Support Content Notification - Support Portal

Product Release Advisory - Elastic Application Runtime for VMware Tanzu Platform 6.0.21+LTS-T

Product/Component

Tanzu Kubernetes Runtime

7 more products

Notification Id

36320

Last Updated

05 November 2025

Initial Publication Date

05 November 2025

Status

CLOSED

Severity

CRITICAL

CVSS Base Score

WorkAround

N/A

Affected CVE

See CVE list in advisory

Product Release Advisory - Elastic Application Runtime for VMware Tanzu Platform 6.0.21+LTS-T

Advisory ID	TNZ-2025-0150
Tanzu Issue Date	2025-10-29
Updated on

	Highest Score CVE from list below advisory details
Severity	Critical
CVSS V4 Vector	Unavailable
CVSS V4 Score	Unavailable (Sev: Unavailable)
CVSS V3.1 Vector	Unavailable
CVSS V3.1 Score	Unavailable (Sev: Unavailable)
CVSS V2 Vector	Unavailable
CVSS V2 Score	Unavailable (Sev: Unavailable)

Note: if cvss scores are "Unavailable" is is most likely due to the vulnerability being GHSA or BDSA without a matching CVE for nvd lookup.

Product Version Release Advisory

Product Release Elastic Application Runtime for VMware Tanzu Platform 6.0.21+LTS-T
Product Release Notes: https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/elastic-application-runtime/10-3/eart/concepts-overview.html

Security Fixes This release has the following security fixes, listed by component.

