Vulnerability-Lookup

RHSA-2026:99018

Vulnerability from csaf_redhat - Published: 2026-11-11 15:58 - Updated: 2026-11-13 00:04

Summary

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 security update

Severity

Important

Notes

Topic: A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This asynchronous patch is an update for Red Hat JBoss Enterprise Application Platform 8.1. See Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): * bcjmail-jdk18on: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement in CMS AuthEnvelopedData decryption. [eap-8.1.z] (CVE-2026-12802) * bcpg-jdk18on: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement in CMS AuthEnvelopedData decryption. [eap-8.1.z] (CVE-2026-12802) * bcutil-jdk18on: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement in CMS AuthEnvelopedData decryption. [eap-8.1.z] (CVE-2026-12802) * bcpkix-jdk18on: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement in CMS AuthEnvelopedData decryption. [eap-8.1.z] (CVE-2026-12802) * bcjmail-jdk18on: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [eap-8.1.z] (CVE-2026-59645) * bcpg-jdk18on: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [eap-8.1.z] (CVE-2026-59645) * bcutil-jdk18on: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [eap-8.1.z] (CVE-2026-59645) * bcpkix-jdk18on: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [eap-8.1.z] (CVE-2026-59645) * bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [eap-8.1.z] (CVE-2026-59645) * bcprov-jdk18on: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement in CMS AuthEnvelopedData decryption. [eap-8.1.z] (CVE-2026-12802) * bcjmail-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass [eap-8.1.z] (CVE-2026-59639) * bcpg-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass [eap-8.1.z] (CVE-2026-59639) * bcpkix-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass [eap-8.1.z] (CVE-2026-59639) * bcprov-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass [eap-8.1.z] (CVE-2026-59639) * bcjmail-jdk18on: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in CMS AuthenticatedData [eap-8.1.z] (CVE-2026-59642) * bcpg-jdk18on: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in CMS AuthenticatedData [eap-8.1.z] (CVE-2026-59642) * bcutil-jdk18on: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in CMS AuthenticatedData [eap-8.1.z] (CVE-2026-59642) * bcpkix-jdk18on: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in CMS AuthenticatedData [eap-8.1.z] (CVE-2026-59642) * bcprov-jdk18on: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in CMS AuthenticatedData [eap-8.1.z] (CVE-2026-59642) * bcjmail-jdk18on: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count [eap-8.1.z] (CVE-2026-58060) * bcpg-jdk18on: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count [eap-8.1.z] (CVE-2026-58060) * bcutil-jdk18on: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count [eap-8.1.z] (CVE-2026-58060) * bcpkix-jdk18on: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count [eap-8.1.z] (CVE-2026-58060) * bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count [eap-8.1.z] (CVE-2026-58060) * bcpg-jdk18on: Bouncy Castle for Java: Integrity bypass in CCM-family modes [eap-8.1.z] (CVE-2026-58061) * bcprov-jdk18on: Bouncy Castle for Java: Integrity bypass in CCM-family modes [eap-8.1.z] (CVE-2026-58061) * sshd-core: Apache MINA SSHD: Asynchronous authentication can bypass signature verification [eap-8.1.z] (CVE-2026-77185) * jackson-core: jackson-core: Denial of Service via excessively long JSON property names [eap-8.1.z] (CVE-2026-68498) * bcutil-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks [eap-8.1.z] (CVE-2026-71889) * bcjmail-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks [eap-8.1.z] (CVE-2026-71889) * bcpg-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks [eap-8.1.z] (CVE-2026-71889) * bcprov-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks [eap-8.1.z] (CVE-2026-71889) * bcpkix-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks [eap-8.1.z] (CVE-2026-71889) * jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing [eap-8.1.z] (CVE-2026-89425) * jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion [eap-8.1.z] (CVE-2026-91777) * bcpg-jdk18on: Bouncy Castle: Signature misattribution via missing subkey cross-certification validation [eap-8.1.z] (CVE-2026-71887) * sshd-core: Apache MINA SSHD: Authentication bypass via duplicate public key presentation [eap-8.1.z] (CVE-2026-93994) * xmlschema-core: Apache XMLSchema: Denial of Service (DoS) via deeply nested schema structures [eap-8.1.z] (CVE-2026-102496) * xmlschema-core: Apache XMLSchema: Denial of Service via unbounded recursion during schema parsing [eap-8.1.z] (CVE-2026-102495) * jackson-core: Jackson-core: Denial of Service via regular expression backtracking [eap-8.1.z] (CVE-2026-89407) * neethi: Neethi: Denial of Service via crafted WS-Policy documents [eap-8.1.z] (CVE-2026-91866) * neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents [eap-8.1.z] (CVE-2026-91865) * neethi: Apache Neethi: Denial of Service via uncontrolled recursion in WS-Policy document parsing [eap-8.1.z] (CVE-2026-91863) * neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents [eap-8.1.z] (CVE-2026-91864) * wildfly-server: wildfly: RBAC bypass in WildFly deployment-operation handlers leads to privilege escalation [eap-8.1.z] (CVE-2026-12977) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-12802

A flaw was found in Bouncy Castle for Java. This vulnerability allows a remote attacker to compromise the integrity of data during the decryption of Cryptographic Message Syntax (CMS) AuthEnvelopedData. The software fails to properly enforce the tag-length, which could enable an attacker to manipulate encrypted data without detection.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-347 - Improper Verification of Cryptographic Signature

Affected products

Fixed 149 products

Product	Version	Remediation
Unresolved product id: 10Base-JBEAP-8.1:eap8-apache-sshd-0:2.20.0-1.redhat_00002.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-apache-sshd-0:2.20.0-1.redhat_00002.1.el10eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-bouncycastle-0:1.86.0-1.redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-bouncycastle-0:1.86.0-1.redhat_00001.1.el10eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-bouncycastle-jmail-0:1.86.0-1.redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-bouncycastle-pg-0:1.86.0-1.redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-bouncycastle-pkix-0:1.86.0-1.redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-bouncycastle-prov-0:1.86.0-1.redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-bouncycastle-util-0:1.86.0-1.redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-eap-product-conf-parent-0:801.9.1-1.GA_redhat_00002.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-eap-product-conf-parent-0:801.9.1-1.GA_redhat_00002.1.el10eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-eap-product-conf-wildfly-ee-feature-pack-0:801.9.1-1.GA_redhat_00002.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-ironjacamar-0:3.1.1-1.Final_redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-ironjacamar-0:3.1.1-1.Final_redhat_00001.1.el10eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-ironjacamar-common-api-0:3.1.1-1.Final_redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-ironjacamar-common-impl-0:3.1.1-1.Final_redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-ironjacamar-common-spi-0:3.1.1-1.Final_redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-ironjacamar-core-api-0:3.1.1-1.Final_redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-ironjacamar-core-impl-0:3.1.1-1.Final_redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-ironjacamar-deployers-common-0:3.1.1-1.Final_redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-ironjacamar-jdbc-0:3.1.1-1.Final_redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-ironjacamar-validator-0:3.1.1-1.Final_redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-jackson-datatype-jdk8-0:2.18.11-1.redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-jackson-datatype-jsr310-0:2.18.11-1.redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-jackson-jaxrs-base-0:2.18.11-1.redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-jackson-jaxrs-json-provider-0:2.18.11-1.redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-jackson-jaxrs-providers-0:2.18.11-1.redhat_00001.1.el10eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-jackson-module-jakarta-xmlbind-annotations-0:2.18.11-1.redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-jackson-modules-base-0:2.18.11-1.redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-jackson-modules-base-0:2.18.11-1.redhat_00001.1.el10eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-jackson-modules-java8-0:2.18.11-1.redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-jackson-modules-java8-0:2.18.11-1.redhat_00001.1.el10eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-neethi-0:3.2.4-1.redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-neethi-0:3.2.4-1.redhat_00001.1.el10eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-wildfly-0:8.1.9.1-1.GA_redhat_00006.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-wildfly-0:8.1.9.1-1.GA_redhat_00006.1.el10eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-wildfly-http-client-0:2.1.5-1.Final_redhat_00001.1.el10eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-wildfly-http-client-common-0:2.1.5-1.Final_redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-wildfly-http-ejb-client-0:2.1.5-1.Final_redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-wildfly-http-naming-client-0:2.1.5-1.Final_redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-wildfly-http-transaction-client-0:2.1.5-1.Final_redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-wildfly-java-jdk21-0:8.1.9.1-1.GA_redhat_00006.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-wildfly-javadocs-0:8.1.1-15.GA_redhat_00052.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-wildfly-javadocs-0:8.1.1-15.GA_redhat_00052.1.el10eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-wildfly-modules-0:8.1.9.1-1.GA_redhat_00006.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-ws-commons-XmlSchema-0:2.3.3-1.redhat_00001.1.el10eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 10Base-JBEAP-8.1:eap8-ws-commons-XmlSchema-0:2.3.3-1.redhat_00001.1.el10eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-apache-sshd-0:2.20.0-1.redhat_00002.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-apache-sshd-0:2.20.0-1.redhat_00002.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-bouncycastle-0:1.86.0-1.redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-bouncycastle-0:1.86.0-1.redhat_00001.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-bouncycastle-jmail-0:1.86.0-1.redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-bouncycastle-pg-0:1.86.0-1.redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-bouncycastle-pkix-0:1.86.0-1.redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-bouncycastle-prov-0:1.86.0-1.redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-bouncycastle-util-0:1.86.0-1.redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-eap-product-conf-parent-0:801.9.1-1.GA_redhat_00002.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-eap-product-conf-parent-0:801.9.1-1.GA_redhat_00002.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-eap-product-conf-wildfly-ee-feature-pack-0:801.9.1-1.GA_redhat_00002.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-ironjacamar-0:3.1.1-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-ironjacamar-0:3.1.1-1.Final_redhat_00001.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-ironjacamar-common-api-0:3.1.1-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-ironjacamar-common-impl-0:3.1.1-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-ironjacamar-common-spi-0:3.1.1-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-ironjacamar-core-api-0:3.1.1-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-ironjacamar-core-impl-0:3.1.1-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-ironjacamar-deployers-common-0:3.1.1-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-ironjacamar-jdbc-0:3.1.1-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-ironjacamar-validator-0:3.1.1-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-jackson-datatype-jdk8-0:2.18.11-1.redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-jackson-datatype-jsr310-0:2.18.11-1.redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-jackson-jaxrs-base-0:2.18.11-1.redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-jackson-jaxrs-json-provider-0:2.18.11-1.redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-jackson-jaxrs-providers-0:2.18.11-1.redhat_00001.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-jackson-module-jakarta-xmlbind-annotations-0:2.18.11-1.redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-jackson-modules-base-0:2.18.11-1.redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-jackson-modules-base-0:2.18.11-1.redhat_00001.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-jackson-modules-java8-0:2.18.11-1.redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-jackson-modules-java8-0:2.18.11-1.redhat_00001.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-neethi-0:3.2.4-1.redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-neethi-0:3.2.4-1.redhat_00001.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-wildfly-0:8.1.9.1-1.GA_redhat_00006.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-wildfly-0:8.1.9.1-1.GA_redhat_00006.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-wildfly-http-client-0:2.1.5-1.Final_redhat_00001.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-wildfly-http-client-common-0:2.1.5-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-wildfly-http-ejb-client-0:2.1.5-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-wildfly-http-naming-client-0:2.1.5-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-wildfly-http-transaction-client-0:2.1.5-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-wildfly-java-jdk17-0:8.1.9.1-1.GA_redhat_00006.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-wildfly-java-jdk21-0:8.1.9.1-1.GA_redhat_00006.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-wildfly-javadocs-0:8.1.1-15.GA_redhat_00052.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-wildfly-javadocs-0:8.1.1-15.GA_redhat_00052.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-wildfly-modules-0:8.1.9.1-1.GA_redhat_00006.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-ws-commons-XmlSchema-0:2.3.3-1.redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-8.1:eap8-ws-commons-XmlSchema-0:2.3.3-1.redhat_00001.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-apache-sshd-0:2.20.0-1.redhat_00002.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-apache-sshd-0:2.20.0-1.redhat_00002.1.el9eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-bouncycastle-0:1.86.0-1.redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-bouncycastle-0:1.86.0-1.redhat_00001.1.el9eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-bouncycastle-jmail-0:1.86.0-1.redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-bouncycastle-pg-0:1.86.0-1.redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-bouncycastle-pkix-0:1.86.0-1.redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-bouncycastle-prov-0:1.86.0-1.redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-bouncycastle-util-0:1.86.0-1.redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-eap-product-conf-parent-0:801.9.1-1.GA_redhat_00002.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-eap-product-conf-parent-0:801.9.1-1.GA_redhat_00002.1.el9eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-eap-product-conf-wildfly-ee-feature-pack-0:801.9.1-1.GA_redhat_00002.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-ironjacamar-0:3.1.1-1.Final_redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-ironjacamar-0:3.1.1-1.Final_redhat_00001.1.el9eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-ironjacamar-common-api-0:3.1.1-1.Final_redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-ironjacamar-common-impl-0:3.1.1-1.Final_redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-ironjacamar-common-spi-0:3.1.1-1.Final_redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-ironjacamar-core-api-0:3.1.1-1.Final_redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-ironjacamar-core-impl-0:3.1.1-1.Final_redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-ironjacamar-deployers-common-0:3.1.1-1.Final_redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-ironjacamar-jdbc-0:3.1.1-1.Final_redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-ironjacamar-validator-0:3.1.1-1.Final_redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-jackson-datatype-jdk8-0:2.18.11-1.redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-jackson-datatype-jsr310-0:2.18.11-1.redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-jackson-jaxrs-base-0:2.18.11-1.redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-jackson-jaxrs-json-provider-0:2.18.11-1.redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-jackson-jaxrs-providers-0:2.18.11-1.redhat_00001.1.el9eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-jackson-module-jakarta-xmlbind-annotations-0:2.18.11-1.redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-jackson-modules-base-0:2.18.11-1.redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-jackson-modules-base-0:2.18.11-1.redhat_00001.1.el9eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-jackson-modules-java8-0:2.18.11-1.redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-jackson-modules-java8-0:2.18.11-1.redhat_00001.1.el9eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-neethi-0:3.2.4-1.redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-neethi-0:3.2.4-1.redhat_00001.1.el9eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-wildfly-0:8.1.9.1-1.GA_redhat_00006.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-wildfly-0:8.1.9.1-1.GA_redhat_00006.1.el9eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-wildfly-http-client-0:2.1.5-1.Final_redhat_00001.1.el9eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-wildfly-http-client-common-0:2.1.5-1.Final_redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-wildfly-http-ejb-client-0:2.1.5-1.Final_redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-wildfly-http-naming-client-0:2.1.5-1.Final_redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-wildfly-http-transaction-client-0:2.1.5-1.Final_redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-wildfly-java-jdk17-0:8.1.9.1-1.GA_redhat_00006.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-wildfly-java-jdk21-0:8.1.9.1-1.GA_redhat_00006.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-wildfly-javadocs-0:8.1.1-15.GA_redhat_00052.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-wildfly-javadocs-0:8.1.1-15.GA_redhat_00052.1.el9eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-wildfly-modules-0:8.1.9.1-1.GA_redhat_00006.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-ws-commons-XmlSchema-0:2.3.3-1.redhat_00001.1.el9eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-JBEAP-8.1:eap8-ws-commons-XmlSchema-0:2.3.3-1.redhat_00001.1.el9eap.src	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-12977

A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive configuration files. This can lead to the exfiltration of credentials and full administrative control (SuperUser) of the server.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-267 - Privilege Defined With Unsafe Actions

Affected products

Fixed 149 products, the same list as for CVE-2026-12802

Threats

Impact Important

CVE-2026-58060

A flaw was found in Bouncy Castle for Java. A remote attacker could exploit a vulnerability where the HSS public-key level count is unbounded. This allows for a huge memory allocation during the verification process, leading to a denial of service (DoS) condition. This issue affects Bouncy Castle for Java, Bouncy Castle for Java LTS, and Bouncy Castle for Java FIPS (BC-FJA).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 149 products, the same list as for CVE-2026-12802

Threats

Impact Important

CVE-2026-58061

A flaw was found in Bouncy Castle for Java. When using CCM-family (Counter with CBC-MAC) modes, the software writes plaintext data into a buffer before verifying the cryptographic tag. This could allow an attacker to manipulate data that is later assumed to be authentic, leading to a high integrity impact if the plaintext is processed before the tag validation completes.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-347 - Improper Verification of Cryptographic Signature

