Axon Ivy 10.0.36 – Planned fixes for Critical/High CVEs in engine dependencies

vantho296

Hi @ivyTeam @IvyExperts ,

I am currently reviewing security vulnerabilities reported for Axon Ivy Engine 10.0.36 and would like to ask whether there are plans to patch or upgrade the affected dependencies in an upcoming release.

The following CVEs appear to originate from dependencies bundled with the Axon Ivy Engine/runtime.

Tomcat bundle (org.apache.tomcat:tomcat-catalina 9.0.117):

CVE-2026-41293 (CRITICAL)
CVE-2026-43512 (CRITICAL)
CVE-2026-43515 (CRITICAL)
CVE-2026-41284 (HIGH)
CVE-2026-42498 (HIGH)
CVE-2026-43513 (HIGH)

These seem related to the embedded Tomcat bundle shipped with the engine.
Can be upgraded to tomcat 9.0.118 to fix the CVEs as the current version bundled inside engine is 9.0.117

Additional engine/runtime dependencies:

org.codehaus.plexus:plexus-utils 3.6.0
- CVE-2025-67030 (HIGH)
org.hibernate:hibernate-core 5.4.33.Final
- CVE-2026-0603 (HIGH)
org.postgresql:postgresql 42.7.10
- CVE-2026-42198 (HIGH)
org.bouncycastle:bcpkix-jdk18on 1.78.1
- CVE-2026-5588 (HIGH)
org.bouncycastle:bcprov-jdk18on 1.78.1
- CVE-2026-0636 (HIGH)
- CVE-2026-5598 (HIGH)

Could you please clarify:

Whether any of these CVEs are already patched/backported internally by Axon Ivy.
Whether there is a planned engine release that upgrades these dependencies.
If there is an ETA or recommended mitigation/workaround for customers in the meantime.

Thanks.

Reto Weiss

Hi @vantho296,

Thanks for reporting this. Please send security-related questions and reports to our support portal: Support.

Planned upgrades in 12.0.15 and 10.0.37:

Tomcat from 9.0.117 → 9.0.118
org.codehaus.plexus:plexus-utils from 3.6.0 → 3.6.1
org.postgresql:postgresql from 42.7.10 → 42.7.11

The following versions are not in our dependencies:

org.bouncycastle:bcpkix-jdk18on 1.78.1
org.bouncycastle:bcprov-jdk18on 1.78.1

We currently use 1.70.0.

We will not upgrade org.hibernate:hibernate-core (currently 5.4.33.Final) because there is no newer compatible 5.x release yet. We plan to move to Hibernate 6.0 in the upcoming 14.0 release.

We monitor our dependencies with Dependency Track and use Renovate to keep them up to date.

Also, we provide a Software Bill of Material (SBOM) for our products. See https://download.axonivy.com/10.0.36/AxonIvyEngine10.0.36.2604091106_All_x64.zip.bom.json

You can expect 12.0.15 and 10.0.37 to be released later this week or next week.

Regards,
Reto Weiss
Product Owner