Security Advisories (CVEs)¶
This page is a single reference for checking whether a security advisory (CVE) reported by a vulnerability scanner against third-party software bundled with Lime CRM on-premise actually applies to your installation, and which release fixed it. Scanners frequently flag a component by version number alone, without accounting for the fix a later Lime CRM release already shipped, a feature the component never enables in a Lime deployment, or a mismatch between the reported product and the one Lime actually ships. The tables below record the verified verdict for each advisory.
Coverage starts at on-premise release 2024.1 (Etna) and moves forward. Anything reported against a release older than 2024.1 is resolved by upgrading to a currently supported release. This page is informational only; it is not a channel for reporting vulnerabilities.
How to read this page¶
Each component section lists the advisories a scanner is likely to raise against the versions Lime CRM ships. The Status column takes one of four values:
- Fixed — a later on-premise release or patch bundles a fixed version of the component. The release and component version that first carried the fix are given in the Fixed in column.
- Affected — the shipped version is inside the advisory's affected range and no on-premise
release carries a fix yet; the Fixed in column shows
—until one ships. - Not exploitable — the shipped version is inside the advisory's affected range (so a scanner flag is legitimate), but the feature or plugin the advisory requires is never enabled in a Lime deployment. Where a component has many of these, they are grouped in a compact table by required feature instead of one row each.
- Not affected — the vulnerable code or feature is not present, not compiled in, or the advisory
belongs to a version range or product Lime never shipped. The reason is given in the
Description column, and the Affected versions, Affected releases, and Fixed in
columns show
—.
Severity follows one convention throughout: the vendor severity is shown first, and where the NVD
score differs by a class (for example vendor Medium versus NVD High) the NVD score is added in
parentheses. Scores that exist only as CVSS v4.0 are labelled CVSS v4.0.
Releases and Lime CRM versions¶
Use this table to translate the on-premise release a customer reports into the Lime CRM version, and to place a reported component version on the release timeline.
| On-premise release | Code name | Lime CRM version | Released |
|---|---|---|---|
| 2026.2 | Bodensee | 3.47.10 | 2026-08-11 |
| 2026.1 Patch 1 | Arresø | 2.1189.9 | 2026-06-10 |
| 2026.1 | Arresø | 2.1189.6 | 2026-03-31 |
| 2025.3 Patch 3 | Mjøsa | 2.1145.13 | 2026-02-12 |
| 2025.3 Patch 2 | Mjøsa | 2.1145.10 | 2025-12-01 |
| 2025.3 Patch 1 | Mjøsa | 2.1145.8 | 2025-11-20 |
| 2025.3 | Mjøsa | 2.1145.8 | 2025-11-14 |
| 2025.2 Patch 3 | Saimaa | 2.1066.12 | 2026-02-24 |
| 2025.2 Patch 2 | Saimaa | 2.1066.12 | 2025-09-19 |
| 2025.2 Patch 1 | Saimaa | 2.1066.7 | 2025-08-08 |
| 2025.2 | Saimaa | 2.1066.7 | 2025-06-26 |
| 2025.1 Patch 3 | Vänern | 2.1017.9 | 2026-02-24 |
| 2025.1 Patch 2 | Vänern | 2.1017.9 | 2025-05-14 |
| 2025.1 Patch 1 | Vänern | 2.1017.7 | 2025-04-02 |
| 2025.1 | Vänern | 2.1017.6 | 2025-03-31 |
| 2024.3 Patch 2 | Halti | 2.936.13 | 2025-02-13 |
| 2024.3 Patch 1 | Halti | 2.936.10 | 2024-12-18 |
| 2024.3 | Halti | 2.936.3 | 2024-11-08 |
| 2024.2 Patch 3 | Galdhøpiggen | 2.862.14 | 2024-11-18 |
| 2024.2 Patch 2 | Galdhøpiggen | 2.862.13 | 2024-10-28 |
| 2024.2 Patch 1 | Galdhøpiggen | 2.862.12 | 2024-09-18 |
| 2024.2 | Galdhøpiggen | 2.862.7 | 2024-06-24 |
| 2024.1 Patch 4 | Etna | 2.761.22 | 2024-07-01 |
| 2024.1 Patch 3 | Etna | 2.761.22 | 2024-06-05 |
| 2024.1 Patch 2 | Etna | 2.761.19 | 2024-05-17 |
| 2024.1 Patch 1 | Etna | 2.761.16 | 2024-05-07 |
| 2024.1 | Etna | 2.761.14 | 2024-03-21 |
Patches that did not change a component version inherit the component versions of their base release.
Python¶
From 2026.1, Lime CRM ships its own build of Python — Python 3.11.15 — documented on the Python build page. Releases before 2026.1 required a customer-installed Python 3.11. A CVE reported against stock CPython 3.11 should be evaluated against that page, since the Lime build controls which patch level is present. No Python-specific advisory rows have been produced for this page.
Elasticsearch¶
Elasticsearch is the full-text search service. Several advisories below describe denial-of-service crashes that require an authenticated request to a specific API; the feature preconditions are noted in each description.
| CVE | Severity | Affected versions | Affected releases | Status | Fixed in | Description |
|---|---|---|---|---|---|---|
| CVE-2026-63263 | Medium 6.5 | 8.18.1 – 8.19.16 | 2025.2 – 2026.1 Patch 1 | Fixed | 2026.2 (Elasticsearch 8.19.19) | DoS via a crafted ES|QL query causing exponential CPU consumption that persists after the query completes, exhausting query workers until the node is restarted; requires authenticated ES|QL query access. |
| CVE-2026-63144 | Medium 6.5 | 8.19.5 – 8.19.16 | 2025.3 – 2026.1 Patch 1 | Fixed | 2026.2 (Elasticsearch 8.19.19) | DoS via a crafted search request causing uncontrolled recursion that terminates the node; requires authenticated read access to an index. Only the 8.19 line is affected. |
| CVE-2026-63140 | Medium 6.5 | 8.18.1 – 8.19.16 | 2025.2 – 2026.1 Patch 1 | Fixed | 2026.2 (Elasticsearch 8.19.19) | DoS via a crafted search request triggering a reachable assertion that terminates the node; requires authenticated read access to an index. |
| CVE-2026-56149 | Medium 4.9 | 8.18.1 – 8.19.16 | 2025.2 – 2026.1 Patch 1 | Fixed | 2026.2 (Elasticsearch 8.19.19) | DoS via a crafted machine learning request causing memory exhaustion; requires trained-model management privileges. |
| CVE-2026-56148 | Medium 6.5 | 8.18.1 – 8.19.16 | 2025.2 – 2026.1 Patch 1 | Fixed | 2026.2 (Elasticsearch 8.19.19) | DoS via a crafted query causing uncontrolled recursion; affects all configurations, no admin privileges required. |
| CVE-2026-49090 | Medium 6.5 | 7.17.18 | 2024.1 – 2024.2 | Fixed | 2024.3 (Elasticsearch 7.17.24) | DoS via a crafted bulk request causing sustained high CPU; requires authenticated access to the bulk API. Advisory published retroactively; fix shipped since 7.17.24. |