Affected products

Fixed 149 products, the same list as for CVE-2026-12802

Threats

Impact Important

CVE-2026-59639

A flaw was found in Bouncy Castle for Java. The library's Cryptographic Message Syntax (CMS) component, which handles digital signature verification, incorrectly validates data that has no signers. This means that even if data is not digitally signed, the system might still consider it legitimate. This could allow an attacker to bypass critical security checks and potentially introduce unauthorized or malicious content.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-347 - Improper Verification of Cryptographic Signature

Affected products

Fixed 149 products, the same list as for CVE-2026-12802

Threats

Impact Important

CVE-2026-59642

A flaw was found in Bouncy Castle for Java. This vulnerability allows a remote attacker to bypass cryptographic integrity checks in the Cryptographic Message Syntax (CMS) AuthenticatedData content without requiring user interaction or elevated privileges. Specifically, when authentication attributes (authAttrs) are present, the content is not properly bound to the Message Authentication Code (MAC). This could lead to a high impact on data integrity, where an attacker might be able to alter authenticated data without detection.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-354 - Improper Validation of Integrity Check Value

Affected products

Fixed 149 products, the same list as for CVE-2026-12802

Threats

Impact Important

CVE-2026-59645

A flaw was found in Bouncy Castle for Java. A remote attacker could exploit this vulnerability by providing a specially crafted self-referential IEEE 1609.2 schema to the OER (Octet Encoding Rules) parser. This can cause the parser to recurse without a depth limit, leading to resource exhaustion and a denial of service (DoS) for the affected system.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-835 - Loop with Unreachable Exit Condition

Affected products

Fixed 149 products, the same list as for CVE-2026-12802

Threats

Impact Important

CVE-2026-68498

A flaw was found in jackson-core. When parsing JSON data from character-based inputs, the parser does not enforce configured property name length limits while reading object keys into memory. A remote, unauthenticated attacker can exploit this flaw by submitting a crafted JSON payload containing an excessively long property name. Processing such input can exhaust system memory, causing the application to crash and resulting in a Denial of Service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 149 products, the same list as for CVE-2026-12802

Threats

Impact Important

CVE-2026-71887

A flaw was found in Bouncy Castle. The high-level OpenPGP (Pretty Good Privacy) API fails to properly enforce cross-certification requirements when validating subkeys that omit key capability flags. A remote attacker can exploit this flaw by binding a victim's public signing key to an attacker-controlled primary key, causing verifiers to mistakenly attribute genuinely signed messages to the attacker.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-295 - Improper Certificate Validation

Affected products

Fixed 149 products, the same list as for CVE-2026-12802

Threats

Impact Important

CVE-2026-71889

A flaw was found in Bouncy Castle. The certificate path reviewer (PKIXCertPathReviewer) fails to enforce name constraints on the end-entity certificate during validation. A remote attacker can exploit this issue by presenting a certificate that violates domain restrictions imposed by an issuing Certificate Authority (CA). Applications that rely on the reviewer to determine trust may incorrectly accept unauthorized certificates as valid.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-295 - Improper Certificate Validation

Affected products

Fixed 149 products, the same list as for CVE-2026-12802

Threats

Impact Important

CVE-2026-77185

A flaw was found in Apache MINA SSHD. When a Secure Shell (SSH) server implements the asynchronous authentication feature, a logic error in signature verification can result in public-key or host-based authentication checks being skipped. A remote, unauthenticated attacker can exploit this flaw to bypass authentication and gain unauthorized access to the server.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-287 - Improper Authentication

Affected products

Fixed 149 products, the same list as for CVE-2026-12802

Threats

Impact Important

CVE-2026-89407

A flaw was found in jackson-core. An attacker can supply specially crafted JSON that, when deserialized into a numeric target type, triggers a Regular expression Denial of Service (ReDoS) vulnerability. This occurs due to quadratic backtracking in the NumberInput.looksLikeValidNumber() method's PATTERN_FLOAT regular expression. A small number of concurrent requests with a long input string can exhaust a server's request-handling thread pool, leading to a Denial of Service (DoS).

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1333 - Inefficient Regular Expression Complexity

Affected products

Fixed 149 products, the same list as for CVE-2026-12802

Threats

Impact Moderate

CVE-2026-89425

A flaw was found in FasterXML jackson-core. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted, malformed token to the JsonFactory.createParser(DataInput) method. The UTF8DataInputJsonParser component, responsible for handling DataInput sources, does not properly limit the size of the error message generated for invalid tokens. This unbounded growth of the StringBuilder can consume excessive memory, leading to an OutOfMemoryError and crashing the Java Virtual Machine (JVM).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1050 - Excessive Platform Resource Consumption within a Loop

Affected products

Fixed 149 products, the same list as for CVE-2026-12802

Threats

Impact Important

CVE-2026-91777

A flaw was found in FasterXML jackson-databind. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing specially crafted JSON input to an application that deserializes it into an identity-enabled collection or map. The flaw occurs due to inefficient processing of forward-references, where the system performs a quadratic amount of work for linearly growing input, leading to excessive CPU consumption.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-606 - Unchecked Input for Loop Condition

Affected products

Fixed 149 products, the same list as for CVE-2026-12802

Threats

Impact Important

CVE-2026-91863

A flaw was found in Apache Neethi. A remote attacker could exploit this vulnerability by sending a specially crafted WS-Policy document containing deeply nested policy elements. This crafted document can bypass the parser's nesting-depth limit, leading to uncontrolled recursion that exhausts the thread stack. Successful exploitation results in a denial of service, causing the parser to crash.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-835 - Loop with Unreachable Exit Condition

Affected products

Fixed 149 products, the same list as for CVE-2026-12802

Threats

Impact Important

CVE-2026-91864

A flaw was found in Apache Neethi. A remote attacker could exploit this vulnerability by sending a specially crafted WS-Policy document. This document can contain unlimited content within a policy assertion, which Neethi processes without proper size limits. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 149 products, the same list as for CVE-2026-12802

Threats

Impact Important

CVE-2026-91865

A flaw was found in Apache Neethi. A remote attacker could exploit this vulnerability by providing a specially crafted WS-Policy document containing repeated policy references. This document would force Neethi to exponentially re-expand the same references during normalization, consuming excessive CPU and memory resources. This can lead to a denial of service (DoS), making the affected system unavailable to legitimate users.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-776 - Improper Restriction of Recursive Entity References in DTDs

Affected products

Fixed 149 products, the same list as for CVE-2026-12802

Threats

Impact Important

CVE-2026-91866

A flaw was found in Neethi. A remote attacker could exploit this vulnerability by providing specially crafted WS-Policy documents. This could force Neethi's policy-intersection to perform an exponential amount of work, leading to a denial of service (DoS) by consuming excessive CPU resources.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1333 - Inefficient Regular Expression Complexity

Affected products

Fixed 149 products, the same list as for CVE-2026-12802

Threats

Impact Important

CVE-2026-93994

A flaw was found in Apache MINA SSHD. When the server is configured to require multiple Secure Shell (SSH) public keys for authentication, it fails to verify that the submitted keys are distinct. A remote user can exploit this flaw by presenting the same public key twice to satisfy multi-key authentication requirements. This flaw results in an authentication bypass, allowing an attacker to gain unauthorized access using fewer credentials than mandated by the security policy.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE-303 - Incorrect Implementation of Authentication Algorithm

Affected products

Fixed 149 products, the same list as for CVE-2026-12802

Threats

Impact Important

CVE-2026-102495

A flaw was found in Apache XMLSchema. The parser does not properly restrict how deeply schema imports and includes can be nested during processing. A remote attacker could provide a crafted schema with deeply nested references, triggering unbounded recursion that exhausts the call stack. This flaw leads to an application crash, resulting in a Denial of Service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 149 products, the same list as for CVE-2026-12802

Threats

Impact Important

CVE-2026-102496

A flaw was found in Apache XMLSchema. When constructing its schema model, the parser does not restrict how deeply schema structures can be nested. A remote attacker could exploit this vulnerability by providing a crafted XML schema containing deeply nested elements, triggering uncontrolled recursion and a stack overflow that crashes the application, resulting in a Denial of Service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 149 products, the same list as for CVE-2026-12802

