Current version 3.7.0 has 1 CVE: CVE-2025-25193

[JoshuelNobre]

Expected behavior

No security vulnerabilities should be present in the current version of Application Insights.

Actual behavior

The current version of Application Insights Java agent uses a vulnerable version of netty-common (4.1.117.Final) which contains CVE-2024-12798, allowing potential arbitrary code execution through JaninoEventEvaluator component.

To Reproduce

I generated a base image using Application Insights and, upon scanning the image with Trivy, I found this vulnerability.

System information

Please provide the following information:

• SDK Version:
• OS type and version: Linux, redhat
• Application Server type and version (if applicable): 3.7.0
• Using spring-boot? yes
• Additional relevant libraries (with version, if applicable): netty-common

Screenshots

[trask]

hi @JoshuelNobre, #4077 will be included in our next release (it's not an exploitable vulnerability for Application Insights Java agent

[trask]

3.7.1 has been released