Component	Vulnerabilities Resolved
backup-and-restore-sdk	CVE-2024-45337 - GHSA-v778-237x-gjrc (Critical) CVE-2025-22871 (Critical) CVE-2025-8715 (High) CVE-2025-8714 (High) CVE-2025-4674 (High) CVE-2025-1094 (High) CVE-2025-22869 - GHSA-hcg3-q754-cr77 (High) CVE-2025-22874 (High) CVE-2025-47907 (High) CVE-2025-4673 (Medium) CVE-2025-30722 (Medium) CVE-2025-50083 (Medium) CVE-2025-50082 (Medium) CVE-2025-50078 (Medium) CVE-2025-47906 (Medium) CVE-2025-30688 (Medium) CVE-2025-30687 (Medium) CVE-2025-30682 (Medium) CVE-2025-21577 (Medium) CVE-2025-21575 (Medium) CVE-2025-21574 (Medium) CVE-2025-22872 - GHSA-vvgc-356p-c3xw (Medium) CVE-2025-4207 (Medium) CVE-2025-50085 (Medium) CVE-2025-30695 (Medium) CVE-2025-30693 (Medium) CVE-2025-0913 (Medium) CVE-2022-29526 - GHSA-p782-xgp4-8hr8 (Medium) CVE-2025-53023 (Medium) CVE-2025-50102 (Medium) CVE-2025-50101 (Medium) CVE-2025-50099 (Medium) CVE-2025-50097 (Medium) CVE-2025-50093 (Medium) CVE-2025-50092 (Medium) CVE-2025-50091 (Medium) CVE-2025-50088 (Medium) CVE-2025-50087 (Medium) CVE-2025-50086 (Medium) CVE-2025-50084 (Medium) CVE-2025-50080 (Medium) CVE-2025-50079 (Medium) CVE-2025-50077 (Medium) CVE-2025-30715 (Medium) CVE-2025-30705 (Medium) CVE-2025-30699 (Medium) CVE-2025-30696 (Medium) CVE-2025-30689 (Medium) CVE-2025-30685 (Medium) CVE-2025-30684 (Medium) CVE-2025-30683 (Medium) CVE-2025-21585 (Medium) CVE-2025-21584 (Medium) CVE-2025-21581 (Medium) CVE-2025-21580 (Medium) CVE-2025-21579 (Medium) CVE-2023-52970 (Medium) CVE-2023-52969 (Medium) CVE-2025-22870 - GHSA-qxp5-gwg8-xv66 (Medium) CVE-2025-50096 (Medium) CVE-2025-30704 (Medium) CVE-2025-30721 (Medium) CVE-2025-8713 (Low) CVE-2025-50104 (Low) CVE-2025-50098 (Low) CVE-2025-30703 (Low) CVE-2025-30681 (Low) CVE-2025-50100 (Low)
binary-offline-buildpack	CVE-2025-47910 (Medium)
capi	CVE-2024-45337 - GHSA-v778-237x-gjrc (Critical) CVE-2025-22869 - GHSA-hcg3-q754-cr77 (High) CVE-2025-59830 - GHSA-625h-95r8-8xpm (High) CVE-2025-22872 - GHSA-vvgc-356p-c3xw (Medium) CVE-2022-29526 - GHSA-p782-xgp4-8hr8 (Medium) CVE-2025-22870 - GHSA-qxp5-gwg8-xv66 (Medium)
cf-autoscaling	CVE-2025-55754 - GHSA-vfww-5hm6-hx2j (Critical) CVE-2025-55752 - GHSA-wmwf-9ccg-fff5 (High) CVE-2025-41249 - GHSA-jmp9-x22r-554x (High) CVE-2025-61795 - GHSA-hgrr-935x-pq79 (Low)
cf-cli	CVE-2025-4674 (High) CVE-2025-22874 (High) CVE-2025-47907 (High) CVE-2025-4673 (Medium) CVE-2025-47906 (Medium) CVE-2025-0913 (Medium)
cf-networking	CVE-2025-47910 (Medium)
cflinuxfs4	CVE-2024-45337 - GHSA-v778-237x-gjrc (Critical) CVE-2025-4674 (High) CVE-2025-22869 - GHSA-hcg3-q754-cr77 (High) CVE-2025-47907 (High) CVE-2025-47906 (Medium) CVE-2025-22872 - GHSA-vvgc-356p-c3xw (Medium) CVE-2022-29526 - GHSA-p782-xgp4-8hr8 (Medium) CVE-2025-22870 - GHSA-qxp5-gwg8-xv66 (Medium)
credhub	CVE-2025-41249 - GHSA-jmp9-x22r-554x (High) CVE-2025-41248 - GHSA-8v5q-rhf3-jphm (High) CVE-2025-58057 - GHSA-3p8m-j85q-pgmj (Medium) CVE-2025-53864 - GHSA-xwmg-2g98-w7v9 (Medium) CVE-2025-58056 - GHSA-fghv-69vj-qj49 (Low)