Threats

Impact Important

References

162 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:99018	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2491669	external
https://bugzilla.redhat.com/show_bug.cgi?id=2510189	external
https://bugzilla.redhat.com/show_bug.cgi?id=2510197	external
https://bugzilla.redhat.com/show_bug.cgi?id=2510204	external
https://bugzilla.redhat.com/show_bug.cgi?id=2510224	external
https://bugzilla.redhat.com/show_bug.cgi?id=2510243	external
https://bugzilla.redhat.com/show_bug.cgi?id=2510254	external
https://bugzilla.redhat.com/show_bug.cgi?id=2538243	external
https://bugzilla.redhat.com/show_bug.cgi?id=2538446	external
https://bugzilla.redhat.com/show_bug.cgi?id=2538720	external
https://bugzilla.redhat.com/show_bug.cgi?id=2538975	external
https://bugzilla.redhat.com/show_bug.cgi?id=2539034	external
https://bugzilla.redhat.com/show_bug.cgi?id=2539084	external
https://bugzilla.redhat.com/show_bug.cgi?id=2539085	external
https://bugzilla.redhat.com/show_bug.cgi?id=2543083	external
https://bugzilla.redhat.com/show_bug.cgi?id=2543086	external
https://bugzilla.redhat.com/show_bug.cgi?id=2543860	external
https://bugzilla.redhat.com/show_bug.cgi?id=2543862	external
https://bugzilla.redhat.com/show_bug.cgi?id=2545496	external
https://bugzilla.redhat.com/show_bug.cgi?id=2545497	external
https://bugzilla.redhat.com/show_bug.cgi?id=2554486	external
https://issues.redhat.com/browse/JBEAP-35049	external
https://issues.redhat.com/browse/JBEAP-35159	external
https://issues.redhat.com/browse/JBEAP-35166	external
https://issues.redhat.com/browse/JBEAP-35262	external
https://issues.redhat.com/browse/JBEAP-35293	external
https://issues.redhat.com/browse/JBEAP-35309	external
https://issues.redhat.com/browse/JBEAP-35632	external
https://issues.redhat.com/browse/JBEAP-35651	external
https://issues.redhat.com/browse/JBEAP-35795	external
https://issues.redhat.com/browse/JBEAP-36001	external
https://issues.redhat.com/browse/JBEAP-36088	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-12802	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510254	external
https://www.cve.org/CVERecord?id=CVE-2026-12802	external
https://nvd.nist.gov/vuln/detail/CVE-2026-12802	external
https://github.com/bcgit/bc-java/commit/0fefa539e…	external
https://github.com/bcgit/bc-java/wiki/CVE-2026-12802	external
https://access.redhat.com/security/cve/CVE-2026-12977	self
https://bugzilla.redhat.com/show_bug.cgi?id=2491669	external
https://www.cve.org/CVERecord?id=CVE-2026-12977	external
https://nvd.nist.gov/vuln/detail/CVE-2026-12977	external
https://access.redhat.com/security/cve/CVE-2026-58060	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510243	external
https://www.cve.org/CVERecord?id=CVE-2026-58060	external
https://nvd.nist.gov/vuln/detail/CVE-2026-58060	external
https://github.com/bcgit/bc-java/commit/311cabbb6…	external
https://github.com/bcgit/bc-java/commit/6c9f30b3f…	external
https://github.com/bcgit/bc-java/wiki/CVE-2026-58060	external
https://access.redhat.com/security/cve/CVE-2026-58061	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510224	external
https://www.cve.org/CVERecord?id=CVE-2026-58061	external
https://nvd.nist.gov/vuln/detail/CVE-2026-58061	external
https://github.com/bcgit/bc-java/commit/08d675106…	external
https://github.com/bcgit/bc-java/commit/cd4a5ab3a…	external
https://github.com/bcgit/bc-java/wiki/CVE-2026-58061	external
https://access.redhat.com/security/cve/CVE-2026-59639	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510197	external
https://www.cve.org/CVERecord?id=CVE-2026-59639	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59639	external
https://github.com/bcgit/bc-java/commit/99ddc6dcc…	external
https://github.com/bcgit/bc-java/wiki/CVE-2026-59639	external
https://access.redhat.com/security/cve/CVE-2026-59642	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510204	external
https://www.cve.org/CVERecord?id=CVE-2026-59642	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59642	external
https://github.com/bcgit/bc-java/commit/2117f316a…	external
https://github.com/bcgit/bc-java/wiki/CVE-2026-59642	external
https://access.redhat.com/security/cve/CVE-2026-59645	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510189	external
https://www.cve.org/CVERecord?id=CVE-2026-59645	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59645	external
https://github.com/bcgit/bc-java/commit/822b2478b…	external
https://github.com/bcgit/bc-java/wiki/CVE-2026-59645	external
https://access.redhat.com/security/cve/CVE-2026-68498	self
https://bugzilla.redhat.com/show_bug.cgi?id=2554486	external
https://www.cve.org/CVERecord?id=CVE-2026-68498	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68498	external
https://github.com/FasterXML/jackson-core/blob/2.…	external
https://github.com/FasterXML/jackson-core/blob/3.…	external
https://github.com/FasterXML/jackson-core/commit/…	external
https://github.com/FasterXML/jackson-core/pull/1643	external
https://github.com/FasterXML/jackson-core/securit…	external
https://access.redhat.com/security/cve/CVE-2026-71887	self
https://bugzilla.redhat.com/show_bug.cgi?id=2545496	external
https://www.cve.org/CVERecord?id=CVE-2026-71887	external
https://nvd.nist.gov/vuln/detail/CVE-2026-71887	external
https://github.com/bcgit/bc-java/commit/b51452fa4…	external
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	external
https://access.redhat.com/security/cve/CVE-2026-71889	self
https://bugzilla.redhat.com/show_bug.cgi?id=2545497	external
https://www.cve.org/CVERecord?id=CVE-2026-71889	external
https://nvd.nist.gov/vuln/detail/CVE-2026-71889	external
https://github.com/bcgit/bc-java/commit/06dcff2f5…	external
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	external
https://access.redhat.com/security/cve/CVE-2026-77185	self
https://bugzilla.redhat.com/show_bug.cgi?id=2543860	external
https://www.cve.org/CVERecord?id=CVE-2026-77185	external
https://nvd.nist.gov/vuln/detail/CVE-2026-77185	external
https://lists.apache.org/thread.html/t8pn812yq8nd…	external
https://access.redhat.com/security/cve/CVE-2026-89407	self
https://bugzilla.redhat.com/show_bug.cgi?id=2538720	external
https://www.cve.org/CVERecord?id=CVE-2026-89407	external
https://nvd.nist.gov/vuln/detail/CVE-2026-89407	external
https://github.com/FasterXML/jackson-core/issues/1649	external
https://github.com/FasterXML/jackson-core/pull/1650	external
https://github.com/FasterXML/jackson-core/pull/1701	external
https://github.com/FasterXML/jackson-core/securit…	external
https://access.redhat.com/security/cve/CVE-2026-89425	self
https://bugzilla.redhat.com/show_bug.cgi?id=2539084	external
https://www.cve.org/CVERecord?id=CVE-2026-89425	external
https://nvd.nist.gov/vuln/detail/CVE-2026-89425	external
https://github.com/FasterXML/jackson-core/pull/1698	external
https://github.com/FasterXML/jackson-core/securit…	external
https://access.redhat.com/security/cve/CVE-2026-91777	self
https://bugzilla.redhat.com/show_bug.cgi?id=2539085	external
https://www.cve.org/CVERecord?id=CVE-2026-91777	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91777	external
https://github.com/FasterXML/jackson-databind/iss…	external
https://github.com/FasterXML/jackson-databind/sec…	external
https://access.redhat.com/security/cve/CVE-2026-91863	self
https://bugzilla.redhat.com/show_bug.cgi?id=2538446	external
https://www.cve.org/CVERecord?id=CVE-2026-91863	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91863	external
http://www.openwall.com/lists/oss-security/2026/0…	external
https://lists.apache.org/thread/72kxj71lvrqqx90xx…	external
https://access.redhat.com/security/cve/CVE-2026-91864	self
https://bugzilla.redhat.com/show_bug.cgi?id=2539034	external
https://www.cve.org/CVERecord?id=CVE-2026-91864	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91864	external
http://www.openwall.com/lists/oss-security/2026/0…	external
https://lists.apache.org/thread/400kbynbyhqhsjkv1…	external
https://access.redhat.com/security/cve/CVE-2026-91865	self
https://bugzilla.redhat.com/show_bug.cgi?id=2538975	external
https://www.cve.org/CVERecord?id=CVE-2026-91865	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91865	external
http://www.openwall.com/lists/oss-security/2026/0…	external
https://lists.apache.org/thread/l48btqh02rlpsgf5p…	external
https://access.redhat.com/security/cve/CVE-2026-91866	self
https://bugzilla.redhat.com/show_bug.cgi?id=2538243	external
https://www.cve.org/CVERecord?id=CVE-2026-91866	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91866	external
http://www.openwall.com/lists/oss-security/2026/0…	external
https://lists.apache.org/thread/zbfxnomgvbmqchqjg…	external
https://access.redhat.com/security/cve/CVE-2026-93994	self
https://bugzilla.redhat.com/show_bug.cgi?id=2543862	external
https://www.cve.org/CVERecord?id=CVE-2026-93994	external
https://nvd.nist.gov/vuln/detail/CVE-2026-93994	external
https://lists.apache.org/thread.html/9t3vsm8rnvwd…	external
https://access.redhat.com/security/cve/CVE-2026-102495	self
https://bugzilla.redhat.com/show_bug.cgi?id=2543083	external
https://www.cve.org/CVERecord?id=CVE-2026-102495	external
https://nvd.nist.gov/vuln/detail/CVE-2026-102495	external
https://lists.apache.org/thread/l339q3oldm0cd2lph…	external
https://access.redhat.com/security/cve/CVE-2026-102496	self
https://bugzilla.redhat.com/show_bug.cgi?id=2543086	external
https://www.cve.org/CVERecord?id=CVE-2026-102496	external
https://nvd.nist.gov/vuln/detail/CVE-2026-102496	external
https://lists.apache.org/thread/9z1vg8wmvwpfw748f…	external

