CIB seven 2.2.4 CE+ hotfix - Release Notes

Release Date: November 4, 2026

Highlights

  • Docker Rebuilt Docker images of CIB seven 2.2.4 CE+ with updated operating system and Java runtime packages. The CIB seven distribution inside the images is unchanged, and there is no new ZIP distribution. The images are tagged with a -hotfix suffix: 2.2.4-hotfix, tomcat-2.2.4-hotfix, run-2.2.4-hotfix, run4-2.2.4-hotfix and wildfly-2.2.4-hotfix. The 2.2.4 images are not changed
  • Security 3 Critical CVEs resolved by the updated Java runtime, openssl and ca-certificates packages, including CVE-2026-91403 (compromised eMudhra intermediate CA certificates)
  • OpenTelemetry The Prometheus metrics endpoint can be scraped from outside the container again

Configuration Changes

  • The Docker images now set OTEL_EXPORTER_PROMETHEUS_HOST=0.0.0.0, so the Prometheus exporter of the OpenTelemetry Java agent listens on all interfaces of the container. It only takes effect when the Prometheus exporter is enabled (OTEL_METRICS_EXPORTER=prometheus, on Tomcat and WildFly also OTEL_AGENT_ENABLED=true). Restrict access to port 9464 to trusted scrapers, or set OTEL_EXPORTER_PROMETHEUS_HOST=localhost if only in-container scraping is needed

Bug Fixes

OpenTelemetry

  • Fixed the Prometheus metrics endpoint on port 9464 not being reachable from other containers or through a published port. Since 2.2.2, the OpenTelemetry Java agent 2.28.1 binds the exporter to localhost by default. See OpenTelemetry and JMX metrics

Technical Updates

Dependency Updates

  • Update openssl (libcrypto3, libssl3) from 3.5.8-r0 to 3.5.9-r0 (Alpine base image)
  • Update the Java runtime (openjdk21-jre-headless) to 21.0.13.0.3 (Alpine base image), which blocks the compromised eMudhra intermediate CA certificates
  • Update ca-certificates to 20261020 (Alpine base image), which no longer trusts emSign ECC Root CA - G3

Resolved CVE Vulnerabilities

Critical Severity
  • CVE-2026-91403 - eMudhra generated weak private keys for 8 intermediate CAs, so TLS certificates that chain to them can be forged. This exposes outbound TLS connections from the container that use the default Java truststore, e.g. the AI Agent Connector, the HTTP connector, OIDC/JWKS or mail. Affects the Java truststore (openjdk, ca-certificates). - CVSS 9.1.
  • CVE-2026-46470 - Critical vulnerability in a package of the Docker images, resolved by the package updates above.
  • CVE-2026-114820 - Critical vulnerability in a package of the Docker images, resolved by the package updates above.

On this Page: