# Vulnerabilities in latest docker image of confluentinc/cp-schema-registry:7.2.0

**URL:** <https://forum.confluent.io/t/vulnerabilities-in-latest-docker-image-of-confluentinc-cp-schema-registry-7-2-0/5587>\
**Category:** Schema Registry\
**Created:** [20 July 2022 13:55 UTC](https://forum.confluent.io/t/vulnerabilities-in-latest-docker-image-of-confluentinc-cp-schema-registry-7-2-0/5587 "2022-07-20T13:55:32Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Brijesh](https://avatars.discourse-cdn.com/v4/letter/b/f475e1/32.png) [@Brijesh](https://forum.confluent.io/u/Brijesh)\
**Post date:** [20 July 2022 13:55 UTC](https://forum.confluent.io/t/vulnerabilities-in-latest-docker-image-of-confluentinc-cp-schema-registry-7-2-0/5587/1 "2022-07-20T13:55:32Z")

</div>

Hi,

We are using confluentinc/cp-schema-registry:7.2.0 for one of our projects.  
While scanning the confluentinc/cp-schema-registry:7.2.0 with Aquasec Scanner, we are getting a few CVEs:

These CVE are associated with various Java based packages which have high vulnerabilities associated:  
CVE-2022-2048 http2-server 9.4.44.v20210927  
CVE-2021-22573 google-oauth-client 1.32.1

How are http2-server, google-oauth-client being used in cp-schema-registry.  
Would it be possible to update the packages in cp-schema-registry to fixed versions?

Thanks and Regards  
Brijesh