Acknowledgments

Kelvin Mbogo

JSON

To clipboard

Loading 1.4 MB of JSON…

CVE-2026-102495 (GCVE-0-2026-102495)

Vulnerability from cvelistv5 – Published: 2026-09-29 11:33 – Updated: 2026-09-29 20:06

Title

Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes

Summary

Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 20:05 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

apache CNA under the mitre root

CNA scorecard B 76/100 over 1267 records in the last 180 days details

References

2 references

URL	Tags
https://lists.apache.org/thread/l339q3oldm0cd2lph…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache XMLSchema	Affected: 0 , < 2.3.3 (semver)

Credits

This issue was found using Claude agents to study the security of open-source projects

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-29T12:11:25.487Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/29/15"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-102495",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T20:05:29.847614Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-674",
                "description": "CWE-674 Uncontrolled Recursion",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T20:06:21.263Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.ws.xmlschema:xmlschema-core",
          "packageURL": "pkg:maven/org.apache.ws.xmlschema/xmlschema-core",
          "product": "Apache XMLSchema",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "2.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was found using Claude agents to study the security of open-source projects"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Apache XmlSchema doesn\u0027t limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service.\u003cbr\u003eUsers are recommended to upgrade to version 2.3.3, which fixes this issue."
            }
          ],
          "value": "Apache XmlSchema doesn\u0027t limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service.\nUsers are recommended to upgrade to version 2.3.3, which fixes this issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T11:33:51.375Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/l339q3oldm0cd2lph4b6f93fd07x9g6s"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-102495",
    "datePublished": "2026-09-29T11:33:51.375Z",
    "dateReserved": "2026-09-29T10:34:05.783Z",
    "dateUpdated": "2026-09-29T20:06:21.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102496 (GCVE-0-2026-102496)

Vulnerability from cvelistv5 – Published: 2026-09-29 11:34 – Updated: 2026-09-29 20:12

Title

Apache XMLSchema: Denial of service through deeply nested schema structures

Summary

Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 20:11 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

apache CNA under the mitre root

CNA scorecard B 76/100 over 1267 records in the last 180 days details

References

2 references

URL	Tags
https://lists.apache.org/thread/9z1vg8wmvwpfw748f…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache XMLSchema	Affected: 0 , < 2.3.3 (semver)

Credits

This issue was found using Claude agents to study the security of open-source projects

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-29T12:11:26.753Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/29/16"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-102496",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T20:11:15.586549Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-674",
                "description": "CWE-674 Uncontrolled Recursion",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T20:12:07.164Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.ws.xmlschema:xmlschema-core",
          "packageURL": "pkg:maven/org.apache.ws.xmlschema/xmlschema-core",
          "product": "Apache XMLSchema",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "2.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was found using Claude agents to study the security of open-source projects"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Apache XmlSchema doesn\u0027t limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service.\u003cbr\u003eUsers are recommended to upgrade to version 2.3.3, which fixes this issue."
            }
          ],
          "value": "Apache XmlSchema doesn\u0027t limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service.\nUsers are recommended to upgrade to version 2.3.3, which fixes this issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T11:34:04.111Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/9z1vg8wmvwpfw748fb2nb55w4hgbnxol"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache XMLSchema: Denial of service through deeply nested schema structures",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-102496",
    "datePublished": "2026-09-29T11:34:04.111Z",
    "dateReserved": "2026-09-29T10:39:29.739Z",
    "dateUpdated": "2026-09-29T20:12:07.164Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12802 (GCVE-0-2026-12802)

Vulnerability from cvelistv5 – Published: 2026-08-03 02:48 – Updated: 2026-08-03 15:28

Title

CMS AuthEnvelopedData fails to enforce tag-length on decryption

Summary

In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 15:27 UTC

CWE

CWE-354 - Improper Validation of Integrity Check Value

Assigner

bcorg CNA under the mitre root

CNA scorecard B 84/100 over 73 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	vendor-advisory
https://github.com/bcgit/bc-java/commit/0fefa539e…	patch

Impacted products

3 products

Vendor	Product	Version
Legion of the Bouncy Castle Inc.	BC-JAVA	Affected: 0 , < 1.85 (maven)
Legion of the Bouncy Castle Inc.	BC-LTS-JAVA	Affected: 2.73.0 , < 2.73.12 (maven)
Legion of the Bouncy Castle Inc.	BC-FJA	Affected: 1.0.0 , < 1.0.12 (maven) Affected: 2.0.0 , < 2.0.12 (maven) Affected: 2.1.0 , < 2.1.12 (maven)

Credits

Thai Duong

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12802",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T15:27:40.666430Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T15:28:12.527Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
          "defaultStatus": "unaffected",
          "modules": [
            "pkix"
          ],
          "packageName": "bcpkix",
          "packageURL": "pkg:maven/org.bouncycastle/bcpkix-jdk18on",
          "platforms": [
            "all"
          ],
          "product": "BC-JAVA",
          "programFiles": [
            "AbstractRecipient"
          ],
          "repo": "https://github.com/bcgit/bc-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.85",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/",
          "defaultStatus": "unaffected",
          "modules": [
            "pkix"
          ],
          "packageName": "bcpkix-lts8on",
          "packageURL": "pkg:maven/org.bouncycastle/bcpkix-lts8on",
          "platforms": [
            "all"
          ],
          "product": "BC-LTS-JAVA",
          "programFiles": [
            "AbstractRecipient"
          ],
          "repo": "https://github.com/bcgit/bc-lts-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "2.73.12",
              "status": "affected",
              "version": "2.73.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/",
          "defaultStatus": "unaffected",
          "packageName": "bcpkix-fips",
          "packageURL": "pkg:maven/org.bouncycastle/bcpkix-fips",
          "platforms": [
            "all"
          ],
          "product": "BC-FJA",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.0.12",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.0.12",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.1.12",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Thai Duong"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).\u003c/p\u003e"
            }
          ],
          "value": "In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series)."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-354",
              "description": "CWE-354 Improper Validation of Integrity Check Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T05:59:51.721Z",
        "orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
        "shortName": "bcorg"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9012802"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/0fefa539e6ac5c66e1daee5a13b23d1d4769cc01"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CMS AuthEnvelopedData fails to enforce tag-length on decryption",
      "x_generator": {
        "engine": "bc release-notes template"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
    "assignerShortName": "bcorg",
    "cveId": "CVE-2026-12802",
    "datePublished": "2026-08-03T02:48:42.672Z",
    "dateReserved": "2026-06-20T23:07:20.197Z",
    "dateUpdated": "2026-08-03T15:28:12.527Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12977 (GCVE-0-2026-12977)