| CVE-2025-68390 | Medium 4.9 | 7.17.18 – 8.19.5 | 2024.1 – 2025.3 | Fixed | 2026.1 (Elasticsearch 8.19.13) | DoS via snapshot restore memory exhaustion; requires snapshot restore privileges. |
| CVE-2025-68384 | Medium 6.5 | 7.17.18 – 8.19.5 | 2024.1 – 2025.3 | Fixed | 2026.1 (Elasticsearch 8.19.13) | DoS via oversized user settings from a low-privileged authenticated user (persistent OOM crash). |
| CVE-2025-66566 | High 8.2 (CVSS v4.0) | 7.17.18 – 8.19.5 | 2024.1 – 2025.3 | Fixed | 2026.1 (Elasticsearch 8.19.13) | Information disclosure via the bundled LZ4 Java library on the transport layer (port 9300). Workaround: transport.compress: false. |
| CVE-2025-54988 | High 8.8 (NVD 8.4; CISA-ADP 9.8 Critical) | 8.18.1 | 2025.2 | Fixed | 2025.3 (Elasticsearch 8.19.5) | XXE in the Apache Tika PDF parser reachable via the ingest attachment processor. 7.17.x is mitigated by the Java Security Manager. |
| CVE-2025-37731 | Medium 6.8 (NVD 7.4 High) | 7.17.18 – 8.19.5 | 2024.1 – 2025.3 | Fixed | 2026.1 (Elasticsearch 8.19.13) | PKI realm authentication bypass / user impersonation via crafted client certificates; only affects deployments using the PKI realm. |
| CVE-2025-37727 | Medium 5.3 | 7.17.18 – 8.18.1 | 2024.1 – 2025.2 | Fixed | 2025.3 (Elasticsearch 8.19.5) | Reindex API request bodies (which can contain credentials) written to the audit log; only when audit logging with emit_request_body: true is enabled (default off). |
| CVE-2025-32434 | High 7.2 (NVD 9.8 Critical — PyTorch) | 8.18.1 – 8.19.5 | 2025.2 – 2025.3 | Fixed | 2026.1 (Elasticsearch 8.19.13) | PyTorch deserialization RCE reachable via ML model loading; requires the high-privileged machine_learning_admin role and ML nodes. |
| CVE-2024-52981 | Medium 4.9 (NVD 7.5 High) | 7.17.18 | 2024.1 – 2024.2 | Fixed | 2024.3 (Elasticsearch 7.17.24) | StackOverflow node crash (DoS) via a Well-Known-Text string with nested GeometryCollection objects. |
| CVE-2024-52980 | Medium 6.5 | 7.17.18 – 7.17.24 | 2024.1 – 2025.1 | Fixed | 2025.2 (Elasticsearch 8.18.1) | Grok PatternBank recursion crashes the node (DoS); requires the read_pipeline cluster privilege. |
| CVE-2024-52979 | Medium 6.5 (NVD 7.5 High) | 7.17.18 – 7.17.24 | 2024.1 – 2025.1 | Fixed | 2025.2 (Elasticsearch 8.18.1) | Crafted search templates with Mustache functions crash the node (DoS). |
| CVE-2024-43709 | Medium 6.5 (NVD 7.5 High) | 7.17.18 | 2024.1 – 2024.2 | Fixed | 2024.3 (Elasticsearch 7.17.24) | Crafted query using an SQL function triggers OutOfMemoryError and node crash (DoS). |
| CVE-2024-23450 | Medium 4.9 (NVD 7.5 High) | 7.17.18 | 2024.1 – 2024.2 | Fixed | 2024.3 (Elasticsearch 7.17.24) | Deeply nested ingest pipeline crashes the node (DoS). |
| CVE-2024-23444 | Medium 4.9 (NVD 7.5 High) | 7.17.18 | 2024.1 – 2024.2 | Fixed | 2024.3 (Elasticsearch 7.17.24) | elasticsearch-certutil csr stores the generated private key on disk unencrypted even with --pass (local CLI tooling issue). |
Commonly misattributed to Elasticsearch but belonging to Kibana (a separate product Lime does not ship): CVE-2024-37287, CVE-2024-37281, CVE-2025-2135, and CVE-2025-25012. Their version ranges overlap the shipped Elasticsearch version numbers (7.17.x / 8.18.x), so stack-banner scanners misattribute them.
Note
CVEs in the JDK bundled inside the Elasticsearch archive are covered in the Java section. Upgrading Elasticsearch also refreshes the bundled JDK.
EmailEngine¶
EmailEngine powers the Email Integration (optional 2024.3–2025.3, opt-out from 2026.1). No CVE has ever been assigned to EmailEngine itself. The rows below are CVEs in its bundled Handlebars dependency (≤ 4.7.8), all resolved by the Handlebars 4.7.9 uplift that shipped when EmailEngine was bumped to 2.67.1. In EmailEngine, templates are administrator-configured, so the practical exposure of the template-injection issues is limited.
| CVE | Severity | Affected versions | Affected releases | Status | Fixed in | Description |
|---|---|---|---|---|---|---|
| CVE-2026-33941 | High 8.2 | 2.50.7 – 2.58.1 | 2025.1 – 2026.1 | Fixed | 2026.1 Patch 1 (EmailEngine 2.67.1) | JS injection in the Handlebars CLI precompiler; the CLI is not exposed by EmailEngine at runtime. |
| CVE-2026-33940 | High 8.1 | 2.50.7 – 2.58.1 | 2025.1 – 2026.1 | Fixed | 2026.1 Patch 1 (EmailEngine 2.67.1) | JS injection via AST type confusion when an object is passed as a dynamic partial. |
| CVE-2026-33939 | High 7.5 | 2.50.7 – 2.58.1 | 2025.1 – 2026.1 | Fixed | 2026.1 Patch 1 (EmailEngine 2.67.1) | DoS (process crash) compiling a template with unregistered decorator syntax such as {{*n}}. |
| CVE-2026-33938 | High 8.1 | 2.50.7 – 2.58.1 | 2025.1 – 2026.1 | Fixed | 2026.1 Patch 1 (EmailEngine 2.67.1) | JS injection via AST type confusion by tampering @partial-block through context-mutating helpers. |
| CVE-2026-33937 | Critical 9.8 | 2.50.7 – 2.58.1 | 2025.1 – 2026.1 | Fixed | 2026.1 Patch 1 (EmailEngine 2.67.1) | JS injection via AST type confusion emitting an unsanitized NumberLiteral from Handlebars.compile(). |
| CVE-2026-33916 | Moderate 4.7 | 2.50.7 – 2.58.1 | 2025.1 – 2026.1 | Fixed | 2026.1 Patch 1 (EmailEngine 2.67.1) | Prototype pollution leading to XSS through partial template injection (the "prototype-pollution vulnerability" named in Lime's 2026.2 release notes). Requires a separate prototype-pollution primitive. |
| GHSA-7rx3-28cr-v5wh (no CVE) | Moderate 4.8 | 2.50.7 – 2.58.1 | 2025.1 – 2026.1 | Fixed | 2026.1 Patch 1 (EmailEngine 2.67.1) | Missing __lookupSetter__ entry in the prototype-method blocklist when allowProtoMethodsByDefault: true. |
| GHSA-442j-39wm-28r2 (no CVE) | Low 3.7 | 2.50.7 – 2.58.1 | 2025.1 – 2026.1 | Fixed | 2026.1 Patch 1 (EmailEngine 2.67.1) | TOCTOU property-access validation bypass in container.lookup() with the compat compile option enabled. |
Erlang OTP¶
Erlang/OTP is the runtime for RabbitMQ. RabbitMQ does not start the OTP ssh, inets (httpd/tftp),
or ftp applications and does not extract untrusted archives, so many of the advisories below require
a feature that is not reachable in a Lime deployment; the caveat is noted per row. The status remains
Fixed because upgrading resolves the advisory regardless of reachability.
