Product Release Advisory - Java Buildpack 4.86.0 - java-buildpack-online-performance

Product/Component

Tanzu Kubernetes Runtime

7 more products

Notification Id

36646

Last Updated

25 December 2025

Initial Publication Date

25 December 2025

Status

CLOSED

Severity

CRITICAL

CVSS Base Score

9.8

WorkAround

N/A

Affected CVE

See CVE list in advisory

Product Release Advisory - Java Buildpack 4.86.0

	Highest Score CVE from list below advisory details
Severity	Critical
CVSS V4 Vector	Unavailable
CVSS V4 Score	Unavailable (Sev: Unavailable)
CVSS V3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS V3.1 Score	9.8 (Sev: CRITICAL)
CVSS V2 Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS V2 Score	7.5 (Sev: Unavailable)

Note: if cvss scores are "Unavailable" it is most likely due to the vulnerability being GHSA or BDSA without a matching CVE for nvd lookup.

Product Version Release Advisory

Security Fixes: This release has the following security fixes, listed by component.

Component	Vulnerabilities Resolved
java-buildpack-online-performance	CVE-2017-5929 (Critical) CVE-2025-48913 - BDSA-2025-8434 (High) CVE-2025-55752 - BDSA-2025-14737 (High) CVE-2021-42550 (Medium) CVE-2025-53506 - BDSA-2025-6846 (Medium) CVE-2025-48988 - BDSA-2025-5233 (Medium) CVE-2024-12801 - BDSA-2024-9861 (Medium) CVE-2025-49124 - BDSA-2025-5234 (Medium) CVE-2024-12798 - BDSA-2024-9866 (Medium) CVE-2025-49125 - BDSA-2025-5235 (Medium) CVE-2023-6481 - BDSA-2023-3341 (Medium) CVE-2023-6378 - BDSA-2023-3307 (Medium) CVE-2024-24549 - BDSA-2024-0623 (Medium) CVE-2025-46701 - BDSA-2025-4728 (Medium) No known CVE - BDSA-2021-3401 (Medium)

Component

Vulnerabilities Resolved

java-buildpack-online-performance