Vulnerability from cvelistv5 – Published: 2026-11-09 19:07 – Updated: 2026-11-11 18:32

Title

Org.wildfly.core/wildfly-server: wildfly: rbac bypass in wildfly deployment-operation handlers leads to privilege escalation

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-267 - Privilege Defined With Unsafe Actions

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1204 records in the last 180 days details

References

4 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:99017	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:99018	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-12977	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2491669	issue-trackingx_refsource_REDHAT

Impacted products

38 products

Vendor	Product	Version
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1	cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10	Unaffected: 0:2.20.0-1.redhat_00002.1.el10eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10	Unaffected: 0:1.86.0-1.redhat_00001.1.el10eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10	Unaffected: 0:801.9.1-1.GA_redhat_00002.1.el10eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10	Unaffected: 0:3.1.1-1.Final_redhat_00001.1.el10eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10	Unaffected: 0:2.18.11-1.redhat_00001.1.el10eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10	Unaffected: 0:2.1.1-1.Final_redhat_00001.1.el10eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10	Unaffected: 0:3.2.4-1.redhat_00001.1.el10eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10	Unaffected: 0:8.1.9.1-1.GA_redhat_00006.1.el10eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10	Unaffected: 0:2.1.5-1.Final_redhat_00001.1.el10eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10	Unaffected: 0:8.1.1-15.GA_redhat_00052.1.el10eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10	Unaffected: 0:2.3.3-1.redhat_00001.1.el10eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8	Unaffected: 0:2.20.0-1.redhat_00002.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8	Unaffected: 0:1.86.0-1.redhat_00001.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8	Unaffected: 0:801.9.1-1.GA_redhat_00002.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8	Unaffected: 0:3.1.1-1.Final_redhat_00001.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8	Unaffected: 0:2.18.11-1.redhat_00001.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8	Unaffected: 0:2.1.1-1.Final_redhat_00001.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8	Unaffected: 0:3.2.4-1.redhat_00001.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8	Unaffected: 0:8.1.9.1-1.GA_redhat_00006.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8	Unaffected: 0:2.1.5-1.Final_redhat_00001.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8	Unaffected: 0:8.1.1-15.GA_redhat_00052.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8	Unaffected: 0:2.3.3-1.redhat_00001.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9	Unaffected: 0:2.20.0-1.redhat_00002.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9	Unaffected: 0:1.86.0-1.redhat_00001.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9	Unaffected: 0:801.9.1-1.GA_redhat_00002.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9	Unaffected: 0:3.1.1-1.Final_redhat_00001.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9	Unaffected: 0:2.18.11-1.redhat_00001.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9	Unaffected: 0:2.1.1-1.Final_redhat_00001.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9	Unaffected: 0:3.2.4-1.redhat_00001.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9	Unaffected: 0:8.1.9.1-1.GA_redhat_00006.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9	Unaffected: 0:2.1.5-1.Final_redhat_00001.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9	Unaffected: 0:8.1.1-15.GA_redhat_00052.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9	Unaffected: 0:2.3.3-1.redhat_00001.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat Fuse 7	cpe:/a:redhat:jboss_fuse:7
Red Hat	Red Hat JBoss Enterprise Application Platform 7	cpe:/a:redhat:jboss_enterprise_application_platform:7
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	cpe:/a:redhat:jbosseapxp
Red Hat	Red Hat Single Sign-On 7	cpe:/a:redhat:red_hat_single_sign_on:7

Date Public

2026-11-09 18:23

Credits

Red Hat would like to thank Kelvin Mbogo for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "wildfly-server",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-apache-sshd",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.20.0-1.redhat_00002.1.el10eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-bouncycastle",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.86.0-1.redhat_00001.1.el10eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-eap-product-conf-parent",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:801.9.1-1.GA_redhat_00002.1.el10eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-ironjacamar",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.1-1.Final_redhat_00001.1.el10eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-jackson-jaxrs-providers",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.11-1.redhat_00001.1.el10eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-jackson-modules-base",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.11-1.redhat_00001.1.el10eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-jackson-modules-java8",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.11-1.redhat_00001.1.el10eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-mod_cluster",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.1.1-1.Final_redhat_00001.1.el10eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-neethi",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.2.4-1.redhat_00001.1.el10eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-wildfly",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:8.1.9.1-1.GA_redhat_00006.1.el10eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-wildfly-http-client",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.1.5-1.Final_redhat_00001.1.el10eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-wildfly-javadocs",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:8.1.1-15.GA_redhat_00052.1.el10eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-ws-commons-XmlSchema",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.3.3-1.redhat_00001.1.el10eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-apache-sshd",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.20.0-1.redhat_00002.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-bouncycastle",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.86.0-1.redhat_00001.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-eap-product-conf-parent",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:801.9.1-1.GA_redhat_00002.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-ironjacamar",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.1-1.Final_redhat_00001.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-jackson-jaxrs-providers",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.11-1.redhat_00001.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-jackson-modules-base",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.11-1.redhat_00001.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-jackson-modules-java8",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.11-1.redhat_00001.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-mod_cluster",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.1.1-1.Final_redhat_00001.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-neethi",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.2.4-1.redhat_00001.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-wildfly",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:8.1.9.1-1.GA_redhat_00006.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-wildfly-http-client",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.1.5-1.Final_redhat_00001.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-wildfly-javadocs",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:8.1.1-15.GA_redhat_00052.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-ws-commons-XmlSchema",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.3.3-1.redhat_00001.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-apache-sshd",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.20.0-1.redhat_00002.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-bouncycastle",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.86.0-1.redhat_00001.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-eap-product-conf-parent",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:801.9.1-1.GA_redhat_00002.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-ironjacamar",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.1-1.Final_redhat_00001.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-jackson-jaxrs-providers",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.11-1.redhat_00001.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-jackson-modules-base",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.11-1.redhat_00001.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-jackson-modules-java8",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.11-1.redhat_00001.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-mod_cluster",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.1.1-1.Final_redhat_00001.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-neethi",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.2.4-1.redhat_00001.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-wildfly",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:8.1.9.1-1.GA_redhat_00006.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-wildfly-http-client",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.1.5-1.Final_redhat_00001.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-wildfly-javadocs",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:8.1.1-15.GA_redhat_00052.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8",
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap8-ws-commons-XmlSchema",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.3.3-1.redhat_00001.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_fuse:7"
          ],
          "defaultStatus": "affected",
          "packageName": "wildfly-server",
          "product": "Red Hat Fuse 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:7"
          ],
          "defaultStatus": "affected",
          "packageName": "wildfly-server",
          "product": "Red Hat JBoss Enterprise Application Platform 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jbosseapxp"
          ],
          "defaultStatus": "unaffected",
          "packageName": "wildfly-server",
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7"
          ],
          "defaultStatus": "affected",
          "packageName": "wildfly-server",
          "product": "Red Hat Single Sign-On 7",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Kelvin Mbogo for reporting this issue."
        }
      ],
      "datePublic": "2026-11-09T18:23:51.637Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted \"Maintainer\" role to read sensitive configuration files. This can lead to the exfiltration of credentials and full administrative control (SuperUser) of the server."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-267",
              "description": "Privilege Defined With Unsafe Actions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T18:32:39.533Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:99017",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:99017"
        },
        {
          "name": "RHSA-2026:99018",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:99018"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-12977"
        },
        {
          "name": "RHBZ#2491669",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491669"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-26T21:41:05.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-11-09T18:23:51.637Z",
          "value": "Made public."
        }
      ],
      "title": "Org.wildfly.core/wildfly-server: wildfly: rbac bypass in wildfly deployment-operation handlers leads to privilege escalation",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-267: Privilege Defined With Unsafe Actions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-12977",
    "datePublished": "2026-11-09T19:07:30.915Z",
    "dateReserved": "2026-06-23T10:55:36.677Z",
    "dateUpdated": "2026-11-11T18:32:39.533Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58060 (GCVE-0-2026-58060)

Vulnerability from cvelistv5 – Published: 2026-08-03 02:37 – Updated: 2026-08-03 15:34