| CVE | Severity | Affected versions | Affected releases | Status | Fixed in | Description |
|---|---|---|---|---|---|---|
| CVE-2026-42790 | High 8.1 | 26.2.2 – 26.2.5.18 | 2024.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Erlang OTP 26.2.5.21) | TLS hostname verification falls back to Subject CommonName when SAN is absent, bypassing domain validation. Only if TLS certificate verification is configured. |
| CVE-2026-42789 | High 7.0 (CVSS v4.0; NVD 4.8 Medium) | 26.2.2 – 26.2.5.18 | 2024.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Erlang OTP 26.2.5.21) | public_key accepts a non-CA certificate as an intermediate issuer (chain forgery). Only if TLS certificate verification is configured. |
| CVE-2026-32147 | Medium 4.3 | 26.2.2 – 26.2.5.18 | 2024.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Erlang OTP 26.2.5.21) | SFTP chroot path traversal lets authenticated users modify attributes outside the root. SSH server not started by RabbitMQ. |
| CVE-2026-28810 | Medium 6.3 (CVSS v4.0; NVD 3.7 Low) | 26.2.2 – 26.2.5.18 | 2024.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Erlang OTP 26.2.5.21) | Built-in DNS resolver uses predictable transaction IDs, enabling cache poisoning. Only used when explicitly configured; Windows default resolution uses the OS. |
| CVE-2026-28808 | High 8.3 (CVSS v4.0; NVD 9.8 Critical) | 26.2.2 – 26.2.5.18 | 2024.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Erlang OTP 26.2.5.21) | inets httpd script_alias CGI mappings bypass directory-based access controls (auth bypass). inets httpd not started by RabbitMQ. |
| CVE-2026-23943 | Medium 5.3 (GHSA v4.0 6.9) | 26.2.2 – 26.2.5.17 | 2024.1 – 2025.3 Patch 3 | Fixed | 2026.1 (Erlang OTP 26.2.5.18) | Pre-auth SSH DoS via unbounded zlib inflate of highly compressed packets. SSH server not started by RabbitMQ. |
| CVE-2026-23942 | Medium 5.4 | 26.2.2 – 26.2.5.17 | 2024.1 – 2025.3 Patch 3 | Fixed | 2026.1 (Erlang OTP 26.2.5.18) | SFTP root escape via prefix-string matching. SSH server not started by RabbitMQ. |
| CVE-2026-23941 | High 7.0 (CVSS v4.0; NVD 9.4 Critical) | 26.2.2 – 26.2.5.17 | 2024.1 – 2025.3 Patch 3 | Fixed | 2026.1 (Erlang OTP 26.2.5.18) | inets httpd request smuggling via first-wins parsing of duplicate Content-Length headers. inets httpd not started by RabbitMQ (management uses cowboy). |
| CVE-2026-21620 | Low 2.3 (CVSS v4.0) | 26.2.2 – 26.2.5.15 | 2024.1 – 2025.3 | Fixed | 2025.3 Patch 3 (Erlang OTP 26.2.5.17) | TFTP server path traversal when the undocumented root_dir option is used. tftp application not started by RabbitMQ. |
| CVE-2025-48041 | High 7.1 (CVSS v4.0) | 26.2.2 – 26.2.5.13 | 2024.1 – 2025.2 | Fixed | 2025.3 (Erlang OTP 26.2.5.15) | SSH_FXP_OPENDIR creates VM file handles without OS handles, allowing resource exhaustion. SSH server not started by RabbitMQ. |
| CVE-2025-48040 | Medium 6.9 (CVSS v4.0) | 26.2.2 – 26.2.5.13 | 2024.1 – 2025.2 | Fixed | 2025.3 (Erlang OTP 26.2.5.15) | Unvalidated SSH KEX messages from unauthenticated peers trigger excessive CPU/memory use. SSH server not started by RabbitMQ. |
| CVE-2025-48039 | Medium 5.3 (CVSS v4.0) | 26.2.2 – 26.2.5.13 | 2024.1 – 2025.2 | Fixed | 2025.3 (Erlang OTP 26.2.5.15) | Unverified SFTP paths from authenticated users cause excessive CPU/memory use. SSH server not started by RabbitMQ. |
| CVE-2025-48038 | Medium 5.3 (CVSS v4.0) | 26.2.2 – 26.2.5.13 | 2024.1 – 2025.2 | Fixed | 2025.3 (Erlang OTP 26.2.5.15) | Unverified SFTP file handles from authenticated users cause excessive CPU/memory use. SSH server not started by RabbitMQ. |
| CVE-2025-46712 | Low 3.7 | 26.2.2 – 26.2.5.4 | 2024.1 – 2025.1 | Fixed | 2025.2 (Erlang OTP 26.2.5.13) | SSH strict-KEX (Terrapin) hardening: optional messages permitted during the initial handshake. SSH not used by RabbitMQ. |
| CVE-2025-32433 | Critical 10.0 | 26.2.2 – 26.2.5.4 | 2024.1 – 2025.1 | Fixed | 2025.2 (Erlang OTP 26.2.5.13) | Unauthenticated remote code execution in the Erlang/OTP SSH server. RabbitMQ never starts the Erlang SSH daemon, so the vulnerable code is not reachable in Lime deployments; upgrading resolves it regardless. Listed in CISA KEV. |
| CVE-2025-30211 | High 7.5 | 26.2.2 – 26.2.5.4 | 2024.1 – 2025.1 | Fixed | 2025.2 (Erlang OTP 26.2.5.13) | Malformed SSH KEX-init message triggers excessive memory allocation (pre-auth DoS). SSH server not started by RabbitMQ. |
| CVE-2025-26618 | High 7.0 (CVSS v4.0) | 26.2.2 – 26.2.5.4 | 2024.1 – 2025.1 | Fixed | 2025.2 (Erlang OTP 26.2.5.13) | SFTP packet size not validated; an authenticated user can force large memory allocation. SSH server not started by RabbitMQ. |
| CVE-2025-4748 | Medium 4.8 (CVSS v4.0) | 26.2.2 – 26.2.5.4 | 2024.1 – 2025.1 | Fixed | 2025.2 (Erlang OTP 26.2.5.13) | zip extraction honors absolute paths in archive entries (path escape). Requires application code extracting untrusted zips; RabbitMQ does not. |
| CVE-2024-53846 | Medium 5.5 | 26.2.2 – 26.2.5.4 | 2024.1 – 2025.1 | Fixed | 2025.2 (Erlang OTP 26.2.5.13) | ssl verifies a peer even when an incorrect extended key usage is presented. Only if TLS listeners/clients are configured in RabbitMQ. |
| CVE-2016-1000107 | Medium 6.1 | 26.2.2 – 26.2.5.13 | 2024.1 – 2025.2 | Fixed | 2025.3 (Erlang OTP 26.2.5.15) | "httpoxy": inets httpd CGI places the client Proxy header into HTTP_PROXY. inets httpd not started by RabbitMQ. |
Java¶
Two bundled products run on Java. Neither uses a Java runtime installed on the server, so the Java patch level in a deployment is determined entirely by the product version:
- Elasticsearch ships as the stock Elastic archive, which bundles an Oracle OpenJDK build in its
jdk/directory. The installer always starts the service against this bundled JDK and ignores any other Java on the machine, so upgrading Elasticsearch is the only thing that changes its JDK. - Lime BI installs its own JDK (Eclipse Temurin, previously AdoptOpenJDK) alongside Metabase; see Java in Lime BI.
The JDK inside Elasticsearch identifies itself as IMPLEMENTOR "Oracle Corporation" — these are
Oracle's open-source OpenJDK builds, which scanners commonly report as "Oracle Java". Per patch level
they carry the same code as Oracle Java SE, so CVE applicability follows the Oracle Critical Patch
Update (CPU) risk matrices, which are the reference used below.
