Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
3 vulnerabilities
CVE-2026-112072 (GCVE-0-2026-112072)
Vulnerability from cvelistv5 – Published: 2026-11-05 07:57 – Updated: 2026-11-05 19:05
VLAI
EPSS
VEX
Title
vault-java-driver: stored deeply nested JSON kills every thread that reads it
Summary
vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch (Exception) handlers and kills the reading thread. A Vault token that can write but not read a KV v2 path can store such a value there, so every later read of that path through the driver fails. This requires Vault 1.19.x or earlier, because 1.20 and later reject values nested deeper than 298 levels. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3 and is fixed in 7.0.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 16:41 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jopenlibs | vault-java-driver |
Affected:
5.2.0 , < 7.0.0
(maven)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112072",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T16:41:01.431970Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T19:05:34.149Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "io.github.jopenlibs:vault-java-driver",
"product": "vault-java-driver",
"programFiles": [
"src/main/java/io/github/jopenlibs/vault/json/JsonParser.java"
],
"repo": "https://github.com/jopenlibs/vault-java-driver",
"vendor": "jopenlibs",
"versions": [
{
"lessThan": "7.0.0",
"status": "affected",
"version": "5.2.0",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Saggie and Mor Wienberger (powered by Echo Frontier)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003evault-java-driver, a Java client for HashiCorp Vault, parses Vault\u0027s JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch (Exception) handlers and kills the reading thread. A Vault token that can write but not read a KV v2 path can store such a value there, so every later read of that path through the driver fails. This requires Vault 1.19.x or earlier, because 1.20 and later reject values nested deeper than 298 levels. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3 and is fixed in 7.0.0.\u003c/p\u003e"
}
],
"value": "vault-java-driver, a Java client for HashiCorp Vault, parses Vault\u0027s JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch (Exception) handlers and kills the reading thread. A Vault token that can write but not read a KV v2 path can store such a value there, so every later read of that path through the driver fails. This requires Vault 1.19.x or earlier, because 1.20 and later reject values nested deeper than 298 levels. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3 and is fixed in 7.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-230",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-230 Serialized Data with Nested Payloads"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T07:57:30.653Z",
"orgId": "abd028dc-c042-4c4d-9749-38d0f850af89",
"shortName": "Echo"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/jopenlibs/vault-java-driver/pull/81"
},
{
"tags": [
"patch"
],
"url": "https://repo.maven.apache.org/maven2/io/github/jopenlibs/vault-java-driver/7.0.0/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade io.github.jopenlibs:vault-java-driver to 7.0.0 or later.\u003c/p\u003e"
}
],
"value": "Upgrade io.github.jopenlibs:vault-java-driver to 7.0.0 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-10-05T15:05:00.000Z",
"value": "Reported to the maintainers"
},
{
"lang": "en",
"time": "2026-10-15T23:16:00.000Z",
"value": "Fix proposed in pull request #81"
}
],
"title": "vault-java-driver: stored deeply nested JSON kills every thread that reads it",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "abd028dc-c042-4c4d-9749-38d0f850af89",
"assignerShortName": "Echo",
"cveId": "CVE-2026-112072",
"datePublished": "2026-11-05T07:57:30.653Z",
"dateReserved": "2026-10-18T13:40:53.662Z",
"dateUpdated": "2026-11-05T19:05:34.149Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109408 (GCVE-0-2026-109408)
Vulnerability from cvelistv5 – Published: 2026-11-05 07:36 – Updated: 2026-11-05 19:05
VLAI
EPSS
VEX
Title
vault-java-driver: SslConfig silently disables requested TLS verification
Summary
vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than "true", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 16:40 UTC
CWE
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jopenlibs | vault-java-driver |
Affected:
5.2.0 , < 7.0.0
(maven)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109408",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T16:40:51.548101Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T19:05:53.450Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "io.github.jopenlibs:vault-java-driver",
"product": "vault-java-driver",
"programFiles": [
"src/main/java/io/github/jopenlibs/vault/SslConfig.java",
"src/main/java/io/github/jopenlibs/vault/rest/Rest.java"
],
"repo": "https://github.com/jopenlibs/vault-java-driver",
"vendor": "jopenlibs",
"versions": [
{
"lessThan": "7.0.0",
"status": "affected",
"version": "5.2.0",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Saggie and Mor Wienberger (powered by Echo Frontier)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003evault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than \"true\", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0.\u003c/p\u003e"
}
],
"value": "vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than \"true\", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-94",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-94 Adversary in the Middle (AiTM)"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-636",
"description": "CWE-636 Not Failing Securely (\u0027Failing Open\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-297",
"description": "CWE-297 Improper Validation of Certificate with Host Mismatch",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T07:36:07.410Z",
"orgId": "abd028dc-c042-4c4d-9749-38d0f850af89",
"shortName": "Echo"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/jopenlibs/vault-java-driver/pull/78"
},
{
"tags": [
"patch"
],
"url": "https://repo.maven.apache.org/maven2/io/github/jopenlibs/vault-java-driver/7.0.0/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade io.github.jopenlibs:vault-java-driver to 7.0.0 or later.\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "Upgrade io.github.jopenlibs:vault-java-driver to 7.0.0 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-10-05T14:00:00.000Z",
"value": "Reported to the maintainers"
},
{
"lang": "en",
"time": "2026-10-08T14:00:00.000Z",
"value": "Fix published as pull request #78"
}
],
"title": "vault-java-driver: SslConfig silently disables requested TLS verification",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "abd028dc-c042-4c4d-9749-38d0f850af89",
"assignerShortName": "Echo",
"cveId": "CVE-2026-109408",
"datePublished": "2026-11-05T07:36:07.410Z",
"dateReserved": "2026-10-12T14:55:10.201Z",
"dateUpdated": "2026-11-05T19:05:53.450Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7482 (GCVE-0-2026-7482)
Vulnerability from cvelistv5 – Published: 2026-05-04 12:38 – Updated: 2026-05-04 13:48 X_Unauthenticated X_Remote X_Information Disclosure
VLAI
EPSS
VEX
Title
Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers
Summary
Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/create endpoint accepts an attacker-supplied GGUF file in which the declared tensor offset and size exceed the file's actual length; during quantization in fs/ggml/gguf.go and server/quantization.go (WriteTo()), the server reads past the allocated heap buffer. The leaked memory contents may include environment variables, API keys, system prompts, and concurrent users' conversation data, and can be exfiltrated by uploading the resulting model artifact through the /api/push endpoint to an attacker-controlled registry. The /api/create and /api/push endpoints have no authentication in the upstream distribution. Default deployments bind to 127.0.0.1, but the documented OLLAMA_HOST=0.0.0.0 configuration is widely used in practice (large public-internet exposure observed).
