocol Buffers library. Protocol Buffers are a way of encoding structured data in an
efficient yet extensible format.
Library home page: https://developers.google.com/protocol-buffers/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/protobuf/protobuf-java/3.25.2/protobuf-java-3.25.2.jar
Dependency Hierarchy:
- google-cloud-secretmanager-2.39.0.jar (Root Library)
- ❌ protobuf-java-3.25.2.jar (Vulnerable Library)
Found in HEAD commit: 21c100d3b0fee337e9a99e3a324b449f35be9262
Found in base branch: master
Vulnerability Details
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.
Publish Date: 2024-09-19
URL: CVE-2024-7254
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2024-7254
Release Date: 2024-09-19
Fix Resolution (com.google.protobuf:protobuf-java): 3.25.5
Direct dependency fix Resolution (com.google.cloud:google-cloud-secretmanager): 2.55.0
Step up your Open Source Security Game with Mend here
CVE-2026-45292
Vulnerable Library - opentelemetry-api-1.36.0.jar
OpenTelemetry API
Library home page: https://github.com/open-telemetry/opentelemetry-java
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/opentelemetry/opentelemetry-api/1.36.0/opentelemetry-api-1.36.0.jar
Dependency Hierarchy:
- google-cloud-secretmanager-2.39.0.jar (Root Library)
- ❌ opentelemetry-api-1.36.0.jar (Vulnerable Library)
Found in HEAD commit: 21c100d3b0fee337e9a99e3a324b449f35be9262
Found in base branch: master
Vulnerability Details
opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.
Publish Date: 2026-05-28
URL: CVE-2026-45292
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-rcgg-9c38-7xpx
Release Date: 2026-05-16
Fix Resolution: https://github.com/open-telemetry/opentelemetry-java.git - v1.62.0,io.opentelemetry:opentelemetry-extension-trace-propagators:1.62.0
Step up your Open Source Security Game with Mend here
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/opentelemetry/opentelemetry-api/1.36.0/opentelemetry-api-1.36.0.jar
Found in HEAD commit: 21c100d3b0fee337e9a99e3a324b449f35be9262
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - grpc-netty-shaded-1.62.2.jar
gRPC: Netty Shaded
Library home page: https://github.com/grpc/grpc-java
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/grpc/grpc-netty-shaded/1.62.2/grpc-netty-shaded-1.62.2.jar
Dependency Hierarchy:
Found in HEAD commit: 21c100d3b0fee337e9a99e3a324b449f35be9262
Found in base branch: master
Vulnerability Details
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.
Publish Date: 2025-08-13
URL: CVE-2025-55163
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2025-08-13
Fix Resolution: https://github.com/netty/netty.git - 4.2.4.Final,https://github.com/netty/netty.git - netty-4.1.124.Final,io.netty:netty-codec-http2:4.1.124.Final,io.netty:netty-codec-http2:4.2.4.Final
Step up your Open Source Security Game with Mend here
Vulnerable Library - protobuf-java-3.25.2.jar
Core Protocol Buffers library. Protocol Buffers are a way of encoding structured data in an efficient yet extensible format.
Library home page: https://developers.google.com/protocol-buffers/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/protobuf/protobuf-java/3.25.2/protobuf-java-3.25.2.jar
Dependency Hierarchy:
Found in HEAD commit: 21c100d3b0fee337e9a99e3a324b449f35be9262
Found in base branch: master
Vulnerability Details
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.
Publish Date: 2024-09-19
URL: CVE-2024-7254
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2024-7254
Release Date: 2024-09-19
Fix Resolution (com.google.protobuf:protobuf-java): 3.25.5
Direct dependency fix Resolution (com.google.cloud:google-cloud-secretmanager): 2.55.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - opentelemetry-api-1.36.0.jar
OpenTelemetry API
Library home page: https://github.com/open-telemetry/opentelemetry-java
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/opentelemetry/opentelemetry-api/1.36.0/opentelemetry-api-1.36.0.jar
Dependency Hierarchy:
Found in HEAD commit: 21c100d3b0fee337e9a99e3a324b449f35be9262
Found in base branch: master
Vulnerability Details
opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.
Publish Date: 2026-05-28
URL: CVE-2026-45292
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-rcgg-9c38-7xpx
Release Date: 2026-05-16
Fix Resolution: https://github.com/open-telemetry/opentelemetry-java.git - v1.62.0,io.opentelemetry:opentelemetry-extension-trace-propagators:1.62.0
Step up your Open Source Security Game with Mend here