Java in Elasticsearch¶
| On-premise releases | Elasticsearch | Bundled JDK | JDK patch level |
|---|---|---|---|
| 2024.1 – 2024.2 | 7.17.18 | 21.0.2+13 | January 2024 CPU |
| 2024.3 – 2025.1 | 7.17.24 | 22.0.1+8 | April 2024 CPU |
| 2025.2 | 8.18.1 | 24+36 (24 GA) | March 2025 GA |
| 2025.3 | 8.19.5 | 25+36 (25 GA) | September 2025 GA |
| 2026.1 | 8.19.13 | 25.0.2+10 | January 2026 CPU |
| 2026.1 Patch 1 | 8.19.16 | 26.0.1+8 | April 2026 CPU |
| 2026.2 | 8.19.19 | 26.0.1+8 | April 2026 CPU |
Two things to keep in mind when reading the rows below:
- JDK families 22 and 24 left support before the next shipped uplift (22 after 22.0.2, 24 after 24.0.2), so Oracle advisories stop listing them; the ranges below treat those shipped versions as affected by every later CVE that spans the neighbouring families. In particular, the JDK 22.0.1 in Elasticsearch 7.17.24 never received the July 2024 CPU fixes.
- Oracle scores many Hotspot/compiler items for deployments that load and run untrusted code. Elasticsearch runs only trusted code, so the operationally relevant items are the ones that process attacker-supplied network data or documents (Networking, JSSE, JAXP, 2D).
The bundled JDK 26.0.1 (2026.1 Patch 1 →, current) is affected by the July 2026 CPU (published 2026-07-21); the fixes are in JDK 26.0.2, which no shipped Elasticsearch version bundles yet — Elasticsearch 8.19.19 (2026.2) still carries JDK 26.0.1+8. The remotely reachable items are CVE-2026-41254 (2D, High 7.5, complete DoS), CVE-2026-47063 (Libraries, High 7.5, integrity impact), CVE-2026-60147 (Security, Medium 6.5), CVE-2026-46968 (JSSE, Medium 5.9), CVE-2026-46917 (JSSE, Medium 5.3), CVE-2026-47021 (2D, Medium 5.3), CVE-2026-47027 (Libraries, Medium 5.3), CVE-2026-47010 (ImageIO, Low 3.7), and CVE-2026-47059 (2D, Low 3.7); CVE-2026-62574 (Install, High 7.8) is local-only. The same ten CVEs affect every older shipped JDK in the table above. The next Oracle CPU is scheduled for 2026-10-20.
| CVE | Severity | Affected versions | Affected releases | Status | Fixed in | Description |
|---|---|---|---|---|---|---|
| CVE-2026-34282 | High 7.5 | JDK 21.0.2 – 25.0.2 | 2024.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Elasticsearch 8.19.16, JDK 26.0.1) | Networking: remote unauthenticated complete DoS (April 2026 CPU). |
| CVE-2026-23865 | Medium 5.3 | JDK 21.0.2 – 25.0.2 | 2024.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Elasticsearch 8.19.16, JDK 26.0.1) | 2D: FreeType integer overflow parsing variable-font tables (out-of-bounds read); requires processing a crafted font (April 2026 CPU). |
| CVE-2026-22021 | Medium 5.3 | JDK 21.0.2 – 25.0.2 | 2024.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Elasticsearch 8.19.16, JDK 26.0.1) | JSSE: partial DoS via crafted HTTPS traffic (April 2026 CPU). |
| CVE-2026-22016 | High 7.5 | JDK 21.0.2 – 25.0.2 | 2024.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Elasticsearch 8.19.16, JDK 26.0.1) | JAXP: unauthorized read of critical data via crafted XML (April 2026 CPU). |
| CVE-2026-22013 | Medium 5.3 | JDK 21.0.2 – 25.0.2 | 2024.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Elasticsearch 8.19.16, JDK 26.0.1) | JGSS: unauthorized read of critical data; requires user interaction (April 2026 CPU). |
| CVE-2026-21945 | High 7.5 | JDK 21.0.2 – 25 | 2024.1 – 2025.3 | Fixed | 2026.1 (Elasticsearch 8.19.13, JDK 25.0.2) | Security: remote unauthenticated complete DoS — hang or repeatable crash (January 2026 CPU). |
| CVE-2026-21933 | Medium 6.1 | JDK 21.0.2 – 25 | 2024.1 – 2025.3 | Fixed | 2026.1 (Elasticsearch 8.19.13, JDK 25.0.2) | Networking: scope-changed low confidentiality/integrity impact; requires user interaction (January 2026 CPU). |
| CVE-2026-21932 | High 7.4 | JDK 21.0.2 – 25 | 2024.1 – 2025.3 | Fixed | 2026.1 (Elasticsearch 8.19.13, JDK 25.0.2) | AWT: scope-changed integrity-high impact; requires user interaction, and AWT is not exercised by a headless Elasticsearch server (January 2026 CPU). |
| CVE-2026-21925 | Medium 4.8 | JDK 21.0.2 – 25 | 2024.1 – 2025.3 | Fixed | 2026.1 (Elasticsearch 8.19.13, JDK 25.0.2) | RMI: low confidentiality/integrity impact (January 2026 CPU). |
| CVE-2025-53066 | High 7.5 | JDK 21.0.2 – 25 | 2024.1 – 2025.3 | Fixed | 2026.1 (Elasticsearch 8.19.13, JDK 25.0.2) | JAXP: unauthorized read of critical data via crafted XML (October 2025 CPU). |
| CVE-2025-53057 | Medium 5.9 | JDK 21.0.2 – 25 | 2024.1 – 2025.3 | Fixed | 2026.1 (Elasticsearch 8.19.13, JDK 25.0.2) | Security: unauthorized create/delete/modify of critical data (October 2025 CPU). |
| CVE-2025-50106 | High 8.1 | JDK 21.0.2 – 24 | 2024.1 – 2025.2 | Fixed | 2025.3 (Elasticsearch 8.19.5, JDK 25) | 2D glyph handling: potential takeover of the Java runtime via crafted font data (July 2025 CPU). |
| CVE-2025-50059 | High 8.6 | JDK 21.0.2 – 24 | 2024.1 – 2025.2 | Fixed | 2025.3 (Elasticsearch 8.19.5, JDK 25) | Networking: scope-changed unauthorized access to critical data (July 2025 CPU). |
| CVE-2025-30754 | Medium 4.8 | JDK 21.0.2 – 24 | 2024.1 – 2025.2 | Fixed | 2025.3 (Elasticsearch 8.19.5, JDK 25) | JSSE: low confidentiality/integrity impact via an incomplete TLS handshake (July 2025 CPU). |
| CVE-2025-30749 | High 8.1 | JDK 21.0.2 – 24 | 2024.1 – 2025.2 | Fixed | 2025.3 (Elasticsearch 8.19.5, JDK 25) | 2D: potential takeover of the Java runtime via crafted graphics data (July 2025 CPU). |
| CVE-2025-30698 | Medium 5.6 | JDK 21.0.2 – 24 | 2024.1 – 2025.2 | Fixed | 2025.3 (Elasticsearch 8.19.5, JDK 25) | 2D: low confidentiality/integrity/availability impact (April 2025 CPU). |
| CVE-2025-30691 | Medium 4.8 | JDK 21.0.2 – 24 | 2024.1 – 2025.2 | Fixed | 2025.3 (Elasticsearch 8.19.5, JDK 25) | Compiler: low confidentiality/integrity impact (April 2025 CPU). |
| CVE-2025-21587 | High 7.4 | JDK 21.0.2 – 24 | 2024.1 – 2025.2 | Fixed | 2025.3 (Elasticsearch 8.19.5, JDK 25) | JSSE: unauthorized create/delete/modify and read of critical data via TLS (April 2025 CPU). |
| CVE-2025-21502 | Medium 4.8 | JDK 21.0.2 – 22.0.1 | 2024.1 – 2025.1 | Fixed | 2025.2 (Elasticsearch 8.18.1, JDK 24) | Hotspot: low confidentiality/integrity impact (January 2025 CPU). |
| CVE-2024-21235 | Medium 4.8 | JDK 21.0.2 – 22.0.1 | 2024.1 – 2025.1 | Fixed | 2025.2 (Elasticsearch 8.18.1, JDK 24) | Hotspot C2 compiler: low confidentiality/integrity impact (October 2024 CPU). |
| CVE-2024-21147 | High 7.4 | JDK 21.0.2 – 22.0.1 | 2024.1 – 2025.1 | Fixed | 2025.2 (Elasticsearch 8.18.1, JDK 24) | Hotspot range-check elimination out-of-bounds access: unauthorized create/delete/modify and read of critical data (July 2024 CPU; the shipped 22.0.1 predates the 22.0.2 fix release). |
| CVE-2024-21145 | Medium 4.8 | JDK 21.0.2 – 22.0.1 | 2024.1 – 2025.1 | Fixed | 2025.2 (Elasticsearch 8.18.1, JDK 24) | 2D: low confidentiality/integrity impact (July 2024 CPU). |
| CVE-2024-21140 | Medium 4.8 | JDK 21.0.2 – 22.0.1 | 2024.1 – 2025.1 | Fixed | 2025.2 (Elasticsearch 8.18.1, JDK 24) | Hotspot: low confidentiality/integrity impact (July 2024 CPU). |
Low-severity items (CVSS ≤ 3.7) follow the same fix chain and are not tabulated: CVE-2024-21011, CVE-2024-21012, CVE-2024-21068, CVE-2024-21094 (April 2024 CPU; affected JDK 21.0.2 only, fixed in 2024.3); CVE-2024-21131, CVE-2024-21138 (July 2024 CPU; fixed in 2025.2); CVE-2024-21208, CVE-2024-21210, CVE-2024-21217 (October 2024 CPU; fixed in 2025.2); CVE-2025-30752 (July 2025 CPU; fixed in 2025.3); CVE-2025-61748 (October 2025 CPU; fixed in 2026.1); CVE-2026-22007, CVE-2026-22018, CVE-2026-34268 (April 2026 CPU; fixed in 2026.1 Patch 1).
Java in Lime BI¶
Lime BI installs its own Java: the lime-bi package's installer downloads a bundle containing
Metabase and a full JDK, and registers Metabase as a Windows service running on that JDK. An
installed instance never updates itself — the Java and Metabase versions change only when the
service is reinstalled with a newer lime-bi package. Lime BI is released on its own cadence,
independent of the on-premise platform releases, so the mapping is by lime-bi package version.
Coverage starts at lime-bi 3.47.0; anything older is resolved by upgrading.
| lime-bi | Metabase | Bundled Java | Notes |
|---|---|---|---|
| 3.47.0 – 3.66.x (maintained until March 2026) | Metabase Enterprise 1.46.x – 1.50.8 (1.50.8 since lime-bi 3.54.0, August 2024) | AdoptOpenJDK 11.0.9.1+1 | Requires Lime CRM Server 2024.1 or later |
| 4.x (from 4.1.0, January 2026) | Metabase Enterprise 1.57.x | Eclipse Temurin 21.0.9+10 | Requires Lime CRM Server 2025.3 or later |
The 3.x line's JDK 11.0.9.1+1 is the November 2020 patch level, unchanged across the whole line. Every Java 11 CVE fixed after that level applies; they are not enumerated here — the remediation for any Java CVE reported against a Lime BI 3.x installation is upgrading to the lime-bi 4.x line and reinstalling the service.
The 4.x line's Temurin 21.0.9+10 is the October 2025 CPU patch level. The January 2026 and April 2026 CPU items in the table above also affect Java 21.0.9 (fixed in 21.0.10 and 21.0.11 respectively), as do the July 2026 CPU items (fixed in 21.0.12); no lime-bi release bundles a fixed Java 21 yet.
Metabase (Lime BI)¶
A security fix for Metabase (used by Lime BI) was delivered under advisory LCSEC26-01 in 2025.1 Patch 3, 2025.2 Patch 3, and 2025.3 Patch 3. See LCSEC26-01 for details. No CVE id is published; the advisory rates the issue Medium (no CVSS score) and names Metabase versions only as a hotfix-compatibility threshold (1.49 or later). The Java runtime Lime BI runs on is covered in Java in Lime BI.
Microsoft SQL Server client components¶
Lime CRM bundles the Microsoft ODBC Driver 18, the OLE DB Driver 19, and the Visual C++ Redistributable. Shipped driver versions: ODBC Driver 18 — 18.3.2.1 (2024.1, 2024.2), 18.4.1.1 (2024.3 → 2025.3 Patch 3), 18.6.1.1 (2026.1 →, current); OLE DB Driver 19 — 19.3.2 (2024.1, 2024.2), 19.3.5 (2024.3 → 2025.3 Patch 3), 19.4.1 (2026.1 →, current).
The 2024 Microsoft servicing batch of client-side remote-code-execution advisories against these drivers (CVE-2024-28929 through CVE-2024-29043 for ODBC Driver 18 18.3.2.1, CVE-2024-28906 through CVE-2024-37334 for OLE DB Driver 19 19.3.2 — all triggered by connecting the driver to a malicious or compromised SQL Server) affected 2024.1 – 2024.2 only and was fixed in 2024.3 (ODBC Driver 18 18.4.1.1, OLE DB Driver 19 19.3.5). Every currently supported release carries fixed drivers, so the individual advisories are not enumerated here.
Microsoft Visual C++ Redistributable¶
Shipped: 14.38.33135.0 (2024.1, 2024.2), 14.40.33810.0 (2024.3 → 2025.3 Patch 3), 14.50.35719 (2026.1, 2026.1 Patch 1), 14.51.36247 (2026.2 →, current).
| CVE | Severity | Affected versions | Affected releases | Status | Fixed in | Description |
|---|---|---|---|---|---|---|
| CVE-2024-43590 | High 7.8 | 14.38.33135.0 – 14.40.33810.0 | 2024.1 – 2025.3 Patch 3 | Fixed | 2026.1 (VC++ Redistributable 14.50.35719) | Local elevation of privilege in the Visual C++ Redistributable installer. Microsoft's fix build (14.40.33816) predates 2024.3, but 2024.3 → 2025.3 still bundled 14.40.33810.0, below the fix threshold. This is an install-time issue, not a runtime exposure. |
Commonly flagged but not applicable to these components: CVE-2024-0056 (a Microsoft.Data / System.Data SqlClient .NET security-feature bypass — the SqlClient provider is not shipped by Lime; the advisory's remediation text mentions ODBC/OLE DB drivers only as an upgrade target) and CVE-2024-29047 (affects the SQL Server 2019/2022 server-bundled provider, not the standalone OLE DB Driver 19).
nginx¶
The shipped "Nginx for Windows" builds compile HTTP/2 but not QUIC / HTTP-3 (ngx_http_v3_module),
so all HTTP/3-only advisories are Not affected. The builds are 32-bit. Many advisories require an
optional module — mail, dav, mp4, scgi/uwsgi — that a default Lime CRM reverse-proxy config
does not enable; the precondition is noted per row. Version numbers are the shipped four-part
Nginx for Windows build versions.