Title

HSS public-key level count unbounded, enabling huge allocation on verify

Summary

In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 15:34 UTC

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

bcorg CNA under the mitre root

CNA scorecard B 84/100 over 73 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	vendor-advisory
https://github.com/bcgit/bc-java/commit/311cabbb6…	patch
https://github.com/bcgit/bc-java/commit/6c9f30b3f…	patch

Impacted products

3 products

Vendor	Product	Version
Legion of the Bouncy Castle Inc.	BC-JAVA	Affected: 1.65 , < 1.85 (maven)
Legion of the Bouncy Castle Inc.	BC-LTS-JAVA	Affected: 2.73.0 , < 2.73.12 (maven)
Legion of the Bouncy Castle Inc.	BC-FJA	Affected: 2.0.0 , < 2.0.2 (maven) Affected: 2.1.0 , < 2.1.3 (maven)

Credits

Alex Gaynor in collaboration with Claude and Anthropic Research

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58060",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T15:34:32.133000Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T15:34:42.170Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
          "defaultStatus": "unaffected",
          "modules": [
            "core"
          ],
          "packageName": "bcprov",
          "packageURL": "pkg:maven/org.bouncycastle/bcprov-jdk18on",
          "platforms": [
            "all"
          ],
          "product": "BC-JAVA",
          "programFiles": [
            "HSSPublicKeyParameters",
            "LMSPublicKeyParameters",
            "HSSSignature"
          ],
          "repo": "https://github.com/bcgit/bc-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.85",
              "status": "affected",
              "version": "1.65",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/",
          "defaultStatus": "unaffected",
          "modules": [
            "core"
          ],
          "packageName": "bcprov-lts8on",
          "packageURL": "pkg:maven/org.bouncycastle/bcprov-lts8on",
          "platforms": [
            "all"
          ],
          "product": "BC-LTS-JAVA",
          "programFiles": [
            "HSSPublicKeyParameters",
            "LMSPublicKeyParameters",
            "HSSSignature"
          ],
          "repo": "https://github.com/bcgit/bc-lts-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "2.73.12",
              "status": "affected",
              "version": "2.73.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/",
          "defaultStatus": "unaffected",
          "packageName": "bc-fips",
          "packageURL": "pkg:maven/org.bouncycastle/bc-fips",
          "platforms": [
            "all"
          ],
          "product": "BC-FJA",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "2.0.2",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.1.3",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Alex Gaynor in collaboration with Claude and Anthropic Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).\u003c/p\u003e"
            }
          ],
          "value": "In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789 Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T05:50:41.191Z",
        "orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
        "shortName": "bcorg"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9058060"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/311cabbb6fcead7647fec16681423a4439118276"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/6c9f30b3fdaa3f2140809278caebbffc55920922"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "HSS public-key level count unbounded, enabling huge allocation on verify",
      "x_generator": {
        "engine": "bc release-notes template"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
    "assignerShortName": "bcorg",
    "cveId": "CVE-2026-58060",
    "datePublished": "2026-08-03T02:37:43.841Z",
    "dateReserved": "2026-06-28T01:21:46.334Z",
    "dateUpdated": "2026-08-03T15:34:42.170Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58061 (GCVE-0-2026-58061)

Vulnerability from cvelistv5 – Published: 2026-08-03 02:36 – Updated: 2026-08-03 15:35

Title

CCM-family modes write plaintext to caller buffer before tag check

Summary

In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 15:35 UTC

CWE

CWE-354 - Improper Validation of Integrity Check Value

Assigner

bcorg CNA under the mitre root

CNA scorecard B 84/100 over 73 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	vendor-advisory
https://github.com/bcgit/bc-java/commit/cd4a5ab3a…	patch
https://github.com/bcgit/bc-java/commit/08d675106…	patch

Impacted products

3 products

Vendor	Product	Version
Legion of the Bouncy Castle Inc.	BC-JAVA	Affected: 0 , < 1.85 (maven)
Legion of the Bouncy Castle Inc.	BC-LTS-JAVA	Affected: 2.73.0 , < 2.73.12 (maven)
Legion of the Bouncy Castle Inc.	BC-FJA	Affected: 1.0.0 , < 1.0.2.7 (maven) Affected: 2.0.0 , < 2.0.2 (maven) Affected: 2.1.0 , < 2.1.3 (maven)

Credits

Alex Gaynor in collaboration with Claude and Anthropic Research

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58061",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T15:35:24.935271Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T15:35:41.256Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
          "defaultStatus": "unaffected",
          "modules": [
            "core"
          ],
          "packageName": "bcprov",
          "packageURL": "pkg:maven/org.bouncycastle/bcprov-jdk18on",
          "platforms": [
            "all"
          ],
          "product": "BC-JAVA",
          "programFiles": [
            "CCMBlockCipher",
            "KCCMBlockCipher",
            "KGCMBlockCipher"
          ],
          "repo": "https://github.com/bcgit/bc-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.85",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/",
          "defaultStatus": "unaffected",
          "modules": [
            "core"
          ],
          "packageName": "bcprov-lts8on",
          "packageURL": "pkg:maven/org.bouncycastle/bcprov-lts8on",
          "platforms": [
            "all"
          ],
          "product": "BC-LTS-JAVA",
          "programFiles": [
            "CCMBlockCipher",
            "KCCMBlockCipher",
            "KGCMBlockCipher"
          ],
          "repo": "https://github.com/bcgit/bc-lts-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "2.73.12",
              "status": "affected",
              "version": "2.73.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/",
          "defaultStatus": "unaffected",
          "packageName": "bc-fips",
          "packageURL": "pkg:maven/org.bouncycastle/bc-fips",
          "platforms": [
            "all"
          ],
          "product": "BC-FJA",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.0.2.7",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.0.2",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.1.3",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Alex Gaynor in collaboration with Claude and Anthropic Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).\u003c/p\u003e"
            }
          ],
          "value": "In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-354",
              "description": "CWE-354 Improper Validation of Integrity Check Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T05:49:52.696Z",
        "orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
        "shortName": "bcorg"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9058061"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/cd4a5ab3ad619ff03c7767c1b8b19d5dea2970af"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/08d675106bb663ddcc6ec0a4af6f6f62f512697b"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CCM-family modes write plaintext to caller buffer before tag check",
      "x_generator": {
        "engine": "bc release-notes template"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
    "assignerShortName": "bcorg",
    "cveId": "CVE-2026-58061",
    "datePublished": "2026-08-03T02:36:36.753Z",
    "dateReserved": "2026-06-28T01:21:46.334Z",
    "dateUpdated": "2026-08-03T15:35:41.256Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59639 (GCVE-0-2026-59639)

Vulnerability from cvelistv5 – Published: 2026-08-03 00:56 – Updated: 2026-08-03 13:24

Title

CMS verifySignatures returns true for SignedData with zero signers

Summary

In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 13:24 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

bcorg CNA under the mitre root

CNA scorecard B 84/100 over 73 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	vendor-advisory
https://github.com/bcgit/bc-java/commit/99ddc6dcc…	patch

Impacted products

3 products

Vendor	Product	Version
Legion of the Bouncy Castle Inc.	BC-JAVA	Affected: 0 , < 1.85 (maven)
Legion of the Bouncy Castle Inc.	BC-LTS-JAVA	Affected: 2.73.0 , < 2.73.12 (maven)
Legion of the Bouncy Castle Inc.	BC-FJA	Affected: 1.0.0 , < 1.0.12 (maven) Affected: 2.0.0 , < 2.0.12 (maven) Affected: 2.1.0 , < 2.1.12 (maven)