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-04 13:48 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/ollama/ollama/pull/14406 | patch |
| https://github.com/ollama/ollama/commit/88d57d048… | patch |
| https://github.com/ollama/ollama/releases/tag/v0.17.1 | release-notes |
Date Public
2026-02-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7482",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-04T13:48:32.181054Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-04T13:48:39.686Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageName": "ollama/ollama",
"product": "ollama",
"programFiles": [
"fs/ggml/gguf.go",
"server/quantization.go"
],
"repo": "https://github.com/ollama/ollama",
"vendor": "ollama",
"versions": [
{
"lessThan": "0.17.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Cyera Research Team (Dor Attias, Ofek Itach)"
}
],
"datePublic": "2026-02-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOllama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/create endpoint accepts an attacker-supplied GGUF file in which the declared tensor offset and size exceed the file\u0027s actual length; during quantization in fs/ggml/gguf.go and server/quantization.go (WriteTo()), the server reads past the allocated heap buffer. The leaked memory contents may include environment variables, API keys, system prompts, and concurrent users\u0027 conversation data, and can be exfiltrated by uploading the resulting model artifact through the /api/push endpoint to an attacker-controlled registry. The /api/create and /api/push endpoints have no authentication in the upstream distribution. Default deployments bind to 127.0.0.1, but the documented OLLAMA_HOST=0.0.0.0 configuration is widely used in practice (large public-internet exposure observed).\u003c/p\u003e"
}
],
"value": "Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/create endpoint accepts an attacker-supplied GGUF file in which the declared tensor offset and size exceed the file\u0027s actual length; during quantization in fs/ggml/gguf.go and server/quantization.go (WriteTo()), the server reads past the allocated heap buffer. The leaked memory contents may include environment variables, API keys, system prompts, and concurrent users\u0027 conversation data, and can be exfiltrated by uploading the resulting model artifact through the /api/push endpoint to an attacker-controlled registry. The /api/create and /api/push endpoints have no authentication in the upstream distribution. Default deployments bind to 127.0.0.1, but the documented OLLAMA_HOST=0.0.0.0 configuration is widely used in practice (large public-internet exposure observed)."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "AUTOMATIC",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:A/V:D/RE:L/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-04T12:38:28.464Z",
"orgId": "abd028dc-c042-4c4d-9749-38d0f850af89",
"shortName": "Echo"
},
"references": [
{
"name": "ollama/ollama PR #14406 \u2014 ggml: ensure tensor size is valid (fix)",
"tags": [
"patch"
],
"url": "https://github.com/ollama/ollama/pull/14406"
},
{
"name": "Fix commit 88d57d0",
"tags": [
"patch"
],
"url": "https://github.com/ollama/ollama/commit/88d57d0483cca907e0b23a968c83627a20b21047"
},
{
"name": "ollama v0.17.1 release notes",
"tags": [
"release-notes"
],
"url": "https://github.com/ollama/ollama/releases/tag/v0.17.1"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to ollama 0.17.1 or later. The fix in PR #14406 validates that declared tensor offset+size do not exceed the GGUF file size before reading, and adds a length check in the quantizer prior to the unsafe read.\u003c/p\u003e"
}
],
"value": "Upgrade to ollama 0.17.1 or later. The fix in PR #14406 validates that declared tensor offset+size do not exceed the GGUF file size before reading, and adds a length check in the quantizer prior to the unsafe read."
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_unauthenticated",
"x_remote",
"x_information-disclosure"
],
"title": "Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUntil upgrade is possible: (1) ensure Ollama is bound to a trusted interface only (default OLLAMA_HOST=127.0.0.1); (2) front Ollama with a reverse proxy that requires authentication on /api/create and /api/push; (3) restrict outbound network egress from the Ollama host to prevent exfiltration via /api/push to attacker-controlled registries.\u003c/p\u003e"
}
],
"value": "Until upgrade is possible: (1) ensure Ollama is bound to a trusted interface only (default OLLAMA_HOST=127.0.0.1); (2) front Ollama with a reverse proxy that requires authentication on /api/create and /api/push; (3) restrict outbound network egress from the Ollama host to prevent exfiltration via /api/push to attacker-controlled registries."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "abd028dc-c042-4c4d-9749-38d0f850af89",
"assignerShortName": "Echo",
"cveId": "CVE-2026-7482",
"datePublished": "2026-05-04T12:38:28.464Z",
"dateReserved": "2026-04-30T06:03:40.622Z",
"dateUpdated": "2026-05-04T13:48:39.686Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}