| CVE | Severity | Affected versions | Affected releases | Status | Fixed in | Description |
|---|---|---|---|---|---|---|
| CVE-2026-60005 | Medium (f5 8.2 High; CVSS v4.0 8.8) | 1.23.3.6 – 1.31.1.1 | 2024.1 – 2026.1 Patch 1 | Fixed | 2026.2 (Nginx for Windows 1.31.1.4) | Uninitialized memory with unnamed regex captures in ngx_http_slice_module — limited memory disclosure or worker crash; requires the slice directive with unnamed regex captures, or background cache updates (backport of the upstream 1.31.3 fix). |
| CVE-2026-56434 | Medium (f5 6.5; CVSS v4.0 8.3 High) | 1.23.3.6 – 1.31.1.1 | 2024.1 – 2026.1 Patch 1 | Fixed | 2026.2 (Nginx for Windows 1.31.1.4) | Use-after-free in ngx_http_ssi_filter_module via a crafted backend response; requires ssi on with proxy_pass and proxy_buffering off, and an attacker-controlled upstream (backport of the upstream 1.31.3 fix). |
| CVE-2026-48142 | Low (f5 4.8 Medium) | 1.23.3.6 – 1.31.1.1 | 2024.1 – 2026.1 Patch 1 | Fixed | 2026.2 (Nginx for Windows 1.31.1.4) | Buffer over-read decoding UTF-8 via charset_map (backport of the upstream 1.31.2 fix). |
| CVE-2026-42946 | Medium (NVD 7.4 High; f5 6.5) | 1.23.3.6 – 1.29.3.1 | 2024.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Nginx for Windows 1.31.1.1) | Heap over-read from a crafted SCGI/uwsgi backend response; requires scgi_pass/uwsgi_pass. |
| CVE-2026-42945 | Medium (f5 8.1 High) | 1.23.3.6 – 1.29.3.1 | 2024.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Nginx for Windows 1.31.1.1) | Heap buffer overflow in ngx_http_rewrite_module; potential remote code execution. |
| CVE-2026-42934 | Low (f5 4.8 Medium) | 1.23.3.6 – 1.29.3.1 | 2024.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Nginx for Windows 1.31.1.1) | Heap over-read decoding UTF-8 via charset_map. |
| CVE-2026-42533 | Major (f5 8.1 High; CVSS v4.0 9.2 Critical) | 1.23.3.6 – 1.31.1.1 | 2024.1 – 2026.1 Patch 1 | Fixed | 2026.2 (Nginx for Windows 1.31.1.4) | Heap buffer overflow in the map directive with unnamed regex captures; potential remote code execution (backport of the upstream 1.31.3 fix). |
| CVE-2026-42055 | Medium (f5 8.1 High; CVSS v4.0 9.2 Critical) | 1.23.3.6 – 1.31.1.1 | 2024.1 – 2026.1 Patch 1 | Fixed | 2026.2 (Nginx for Windows 1.31.1.4) | Heap buffer overflow proxying a crafted request to an HTTP/2 backend; requires ignore_invalid_headers off (backport of the upstream 1.31.2 fix). |
| CVE-2026-40701 | Medium (f5 4.8 Medium) | 1.23.3.6 – 1.29.3.1 | 2024.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Nginx for Windows 1.31.1.1) | Use-after-free in DNS response processing when ssl_ocsp is used for client-certificate verification. |
| CVE-2026-40460 | Medium (f5 6.5) | — | — | Not affected | — | HTTP/3 QUIC connection-migration address spoofing; QUIC / HTTP-3 is not compiled into the shipped builds. |
| CVE-2026-32647 | Medium (f5 7.8 High) | 1.23.3.6 – 1.29.3.1 | 2024.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Nginx for Windows 1.31.1.1) | Crafted mp4 file triggers a buffer over-read/write in ngx_http_mp4_module; requires the mp4 directive. |
| CVE-2026-28755 | Medium (NVD 5.4) | 1.27.2.1 – 1.29.3.1 | 2025.2 – 2026.1 | Fixed | 2026.1 Patch 1 (Nginx for Windows 1.31.1.1) | Stream SSL handshake succeeds despite OCSP client-certificate rejection; requires stream ssl_verify_client + ssl_ocsp. |
| CVE-2026-28753 | Medium (f5 3.7 Low) | 1.23.3.6 – 1.29.3.1 | 2024.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Nginx for Windows 1.31.1.1) | Attacker-controlled PTR DNS records inject CRLF into mail auth_http requests and the XCLIENT command; requires mail proxy + resolver. |
| CVE-2026-27784 | Medium (NVD 5.5; f5 7.8 High) | 1.23.3.6 – 1.29.3.1 | 2024.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Nginx for Windows 1.31.1.1) | Crafted mp4 file crashes the worker on 32-bit platforms (the shipped builds are 32-bit); requires the mp4 directive. |
| CVE-2026-27654 | Medium (f5 8.2 High) | 1.23.3.6 – 1.29.3.1 | 2024.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Nginx for Windows 1.31.1.1) | Buffer overflow in ngx_http_dav_module on COPY/MOVE with alias; requires the dav module. |
| CVE-2026-27651 | Low (f5 7.5 High) | 1.23.3.6 – 1.29.3.1 | 2024.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Nginx for Windows 1.31.1.1) | NULL-pointer worker crash with CRAM-MD5 / APOP mail authentication; requires mail proxy. |
| CVE-2026-9256 | Medium (f5 8.1 High) | 1.23.3.6 – 1.29.3.1 | 2024.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Nginx for Windows 1.31.1.1) | Heap buffer overflow in ngx_http_rewrite_module with overlapping regex captures; potential remote code execution. |
| CVE-2026-1642 | Medium (f5 5.9) | 1.23.3.6 – 1.29.1.1 | 2024.1 – 2025.3 | Fixed | 2026.1 (Nginx for Windows 1.29.3.1) | Plaintext data injection into responses proxied from an SSL backend (attacker in a MITM position toward the TLS upstream). |
| CVE-2025-53859 | Low (f5 3.7 Low) | 1.23.3.6 – 1.27.2.1 | 2024.1 – 2025.2 | Fixed | 2025.3 (Nginx for Windows 1.29.1.1) | Worker memory disclosure to the auth server via the "none" auth method in ngx_mail_smtp_module; requires an SMTP mail proxy. |
| CVE-2025-23419 | Medium (f5 4.3) | 1.23.3.6 – 1.27.2.1 | 2024.1 – 2025.2 | Fixed | 2025.3 (Nginx for Windows 1.29.1.1) | TLSv1.3 session resumption bypasses client-certificate verification across name-based virtual servers sharing an IP. |
| CVE-2024-35200 | Medium (NVD 5.3) | — | — | Not affected | — | HTTP/3 NULL-pointer worker crash; QUIC / HTTP-3 not compiled in (vendor build states "does not affect our version"). |
| CVE-2024-34161 | Medium (NVD 5.3) | — | — | Not affected | — | HTTP/3 crafted QUIC packets leak freed worker memory; QUIC / HTTP-3 not compiled in. |
| CVE-2024-32760 | Medium (NVD 6.5) | — | — | Not affected | — | HTTP/3 crafted QUIC encoder instructions overwrite worker memory; QUIC / HTTP-3 not compiled in. |
| CVE-2024-31079 | Medium (NVD 4.8) | — | — | Not affected | — | HTTP/3 stack overflow / use-after-free during connection draining; QUIC / HTTP-3 not compiled in. |
| CVE-2024-7347 | Low (NVD 4.7 Medium) | 1.23.3.6 – 1.25.4.2 | 2024.1 – 2025.1 | Fixed | 2025.2 (Nginx for Windows 1.27.2.1) | Crafted mp4 file over-reads worker memory in ngx_http_mp4_module; requires the mp4 directive. |
| CVE-2023-44487 | High (NVD 7.5) | — | — | Not affected | — | HTTP/2 "Rapid Reset" DoS; the 1.25.3 stream-handling mitigation is present in every shipped build (from 1.23.3.6 onward). |
RabbitMQ¶
RabbitMQ Server 3.13.0 shipped in 2024.1–2024.2 and 3.13.7 has shipped since 2024.3. Lime enables only the management plugin — no stream, shovel, federation, web-MQTT/STOMP, trust-store, or tracing plugins, no OAuth 2, no TLS listeners, single node — which is what keeps most of the advisories below out of reach. Two facts frame every 3.13 row: 3.13.7 (August 2024) is the last open-source release of the 3.13 line — community support ended 2024-09-30 and the later 3.13.x fix releases (3.13.8 and up) are commercial-only — so fixes only become available through a future upgrade to the RabbitMQ 4.x line; and because both shipped versions predate every 3.13 fix release, an advisory that affects the line affects both of them (2024.1 onwards).
