Security Scan: Third-Party Library Upgrades
Overview
This page lists the third-party libraries reported by the customer security scan and what was done with each of them in ACS 7.1.3.
-
Jira: DEV-2901
-
Applies to: ACS 7.1.3
-
Results recorded: 2026-09-21
In the table:
-
Version in the scan report is the version the scan found in the ACS image.
-
Version in ACS 7.1.3 is the version this release ships.
-
Not upgraded means the library was checked and left as it is. The Notes column gives the reason.
Libraries
| Component | Version in the scan report | Version in ACS 7.1.3 | Notes |
|---|---|---|---|
Apache ActiveMQ |
6.2.6 |
6.3.2 |
|
Apache Commons FileUpload |
Fork of 1.6.0 |
Not upgraded |
ACS doesn’t use this library directly. Apache Tomcat does, but it ships a repackaged internal fork rather than the library itself — a stripped-down, modified copy (currently aligned with 1.6.0) that Tomcat maintains and patches on its own, not a straight copy of the upstream release. |
Apache CXF |
4.1.3 |
4.2.3 |
|
Apache Tomcat |
11.0.22 |
11.0.26 |
|
Apache Xerces2 J |
2.12.2 |
Not upgraded |
This is the latest version of 2.12.x branch, it doesn’t have vulnerabilities. |
commons-bcel |
6.10.0 |
Not upgraded |
This is a part of Java itself. Newer builds include 6.10.0 too. |
curl |
8.20.0 |
8.22.0 |
The latest version available at the time the image is built is used. |
dom4j: flexible XML framework for Java |
2.2.0 |
Not upgraded |
2.2.0 is the latest version without vulnerabilities. |
jackson-databind |
2.21.2, 3.0.3 |
2.21.5, 3.2.2 |
|
Kotlin |
1.3.70 |
Not upgraded |
Not found and is not used anywhere. |
Little cms color engine |
2.17 |
2.19.1 |
This is a part of Java itself. |
lz4 |
1.8.0, 1.10.2 |
1.11.3 |
|
mysql-connector-j |
9.4.0 |
Not upgraded |
No vulnerabilities in the current version |
Netty Project |
4.2.15 |
4.2.18 |
|
OpenJDK |
25.0.3+9 |
25.0.4+7 |
|
Spring Framework |
7.0.7 |
7.0.9 |
|
The FreeType Project |
2.14.2 |
2.14.3-r0 |
The latest version available at the time the image is built is used. |
Apache HTTPComponents Core |
5.3.4 |
5.4.3 |
|
Apache HTTPComponents Core |
5.3.6 |
5.4.3 |
|
Apache Neethi |
3.2.1 |
3.2.3 |
|
Bouncy Castle |
1.70 |
Not upgraded, already 1.84 |
The image contains 1.84. The version 1.70 was not found |
jackson-core |
3.0.3 |
3.2.2 |
|
jackson-databind |
2.21.2 |
2.21.5 |
Cannot be updated to 3.2.2. 2.21.5 doesn’t have vulnerabilities. |
jackson-databind |
3.0.3 |
3.2.2 |
|
Jakarta Mail |
2.0.5, 2.1.5 |
Not upgraded |
Both versions don’t have vulnerabilities. |
libjpeg |
6b |
Not upgraded |
This is a part of Java itself. |
libxml2 |
2.13.9 |
Not upgraded |
The latest version in Alpine Linux repos. |
LLVM - Low Level Virtual Machine |
Not found. Probably some of Linux libraries indirectly use it. |
||
micrometer-metrics |
1.16.5 |
1.17.1 |
|
musl |
1.2.5 |
1.2.6-r2 |
|
Procps |
4.0.5-r0 |
4.0.6 |
The latest version available at the time the image is built is used. |
protobuf-java |
4.32.0 |
4.35.1 |
|
pykerberos |
1.1.2 |
Not upgraded |
Not found and is not used anywhere. |
Spring Data Commons |
4.0.5 |
4.1.1 |
|
Spring Security |
7.0.5 |
7.1.1 |