thingsboard vulnerabilities

Known vulnerabilities in the thingsboard package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
H HTTP Request Smuggling	<4.2-r4
L GHSA-fghv-69vj-qj49	<4.2-r4
L GHSA-3p8m-j85q-pgmj	<4.2-r3
H Improper Handling of Highly Compressed Data (Data Amplification)	<4.2-r3
L CVE-2025-41242	<4.1-r7
L GHSA-r936-gwx5-v52f	<4.1-r7
L GHSA-prj3-ccx8-p6x4	<4.1-r6
H Allocation of Resources Without Limits or Throttling	<4.1-r6
L CVE-2025-7339	<4.1-r5
L GHSA-76c9-3jph-rj3q	<4.1-r5
L GHSA-4q2v-9p7v-3v22	<4.1-r2
L CVE-2025-22227	<4.1-r2
L Uncontrolled Recursion	<4.1-r1
L GHSA-j288-q9x7-2f5v	<4.1-r1
L GHSA-g93m-8x6h-g5gv	<4.0.1-r51
L Authentication Bypass	<4.0.1-r51
L GHSA-h3gc-qfqq-6h8f	<4.0.1-r8
L GHSA-wc4r-xq3c-5cf3	<4.0.1-r8
L Authentication Bypass	<4.0.1-r8
L Allocation of Resources Without Limits or Throttling	<4.0.1-r8
L CVE-2025-41234	<4.0.1-r7
L GHSA-6r3c-xf4w-jxjm	<4.0.1-r7
L CVE-2025-27817	<4.0.1-r6
L GHSA-vgq5-3255-v292	<4.0.1-r6
L GHSA-4wp7-92pw-q264	<4.0.1-r5
L CVE-2025-22233	<4.0.1-r5
L Improper Handling of Case Sensitivity	<4.0.1-r4
L GHSA-h2fw-rfh5-95r3	<4.0.1-r4
C XML External Entity (XXE) Injection	<4.0.1-r2
L GHSA-vrpq-qp53-qv56	<4.0.1-r2
L GHSA-ff77-26x5-69cr	<4.0.1-r1
C Improper Encoding or Escaping of Output	<4.0.1-r1
H Incomplete Cleanup	<4.0.1-r1
L GHSA-3p2h-wqq4-wf4h	<4.0.1-r1
L GHSA-735f-pc8j-v9w8	<3.9.1-r2
L CVE-2024-38809	<3.9.1-r2
L GHSA-2rmj-mq67-h97g	<3.9.1-r2
L GHSA-mg83-c7gq-rv5c	<3.9.1-r2
L CVE-2024-47764	<3.9.1-r2
H Out-of-bounds Write	<3.9.1-r2
L CVE-2025-22228	<3.9.1-r2
L GHSA-pxg6-pf52-xh8x	<3.9.1-r2
L GHSA-p53j-g8pw-4w5f	<3.9.1-r2
L CVE-2020-36843	<3.9.1-r2
L GHSA-83qj-6fr2-vhqg	<3.9.1-r2
C Deserialization of Untrusted Data	<3.9.1-r2
L GHSA-4g8c-wm8x-jfhw	<3.9.1-r1
L CVE-2025-24970	<3.9.1-r1
L GHSA-5j33-cvvr-w245	<3.9-r1
L GHSA-27hp-xhwr-wr2m	<3.9-r1
L Time-of-check Time-of-use (TOCTOU)	<3.9-r1
L Improper Authentication	<3.9-r1
L GHSA-mfj5-cf8g-g2fv	<3.9-r1
L Time-of-check Time-of-use (TOCTOU)	<3.9-r1
L CVE-2024-12798	<3.9-r0
L CVE-2024-12801	<3.9-r0
L GHSA-pr98-23f8-jwxv	<3.9-r0
L GHSA-6v67-2wr5-gvf4	<3.9-r0
L CVE-2024-38827	<3.8.1-r4
L GHSA-q3v6-hm2v-pw99	<3.8.1-r4
L GHSA-2x2g-32r7-p4x8	<3.8.1-r4
L Improper Privilege Management	<3.8.1-r4
L GHSA-rhx6-c78j-4q9w	<3.8.1-r4
L Inefficient Regular Expression Complexity	<3.8.1-r4
L GHSA-c4q5-6c82-3qpw	<3.8.1-r2
L CVE-2024-38816	<3.8.1-r2
L CVE-2024-38821	<3.8.1-r2
L GHSA-cx7f-g6mp-7hqm	<3.8.1-r2
L GHSA-4gc7-5j7h-4qph	<3.8.1-r1
M CVE-2024-38820	<3.8.1-r1
M Cross-site Scripting (XSS)	<3.7-r4
L GHSA-493p-pfq6-5258	<3.7-r4
L GHSA-fg2v-w576-w4v3	<3.7-r4
H Out-of-bounds Write	<3.7-r4
L GHSA-m6fv-jmcg-4jfg	<3.7-r4
H Uncontrolled Recursion	<3.7-r4
H CVE-2023-52428	<3.7-r2
L GHSA-w33c-445m-f8w7	<3.7-r2
L Inefficient Regular Expression Complexity	<3.7-r2
L GHSA-9wv6-86v2-598j	<3.7-r2
L GHSA-wm9w-rjj3-j356	<3.7-r2
L Resource Exhaustion	<3.7-r2
H Incorrect Conversion between Numeric Types	<3.7-r2
L GHSA-gvpg-vgmx-xg6w	<3.7-r2
L GHSA-cqj8-47ch-rvvq	<3.7-r1
M Incorrect Default Permissions	<3.7-r1
L GHSA-2qp4-g3q3-f92w	<3.7-r1
M Inclusion of Functionality from Untrusted Control Sphere	<3.7-r1

Vulnerability

Vulnerable Version

HTTP Request Smuggling

<4.2-r4

GHSA-fghv-69vj-qj49

<4.2-r4

GHSA-3p8m-j85q-pgmj

<4.2-r3

Improper Handling of Highly Compressed Data (Data Amplification)

<4.2-r3

CVE-2025-41242

<4.1-r7