Advisories reachable in a Lime deployment (management plugin + AMQP 0-9-1). Severities are the vendor (Broadcom/GitHub) ratings; most of the 2026 batch has no independent NVD score yet:
| CVE | Severity | Affected versions | Affected releases | Status | Fixed in | Description |
|---|---|---|---|---|---|---|
| CVE-2026-57221 | Medium | 3.13.0 – 3.13.7 | 2024.1 → | Affected | — | Passive queue.declare/exchange.declare skip authorization checks: any authenticated user sharing a vhost can enumerate queues/exchanges and read message/consumer counts. |
| CVE-2026-57215 | High | 3.13.0 – 3.13.7 | 2024.1 → | Affected | — | Direct-reply-to bindings persist, allowing an authenticated client to inject unauthorized reply channels / phantom bindings. |
| CVE-2026-57212 | High | 3.13.0 – 3.13.7 | 2024.1 → | Affected | — | Management HTTP API accepts request bodies larger than max_http_body_size (authenticated memory-exhaustion DoS). |
| CVE-2025-50200 | Medium | 3.13.0 – 3.13.7 | 2024.1 → | Affected | — | Management API errors log the HTTP Basic Authorization header, writing base64 credentials to the node log. Reproduced by the reporter on Windows + RabbitMQ 3.13.7. |
| CVE-2025-30219 | Medium 5.5 (NVD 6.1) | 3.13.0 – 3.13.7 | 2024.1 → | Affected | — | Stored XSS via an unescaped vhost name in a management-UI error notification; requires tampering with the vhost name on disk, so practical risk is low. |
| GHSA-q8g2-pc7m-m3jw (no CVE) | High 7.1 | 3.13.0 – 3.13.7 | 2024.1 → | Affected | — | AMQP 0-9-1 message-body assembly never validates accumulated size against max_message_size: memory-exhaustion DoS by an authenticated publisher. |
| GHSA-ggrw-qm45-hwpv (no CVE) | Medium 6.9 | 3.13.0 – 3.13.7 | 2024.1 → | Affected | — | Atom-table exhaustion via vhost metadata keys in a definitions import; requires the administrator tag. |
| GHSA-rg5q-vcgf-rfh7 (no CVE) | Medium 6.0 | 3.13.0 – 3.13.7 | 2024.1 → | Affected | — | ReDoS via the ?name= regex filter in the management API (no match_limit); requires the management tag. |
| GHSA-6v53-r759-jrvx (no CVE) | Medium 6.0 | 3.13.0 – 3.13.7 | 2024.1 → | Affected | — | Atom-table exhaustion via the node field in management API requests (list_to_atom), crashing the VM; requires the management tag. |
| GHSA-j45q-v7g2-82ph (no CVE) | Low 2.3 | 3.13.0 – 3.13.7 | 2024.1 → | Affected | — | Cross-vhost quorum-queue status disclosure (missing vhost check); only relevant when more than one vhost exists. |
| GHSA-j9m2-hw6x-rqr9 (no CVE) | Low 2.1 | 3.13.0 – 3.13.7 | 2024.1 → | Affected | — | The protected user-tag guard is bypassed by POST /api/users/bulk-delete; requires the administrator tag. |
Advisories with the same affected range (3.13.0 – 3.13.7, 2024.1 →) whose required feature is never enabled in a Lime deployment — status Not exploitable, grouped by that feature:
| Requires (not enabled by Lime) | Advisories |
|---|---|
rabbitmq_stream plugin |
GHSA-c8c4-gvv4-8j3q (Medium 6.3; pre-auth stream frame-length memory DoS — the 3.13 counterpart of the 4.2-only CVE-2026-57220), GHSA-48hm-chgv-398r (Medium 6.0) |
| Shovel / federation plugins | GHSA-9wm4-9m6g-w38x (Medium 5.6), GHSA-x5h5-588r-cv55 (Medium 5.9), GHSA-85jr-6rr2-j73r (Medium 5.9), GHSA-7jc3-73v6-rjvc (Medium 6.0), GHSA-g5v3-w5xg-62q2 (Low 2.3), CVE-2026-57213 (Medium; stored XSS in federation management) |
| OAuth 2 | GHSA-37wx-r6q9-6fhj (Critical 9.2; JWKS fetch falls back to verify_none), CVE-2026-57219 (High; unauthenticated OAuth client-secret disclosure), GHSA-89p2-f5cv-x5cg (Medium 6.0) |
| Web-MQTT / Web-STOMP plugins | GHSA-gmgx-hhg5-43gr (High 8.2; unauthenticated decompression bomb), GHSA-7v63-j4gm-p4rh (Medium 6.3), GHSA-9c4f-rxxm-88q3 (Medium 5.3) |
rabbitmq_trust_store plugin |
GHSA-cw8c-4m83-9c6w (Critical 9.1; TLS client-auth bypass) |
| AMQP 1.0 plugin | GHSA-c66h-hf5j-8jf9 (High 8.2; pre-auth array32 memory DoS) |
| TLS listeners with peer verification | GHSA-rjcf-35r5-xw38 (High 7.3; stored XSS via client-certificate DN) |
proxy_protocol option |
CVE-2026-57216 (Medium, NVD 6.8; loopback-only users such as guest reachable remotely) |
| Khepri metadata store (3.13 defaults to Mnesia) | CVE-2026-57217 (High; topic authorization fails open) |
| CORS wildcard configuration | GHSA-p3hp-v9wh-ghm7 (High 7.6; Origin reflected with credentials allowed) |
| JMS topic exchange plugin | GHSA-r3qr-4h63-mvj2 (Medium 6.0) |
| Consistent-hash exchange plugin | GHSA-m8pg-4x2h-jvgr (Medium 6.0) |
rabbitmq_tracing plugin |
GHSA-h7cq-qrr8-7vgc (Low 2.1) |
Advisories a scanner may raise that do not apply to the shipped versions at all:
| CVE | Severity | Affected versions | Affected releases | Status | Fixed in | Description |
|---|---|---|---|---|---|---|
| CVE-2026-57220 | High 7.5 | — | — | Not affected | — | Unauthenticated memory-exhaustion DoS via oversized stream-protocol frames; affects the 4.2.x line only (the 3.13 stream frame-length issue is GHSA-c8c4-gvv4-8j3q above). |
| CVE-2026-57218 | Medium 4.9 (CVSS v4.0) | — | — | Not affected | — | AMQP 0-9-1 + OAuth 2 consumers keep receiving messages after token expiry; affects 4.2.x only and requires OAuth 2, which Lime's RabbitMQ does not use. |
| CVE-2024-51988 | Medium 6.5 | — | — | Not affected | — | HTTP API queue-deletion endpoint did not verify configure permission; affects only 3.12.8–3.12.10, and 3.13.0 already carries the fix. |
| CVE-2023-46120 | Medium 4.9 | — | — | Not affected | — | DoS via large messages in the RabbitMQ Java client library, not the broker. Keyword scanners sometimes attach it to rabbitmq-server. |
| CVE-2023-46118 | Medium 4.9 | — | — | Not affected | — | DoS by publishing large messages over the HTTP API; fixed in 3.11.24 / 3.12.7, before the 3.13 branch. |
Redis¶
Redis backs the Email Integration. It was optional in 2024.3 (undocumented version) and 2025.1 (7.4.2), became required in 2025.2, and moved to 8.2.2 (2025.3), 8.8.0 (2026.1 Patch 1), then 8.10.0 (2026.2). Most Redis advisories require an authenticated connection; a standalone single instance is the typical deployment. Some rows apply only if the Redis 8 modules are loaded, as noted.
