The Flink Kubernetes Operator is currently vulnerable to CVE-2025-48924.

This should be fixable by upgrading to the latest version (3.18 at time of writing) of the org.apache.commons:commons-lang3 dependency.

We need to open an issue in the upstream JIRA and then a PR against the Operator repo.