diego	CVE-2024-45337 - GHSA-v778-237x-gjrc (Critical) CVE-2025-4674 (High) CVE-2025-22869 - GHSA-hcg3-q754-cr77 (High) CVE-2025-47907 (High) CVE-2025-47906 (Medium) CVE-2025-22872 - GHSA-vvgc-356p-c3xw (Medium) CVE-2025-49014 (Medium) CVE-2022-29526 - GHSA-p782-xgp4-8hr8 (Medium) CVE-2025-22870 - GHSA-qxp5-gwg8-xv66 (Medium) CVE-2025-54410 - GHSA-4vq8-7jfc-9cvp (Low)
dotnet-core-offline-buildpack	CVE-2025-55315 - GHSA-5rrx-jjjq-q2r5 (Critical) CVE-2025-23083 (High) CVE-2025-27210 (High) CVE-2025-23166 (High) CVE-2025-23167 (Medium) CVE-2025-55248 - GHSA-gwq6-fmvp-qp68 (Medium) CVE-2025-23084 (Medium) CVE-2025-47910 (Medium) CVE-2025-23085 (Medium) CVE-2025-23165 (Low)
garden-runc	CVE-2025-47910 (Medium)
go-offline-buildpack	CVE-2025-47910 (Medium)
java-offline-buildpack	CVE-2024-47554 - GHSA-78wr-2p64-hpwj (High) CVE-2024-47535 - GHSA-xq3w-v528-46rv (Medium)
log-cache	CVE-2024-45337 - GHSA-v778-237x-gjrc (Critical) CVE-2025-4674 (High) CVE-2025-22869 - GHSA-hcg3-q754-cr77 (High) CVE-2025-47907 (High) CVE-2025-4673 (Medium) CVE-2025-47906 (Medium) CVE-2025-22872 - GHSA-vvgc-356p-c3xw (Medium) No known CVE - GHSA-vrw8-fxc6-2r93 (Medium) CVE-2025-0913 (Medium) CVE-2022-29526 - GHSA-p782-xgp4-8hr8 (Medium) CVE-2025-22870 - GHSA-qxp5-gwg8-xv66 (Medium)
loggregator	CVE-2024-45337 - GHSA-v778-237x-gjrc (Critical) CVE-2025-4674 (High) CVE-2025-22869 - GHSA-hcg3-q754-cr77 (High) CVE-2025-47907 (High) CVE-2025-4673 (Medium) CVE-2025-47906 (Medium) CVE-2025-22872 - GHSA-vvgc-356p-c3xw (Medium) CVE-2025-0913 (Medium) CVE-2022-29526 - GHSA-p782-xgp4-8hr8 (Medium) CVE-2025-22870 - GHSA-qxp5-gwg8-xv66 (Medium)
loggregator-agent	CVE-2024-45337 - GHSA-v778-237x-gjrc (Critical) CVE-2025-4674 (High) CVE-2025-22869 - GHSA-hcg3-q754-cr77 (High) CVE-2025-47907 (High) CVE-2025-4673 (Medium) CVE-2025-47906 (Medium) CVE-2025-22872 - GHSA-vvgc-356p-c3xw (Medium) CVE-2025-0913 (Medium) CVE-2022-29526 - GHSA-p782-xgp4-8hr8 (Medium) CVE-2025-22870 - GHSA-qxp5-gwg8-xv66 (Medium)
metric-registrar	CVE-2024-45337 - GHSA-v778-237x-gjrc (Critical) CVE-2025-4674 (High) CVE-2025-22869 - GHSA-hcg3-q754-cr77 (High) CVE-2025-47907 (High) CVE-2025-4673 (Medium) CVE-2025-47906 (Medium) CVE-2025-22872 - GHSA-vvgc-356p-c3xw (Medium) CVE-2025-0913 (Medium) CVE-2022-29526 - GHSA-p782-xgp4-8hr8 (Medium) CVE-2025-22870 - GHSA-qxp5-gwg8-xv66 (Medium)
mysql-monitoring	CVE-2025-47910 (Medium)
nats-monitor	CVE-2025-47910 (Medium)
nfs-volume	CVE-2025-9230 (High) CVE-2025-9231 (Medium) CVE-2025-9232 (Medium) CVE-2025-47910 (Medium)
nginx-offline-buildpack	CVE-2025-47910 (Medium)
notifications-ui	CVE-2025-47910 (Medium)
push-apps-manager-release	CVE-2024-45337 - GHSA-v778-237x-gjrc (Critical) CVE-2025-22871 (Critical) CVE-2025-4674 (High) CVE-2025-22869 - GHSA-hcg3-q754-cr77 (High) CVE-2025-58754 - GHSA-4hjh-wcwx-xvwj (High) CVE-2025-22874 (High) CVE-2025-47907 (High) CVE-2025-4673 (Medium) CVE-2025-47906 (Medium) CVE-2025-27789 - GHSA-968p-4wvh-cqc8 (Medium) CVE-2024-45341 (Medium) CVE-2024-45336 (Medium) CVE-2025-22872 - GHSA-vvgc-356p-c3xw (Medium) CVE-2025-0913 (Medium) CVE-2025-22870 - GHSA-qxp5-gwg8-xv66 (Medium) CVE-2025-22866 (Medium)