| CVE | Severity | Affected versions | Affected releases | Status | Fixed in | Description |
|---|---|---|---|---|---|---|
| CVE-2026-25589 | High 8.8 | 8.2.2 | 2025.3 – 2026.1 | Fixed | 2026.1 Patch 1 (Redis 8.8.0) | RESTORE of a crafted RedisBloom payload triggers invalid memory access (potential RCE); applies only if the RedisBloom module is loaded. |
| CVE-2026-25588 | High 8.8 | 8.2.2 | 2025.3 – 2026.1 | Fixed | 2026.1 Patch 1 (Redis 8.8.0) | RESTORE of a crafted RedisTimeSeries payload triggers invalid memory access (potential RCE); applies only if the RedisTimeSeries module is loaded. |
| CVE-2026-25243 | High 8.8 (GHSA v4.0 7.7) | 7.4.2 – 8.2.2 | 2025.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Redis 8.8.0) | RESTORE does not sufficiently validate a crafted serialized payload — invalid memory access, potential RCE. Requires authenticated access + RESTORE. |
| CVE-2026-23631 | Medium 6.1 (CVSS v4.0; NVD 8.1 High) | 7.4.2 – 8.2.2 | 2025.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Redis 8.8.0) | "DarkReplica": Lua use-after-free via the master-replica synchronization mechanism (potential RCE); only exploitable on replicas where replica-read-only is disabled. |
| CVE-2026-23479 | High 8.8 (GHSA v4.0 7.7) | 7.4.2 – 8.2.2 | 2025.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Redis 8.8.0) | Use-after-free in the unblock-client flow (potential RCE). Requires authenticated access. |
| CVE-2025-62507 | High 8.8 (GHSA v4.0 7.7) | 8.2.2 | 2025.3 – 2026.1 | Fixed | 2026.1 Patch 1 (Redis 8.8.0) | Stack buffer overflow in XACKDEL with many stream IDs (potential RCE). XACKDEL is new in Redis 8.2, so 7.4.2 is not affected. |
| CVE-2025-49844 | Critical 9.9 | 7.4.2 | 2025.1 – 2025.2 | Fixed | 2025.3 (Redis 8.2.2) | "RediShell": crafted Lua script manipulates the garbage collector (use-after-free RCE). Requires authenticated access + Lua scripting. |
| CVE-2025-48367 | High 7.5 | 7.4.2 | 2025.1 – 2025.2 | Fixed | 2025.3 (Redis 8.2.2) | Unauthenticated connection causing repeated protocol errors leads to client starvation (DoS). |
| CVE-2025-46819 | Medium 6.3 (NVD 7.1 High) | 7.4.2 | 2025.1 – 2025.2 | Fixed | 2025.3 (Redis 8.2.2) | Crafted Lua script reads out-of-bounds data or crashes the server (info leak / DoS). Requires authenticated access + Lua. |
| CVE-2025-46818 | Medium 6.0 (NVD 7.3 High) | 7.4.2 | 2025.1 – 2025.2 | Fixed | 2025.3 (Redis 8.2.2) | Crafted Lua script runs code in the context of another Redis ACL user. Requires authenticated access + Lua. |
| CVE-2025-46817 | High 7.0 (NVD 8.8) | 7.4.2 | 2025.1 – 2025.2 | Fixed | 2025.3 (Redis 8.2.2) | Crafted Lua script causes an integer overflow (potential RCE). Requires authenticated access + Lua. |
| CVE-2025-32023 | High 7.0 (NVD 7.8) | 7.4.2 | 2025.1 – 2025.2 | Fixed | 2025.3 (Redis 8.2.2) | Out-of-bounds write via crafted HyperLogLog strings (potential RCE). Requires authenticated access + HLL commands. |
| CVE-2025-27151 | Medium 4.7 (NVD 9.8 Critical) | 7.4.2 | 2025.1 – 2025.2 | Fixed | 2025.3 (Redis 8.2.2) | Stack buffer overflow in the offline redis-check-aof CLI tool via an overlong file path (not the network-facing server). |
| CVE-2025-21605 | High 7.5 | 7.4.2 | 2025.1 – 2025.2 | Fixed | 2025.3 (Redis 8.2.2) | Unauthenticated client can grow output buffers without limit until the server OOMs (DoS). |
| CVE-2024-46981 | High 7.0 (NVD 9.8 Critical) | — | — | Not affected | — | Lua GC use-after-free RCE; fixed exactly in 7.4.2, the first shipped 7.4.x. Common scanner flag because it was published close to the 7.4.2 release. |
| CVE-2024-51741 | Medium 4.4 | — | — | Not affected | — | Malformed ACL selector DoS; fixed exactly in 7.4.2. |
| CVE-2024-31449 | High 7.0 | — | — | Not affected | — | Lua bit-library stack overflow RCE; fixed in 7.4.1, below the shipped 7.4.2. |
| CVE-2024-31228 | Medium 5.5 | — | — | Not affected | — | Unbounded ACL pattern-matching DoS; fixed in 7.4.1, below the shipped 7.4.2. |
| CVE-2024-31227 | Medium 4.4 | — | — | Not affected | — | Malformed ACL selector DoS; fixed in 7.4.1, below the shipped 7.4.2. |
— RedisBloom / TDigest RESTORE out-of-bounds writes (no CVE) |
High (no CVSS published) | 8.2.2 – 8.8.0 | 2025.3 – 2026.1 Patch 1 | Fixed | 2026.2 (Redis 8.10.0) | Crafted RESTORE payloads for the RedisBloom and TDigest structures trigger out-of-bounds writes (potential RCE); applies only if the RedisBloom module is loaded. Part of the July 2026 upstream security release (fixed upstream in 8.8.1); distinct from CVE-2026-25589 above, despite third-party write-ups reusing that id. |
— Stream RESTORE use-after-free (no CVE) |
Not scored | 7.4.2 – 8.2.2 | 2025.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Redis 8.8.0) | A crafted stream RESTORE payload makes two consumers share the same NACK, causing a use-after-free (potential RCE). Disclosed in the July 2026 upstream security release; the 8.8 line already carried the fix, so 8.8.0 is not affected. |
| — CRLF injection in error replies (no CVE) | Not scored | 7.4.2 – 8.2.2 | 2025.1 – 2026.1 | Fixed | 2026.1 Patch 1 (Redis 8.8.0) | A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply. No CVE was assigned. |
| — Hide PII from server log (no CVE) | Not scored | 8.2.2 | 2025.3 – 2026.1 | Fixed | 2026.1 Patch 1 (Redis 8.8.0) | Server log could expose personally identifiable information; applies only if the RedisTimeSeries or RedisJSON module is loaded. No CVE was assigned. |
The four Lua CVEs above (CVE-2025-49844 / -46817 / -46818 / -46819) are commonly flagged against Redis 8.2.2, but 8.2.2 is their fix release — those flags do not apply. The RedisTimeSeries / RedisBloom module CVEs CVE-2024-51480 and CVE-2024-55656 predate the Redis 8 module bundling, and the authenticated multi-bulk DoS GHSA-2r7g-8hpc-rpq9 is a won't-fix protocol behaviour with no CVE.
No known applicable CVEs¶
The following bundled components have no known CVE applicable to the versions shipped since 2024.1:
- WinSW (2.12.0) — No known applicable CVEs in the versions shipped since 2024.1.
- NSSM (2.21-134) — No known applicable CVEs in the versions shipped since 2024.1. Removed in 2026.2, where the webfront service moved to WinSW like all other services.
- Microsoft Sysinternals Handle (5.0) — No known applicable CVEs in the versions shipped since 2024.1. Removed from the installer in 2024.3.