CyberzSOC

Applicability
← Back to CVE-2023-33246

CVE-2023-33246

CVSS 9.8 In CISA KEV Apache

Every applicability statement published about this vulnerability, kept as each source wrote it rather than merged into one verdict. Where sources disagree, both positions are shown.

Does it affect your version?

A statement that names no version covers the whole product, which is not the same as your version falling inside a range. Orderings marked best effort come from schemes with no published comparison algorithm; exact ones follow a published specification.

What each source says

Red Hat CSAF/VEX
precedence 100 · revised 2025-11-21
1 not affected
OSV.dev (incl. GHSA)
precedence 80 · revised 2026-08-12
6 affected 6 fixed
CVE List v5 (CNA container)
precedence 60 · revised 2025-10-21
1 affected

Precedence decides which claim wins when two sources describe the same product over the same version range. It is a property of the source, not of the claim, and changing it re-ranks the data without re-reading a single document.

Statements (14)

Product Status Versions Remediation Source
red_hat_products Red Hat · All currently supported Red Hat products not affected vulnerable code not present no version stated not applicable csaf_redhat
https://github.com/apache/rocketmq affected < db4ba459bec9392ac37647ff1a4d24d30466814d vendor fix → db4ba459bec9392ac37647ff1a4d24d30466814d osv
https://github.com/apache/rocketmq affected >= f3e113cb1f98ced8327e7c97bfb5a623950339ef, < e244ebb99a1ba5e5dac174c699da8b83a273e7fd vendor fix → e244ebb99a1ba5e5dac174c699da8b83a273e7fd osv
org.apache.rocketmq:rocketmq-broker affected >= 5.0.0, < 5.1.1 vendor fix → 5.1.1 osv GHSA-x3cq-8f32-5f63
org.apache.rocketmq:rocketmq-controller affected >= 5.0.0, < 5.1.1 vendor fix → 5.1.1 osv GHSA-x3cq-8f32-5f63
org.apache.rocketmq:rocketmq-namesrv affected >= 4.0.0, < 4.9.6 vendor fix → 4.9.6 osv GHSA-x3cq-8f32-5f63
org.apache.rocketmq:rocketmq-namesrv affected >= 5.0.0, < 5.1.1 vendor fix → 5.1.1 osv GHSA-x3cq-8f32-5f63
https://github.com/apache/rocketmq fixed db4ba459bec9392ac37647ff1a4d24d30466814d vendor fix → db4ba459bec9392ac37647ff1a4d24d30466814d osv
https://github.com/apache/rocketmq fixed e244ebb99a1ba5e5dac174c699da8b83a273e7fd vendor fix → e244ebb99a1ba5e5dac174c699da8b83a273e7fd osv
org.apache.rocketmq:rocketmq-broker fixed 5.1.1 vendor fix → 5.1.1 osv GHSA-x3cq-8f32-5f63
org.apache.rocketmq:rocketmq-controller fixed 5.1.1 vendor fix → 5.1.1 osv GHSA-x3cq-8f32-5f63
org.apache.rocketmq:rocketmq-namesrv fixed 4.9.6 vendor fix → 4.9.6 osv GHSA-x3cq-8f32-5f63
org.apache.rocketmq:rocketmq-namesrv fixed 5.1.1 vendor fix → 5.1.1 osv GHSA-x3cq-8f32-5f63
Apache Software Foundation/Apache RocketMQ Apache Software Foundation · Apache RocketMQ affected <= 5.1.0 none available cve_cna

A claim with no version range is shown as written rather than expanded: a government catalog naming only a vendor and product is a real statement at zero granularity, and inventing bounds for it would put precision in the record that the source never offered.