push-usage-service-release	CVE-2025-24293 - GHSA-r4mg-4433-c7g3 (Critical) CVE-2025-61772 - GHSA-wpv5-97wm-hp9c (High) CVE-2025-61771 - GHSA-w9pc-fmgc-vxvw (High) CVE-2025-61770 - GHSA-p543-xpfm-54cp (High) CVE-2025-61919 - GHSA-6xw4-3v39-52mm (High) CVE-2025-55193 - GHSA-76r7-hhxj-r776 (Medium) CVE-2025-61780 - GHSA-r657-rxjc-j557 (Medium) CVE-2024-21510 - GHSA-hxx2-7vcw-mqr3 (Medium) CVE-2025-61921 - GHSA-mr3q-g2mv-mr4q (Low) CVE-2025-58767 - GHSA-c2f4-jgmc-q2r5 (Low)
pxc	CVE-2025-50083 (Medium) CVE-2025-50082 (Medium) CVE-2025-50078 (Medium) CVE-2025-50085 (Medium) CVE-2025-47910 (Medium) CVE-2025-53023 (Medium) CVE-2025-50102 (Medium) CVE-2025-50101 (Medium) CVE-2025-50099 (Medium) CVE-2025-50097 (Medium) CVE-2025-50094 (Medium) CVE-2025-50093 (Medium) CVE-2025-50092 (Medium) CVE-2025-50091 (Medium) CVE-2025-50087 (Medium) CVE-2025-50086 (Medium) CVE-2025-50084 (Medium) CVE-2025-50080 (Medium) CVE-2025-50079 (Medium) CVE-2025-50077 (Medium) CVE-2025-50096 (Medium) CVE-2025-50104 (Low) CVE-2025-50098 (Low) CVE-2025-50100 (Low)
python-offline-buildpack	CVE-2024-5642 (Medium) CVE-2025-47910 (Medium)
r-offline-buildpack	CVE-2025-47910 (Medium)
routing	CVE-2024-45337 - GHSA-v778-237x-gjrc (Critical) CVE-2025-4674 (High) CVE-2025-22869 - GHSA-hcg3-q754-cr77 (High) CVE-2025-22874 (High) CVE-2025-47907 (High) CVE-2025-4673 (Medium) CVE-2025-47906 (Medium) CVE-2025-22872 - GHSA-vvgc-356p-c3xw (Medium) CVE-2025-0913 (Medium) CVE-2022-29526 - GHSA-p782-xgp4-8hr8 (Medium) CVE-2025-22870 - GHSA-qxp5-gwg8-xv66 (Medium)
ruby-offline-buildpack	CVE-2020-2805 (High) CVE-2020-2803 (High) CVE-2020-14664 (High) CVE-2020-14583 (High) CVE-2025-23083 (High) CVE-2025-27210 (High) CVE-2025-23166 (High) CVE-2022-21476 (High) CVE-2021-35560 (High) CVE-2021-2388 (High) CVE-2025-21587 (High) CVE-2024-21147 (High) CVE-2024-20952 (High) CVE-2024-20918 (High) CVE-2023-21930 (High) CVE-2020-14593 (High) CVE-2021-35567 (Medium) CVE-2025-25186 - GHSA-7fc5-f82f-cx69 (Medium) CVE-2025-23167 (Medium) CVE-2025-46551 - GHSA-72qj-48g4-5xgx (Medium) CVE-2025-8916 - GHSA-4cx2-fc23-5wg6 (Medium) CVE-2025-30761 (Medium) CVE-2024-20926 (Medium) CVE-2024-20921 (Medium) CVE-2024-20919 (Medium) CVE-2023-21967 (Medium) CVE-2023-21954 (Medium) CVE-2022-21541 (Medium) CVE-2021-35550 (Medium) CVE-2021-2161 (Medium) CVE-2025-30698 (Medium) CVE-2025-23084 (Medium) CVE-2025-47910 (Medium) CVE-2025-23085 (Medium) CVE-2023-22081 (Medium) CVE-2023-22067 (Medium) CVE-2023-21939 (Medium) CVE-2023-21830 (Medium) CVE-2022-21628 (Medium) CVE-2022-21626 (Medium) CVE-2022-21540 (Medium) CVE-2022-21434 (Medium) CVE-2022-21426 (Medium) CVE-2022-21365 (Medium) CVE-2022-21360 (Medium) CVE-2022-21349 (Medium) CVE-2022-21341 (Medium) CVE-2022-21340 (Medium) CVE-2022-21305 (Medium) CVE-2022-21299 (Medium) CVE-2022-21296 (Medium) CVE-2022-21294 (Medium) CVE-2022-21293 (Medium) CVE-2022-21291 (Medium) CVE-2022-21282 (Medium) CVE-2022-21271 (Medium) CVE-2021-35586 (Medium) CVE-2021-35578 (Medium) CVE-2021-35565 (Medium) CVE-2021-35564 (Medium) CVE-2021-35561 (Medium) CVE-2021-35559 (Medium) CVE-2021-35556 (Medium) CVE-2021-2163 (Medium) CVE-2020-2830 (Medium) CVE-2020-2781 (Medium) CVE-2020-14621 (Medium) CVE-2025-21502 (Medium) CVE-2024-21235 (Medium) CVE-2024-21145 (Medium) CVE-2024-21140 (Medium) CVE-2020-2800 (Medium) CVE-2020-14556 (Medium) CVE-2024-20945 (Medium) CVE-2021-2369 (Medium) CVE-2020-14792 (Medium) CVE-2025-23165 (Low) CVE-2024-21217 (Low) CVE-2024-21210 (Low) CVE-2024-21208 (Low) CVE-2024-21144 (Low) CVE-2024-21138 (Low) CVE-2024-21131 (Low) CVE-2024-21094 (Low) CVE-2024-21085 (Low) CVE-2024-21068 (Low) CVE-2024-21011 (Low) CVE-2023-22049 (Low) CVE-2023-22045 (Low) CVE-2023-21968 (Low) CVE-2023-21938 (Low) CVE-2023-21937 (Low) CVE-2023-21843 (Low) CVE-2022-21624 (Low) CVE-2022-21619 (Low) CVE-2022-21248 (Low) CVE-2021-35603 (Low) CVE-2020-2773 (Low) CVE-2020-2757 (Low) CVE-2020-2756 (Low) CVE-2020-2755 (Low) CVE-2020-2754 (Low) CVE-2020-14797 (Low) CVE-2020-14782 (Low) CVE-2020-14781 (Low) CVE-2020-14779 (Low) CVE-2020-14581 (Low) CVE-2020-14579 (Low) CVE-2020-14578 (Low) CVE-2020-14577 (Low) CVE-2024-58266 - GHSA-r7qv-8r2h-pg27 (Low) CVE-2025-27221 - GHSA-22h5-pq3x-2gf2 (Low) CVE-2021-35588 (Low) CVE-2021-2341 (Low) CVE-2020-14798 (Low) CVE-2020-14796 (Low)
silk	CVE-2025-47910 (Medium)
smb-volume	CVE-2025-47910 (Medium)
staticfile-offline-buildpack	CVE-2025-47910 (Medium)
statsd-injector	CVE-2024-45337 - GHSA-v778-237x-gjrc (Critical) CVE-2025-4674 (High) CVE-2025-22869 - GHSA-hcg3-q754-cr77 (High) CVE-2025-47907 (High) CVE-2025-4673 (Medium) CVE-2025-47906 (Medium) CVE-2025-22872 - GHSA-vvgc-356p-c3xw (Medium) CVE-2025-0913 (Medium) CVE-2022-29526 - GHSA-p782-xgp4-8hr8 (Medium) CVE-2025-22870 - GHSA-qxp5-gwg8-xv66 (Medium)
syslog	CVE-2024-45337 - GHSA-v778-237x-gjrc (Critical) CVE-2025-4674 (High) CVE-2025-22869 - GHSA-hcg3-q754-cr77 (High) CVE-2025-47907 (High) CVE-2025-4673 (Medium) CVE-2025-47906 (Medium) CVE-2025-22872 - GHSA-vvgc-356p-c3xw (Medium) CVE-2025-0913 (Medium) CVE-2022-29526 - GHSA-p782-xgp4-8hr8 (Medium) CVE-2025-22870 - GHSA-qxp5-gwg8-xv66 (Medium)
system-metrics-scraper	CVE-2024-45337 - GHSA-v778-237x-gjrc (Critical) CVE-2025-4674 (High) CVE-2025-22869 - GHSA-hcg3-q754-cr77 (High) CVE-2025-47907 (High) CVE-2025-4673 (Medium) CVE-2025-47906 (Medium) CVE-2025-22872 - GHSA-vvgc-356p-c3xw (Medium) CVE-2025-0913 (Medium) CVE-2022-29526 - GHSA-p782-xgp4-8hr8 (Medium) CVE-2025-22870 - GHSA-qxp5-gwg8-xv66 (Medium)
uaa	CVE-2016-1000027 - GHSA-4wrc-f8pq-fpqp (Critical) CVE-2025-41249 - GHSA-jmp9-x22r-554x (High) CVE-2025-48989 - GHSA-gqp3-2cvr-x8m3 (High) CVE-2024-38819 - GHSA-g5vr-rgqm-vf78 (High) CVE-2024-38816 - GHSA-cx7f-g6mp-7hqm (High) CVE-2025-53066 (High) CVE-2025-22228 - GHSA-mg83-c7gq-rv5c (High) CVE-2025-22235 - GHSA-rc42-6c7j-7h5r (High) CVE-2025-48924 - GHSA-j288-q9x7-2f5v (Medium) CVE-2025-8885 - GHSA-67mf-3cr5-8w23 (Medium) CVE-2025-8916 - GHSA-4cx2-fc23-5wg6 (Medium) CVE-2025-41242 - GHSA-r936-gwx5-v52f (Medium) CVE-2025-53057 (Medium) CVE-2024-38828 - GHSA-w3c8-7r8f-9jp8 (Medium) CVE-2024-38820 - GHSA-4gc7-5j7h-4qph (Medium) CVE-2025-61748 (Low) CVE-2025-22233 - GHSA-4wp7-92pw-q264 (Low)