Credits

Alex Gaynor in collaboration with Claude and Anthropic Research

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59639",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T13:24:06.309527Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T13:24:16.359Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
          "defaultStatus": "unaffected",
          "modules": [
            "pkix"
          ],
          "packageName": "bcpkix",
          "packageURL": "pkg:maven/org.bouncycastle/bcpkix-jdk18on",
          "platforms": [
            "all"
          ],
          "product": "BC-JAVA",
          "programFiles": [
            "CMSSignedData"
          ],
          "repo": "https://github.com/bcgit/bc-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.85",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/",
          "defaultStatus": "unaffected",
          "modules": [
            "pkix"
          ],
          "packageName": "bcpkix-lts8on",
          "packageURL": "pkg:maven/org.bouncycastle/bcpkix-lts8on",
          "platforms": [
            "all"
          ],
          "product": "BC-LTS-JAVA",
          "programFiles": [
            "CMSSignedData"
          ],
          "repo": "https://github.com/bcgit/bc-lts-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "2.73.12",
              "status": "affected",
              "version": "2.73.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/",
          "defaultStatus": "unaffected",
          "packageName": "bcpkix-fips",
          "packageURL": "pkg:maven/org.bouncycastle/bcpkix-fips",
          "platforms": [
            "all"
          ],
          "product": "BC-FJA",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.0.12",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.0.12",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.1.12",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Alex Gaynor in collaboration with Claude and Anthropic Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).\u003c/p\u003e"
            }
          ],
          "value": "In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series)."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T05:05:39.619Z",
        "orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
        "shortName": "bcorg"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059639"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/99ddc6dcc6782e6a76b0dd587c77e62eb7096ad0"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CMS verifySignatures returns true for SignedData with zero signers",
      "x_generator": {
        "engine": "bc release-notes template"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
    "assignerShortName": "bcorg",
    "cveId": "CVE-2026-59639",
    "datePublished": "2026-08-03T00:56:24.394Z",
    "dateReserved": "2026-07-06T06:58:29.263Z",
    "dateUpdated": "2026-08-03T13:24:16.359Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59642 (GCVE-0-2026-59642)

Vulnerability from cvelistv5 – Published: 2026-08-03 00:53 – Updated: 2026-08-03 13:27

Title

CMS AuthenticatedData content not bound to MAC when authAttrs present

Summary

In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 13:27 UTC

CWE

CWE-354 - Improper Validation of Integrity Check Value

Assigner

bcorg CNA under the mitre root

CNA scorecard B 84/100 over 73 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	vendor-advisory
https://github.com/bcgit/bc-java/commit/2117f316a…	patch

Impacted products

3 products

Vendor	Product	Version
Legion of the Bouncy Castle Inc.	BC-JAVA	Affected: 0 , < 1.85 (maven)
Legion of the Bouncy Castle Inc.	BC-LTS-JAVA	Affected: 2.73.0 , < 2.73.12 (maven)
Legion of the Bouncy Castle Inc.	BC-FJA	Affected: 1.0.0 , < 1.0.12 (maven) Affected: 2.0.0 , < 2.0.12 (maven) Affected: 2.1.0 , < 2.1.12 (maven)

Credits

Alex Gaynor in collaboration with Claude and Anthropic Research

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59642",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T13:27:10.316195Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T13:27:19.619Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
          "defaultStatus": "unaffected",
          "modules": [
            "pkix"
          ],
          "packageName": "bcpkix",
          "packageURL": "pkg:maven/org.bouncycastle/bcpkix-jdk18on",
          "platforms": [
            "all"
          ],
          "product": "BC-JAVA",
          "programFiles": [
            "RecipientInformation"
          ],
          "repo": "https://github.com/bcgit/bc-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.85",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/",
          "defaultStatus": "unaffected",
          "modules": [
            "pkix"
          ],
          "packageName": "bcpkix-lts8on",
          "packageURL": "pkg:maven/org.bouncycastle/bcpkix-lts8on",
          "platforms": [
            "all"
          ],
          "product": "BC-LTS-JAVA",
          "programFiles": [
            "RecipientInformation"
          ],
          "repo": "https://github.com/bcgit/bc-lts-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "2.73.12",
              "status": "affected",
              "version": "2.73.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/",
          "defaultStatus": "unaffected",
          "packageName": "bcpkix-fips",
          "packageURL": "pkg:maven/org.bouncycastle/bcpkix-fips",
          "platforms": [
            "all"
          ],
          "product": "BC-FJA",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.0.12",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.0.12",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.1.12",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Alex Gaynor in collaboration with Claude and Anthropic Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).\u003c/p\u003e"
            }
          ],
          "value": "In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series)."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-354",
              "description": "CWE-354 Improper Validation of Integrity Check Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T05:03:43.251Z",
        "orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
        "shortName": "bcorg"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059642"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/2117f316a5a47308f3e569695a6592b16aac0dd7"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CMS AuthenticatedData content not bound to MAC when authAttrs present",
      "x_generator": {
        "engine": "bc release-notes template"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
    "assignerShortName": "bcorg",
    "cveId": "CVE-2026-59642",
    "datePublished": "2026-08-03T00:53:28.335Z",
    "dateReserved": "2026-07-06T06:58:29.263Z",
    "dateUpdated": "2026-08-03T13:27:19.619Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59645 (GCVE-0-2026-59645)

Vulnerability from cvelistv5 – Published: 2026-08-03 00:49 – Updated: 2026-08-03 13:35

Title

OER parser recurses without depth limit on self-referential IEEE 1609.2 schema

Summary

In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 13:35 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

bcorg CNA under the mitre root

CNA scorecard B 84/100 over 73 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	vendor-advisory
https://github.com/bcgit/bc-java/commit/822b2478b…	patch

Impacted products

3 products

Vendor	Product	Version
Legion of the Bouncy Castle Inc.	BC-JAVA	Affected: 1.70 , < 1.85 (maven)
Legion of the Bouncy Castle Inc.	BC-LTS-JAVA	Affected: 2.73.0 , < 2.73.12 (maven)
Legion of the Bouncy Castle Inc.	BC-FJA	Affected: 2.0.0 , < 2.0.7 (maven) Affected: 2.1.0 , < 2.1.7 (maven)

Credits

Alex Gaynor in collaboration with Claude and Anthropic Research

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59645",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T13:35:24.948138Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T13:35:36.136Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
          "defaultStatus": "unaffected",
          "modules": [
            "util"
          ],
          "packageName": "bcutil",
          "packageURL": "pkg:maven/org.bouncycastle/bcutil-jdk18on",
          "platforms": [
            "all"
          ],
          "product": "BC-JAVA",
          "programFiles": [
            "OERInputStream"
          ],
          "repo": "https://github.com/bcgit/bc-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.85",
              "status": "affected",
              "version": "1.70",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/",
          "defaultStatus": "unaffected",
          "modules": [
            "util"
          ],
          "packageName": "bcutil-lts8on",
          "packageURL": "pkg:maven/org.bouncycastle/bcutil-lts8on",
          "platforms": [
            "all"
          ],
          "product": "BC-LTS-JAVA",
          "programFiles": [
            "OERInputStream"
          ],
          "repo": "https://github.com/bcgit/bc-lts-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "2.73.12",
              "status": "affected",
              "version": "2.73.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/",
          "defaultStatus": "unaffected",
          "packageName": "bcutil-fips",
          "packageURL": "pkg:maven/org.bouncycastle/bcutil-fips",
          "platforms": [
            "all"
          ],
          "product": "BC-FJA",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "2.0.7",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.1.7",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Alex Gaynor in collaboration with Claude and Anthropic Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).\u003c/p\u003e"
            }
          ],
          "value": "In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series)."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674 Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T05:00:24.183Z",
        "orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
        "shortName": "bcorg"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059645"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/822b2478b131097368a56290f5728e28dd042989"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "OER parser recurses without depth limit on self-referential IEEE 1609.2 schema",
      "x_generator": {
        "engine": "bc release-notes template"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
    "assignerShortName": "bcorg",
    "cveId": "CVE-2026-59645",
    "datePublished": "2026-08-03T00:49:41.143Z",
    "dateReserved": "2026-07-06T06:58:29.263Z",
    "dateUpdated": "2026-08-03T13:35:36.136Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68498 (GCVE-0-2026-68498)

Vulnerability from cvelistv5 – Published: 2026-10-16 21:11 – Updated: 2026-10-20 18:08 X_Open Source

Title

jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service

Summary

StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default. In the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory. A remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration. Byte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes. This issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-20 17:31 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

HeroDevs CNA under the mitre root

CNA scorecard B 82/100 over 18 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/FasterXML/jackson-core/securit…	vendor-advisory
https://github.com/FasterXML/jackson-core/pull/1643	patch
https://github.com/FasterXML/jackson-core/commit/…	patch
https://github.com/FasterXML/jackson-core/blob/2.…	release-notes
https://github.com/FasterXML/jackson-core/blob/3.…	release-notes

Impacted products

2 products

Vendor	Product	Version
FasterXML	jackson-core	Affected: 2.16.0 , < 2.18.10 (maven) Unaffected: 2.18.10 (maven) Affected: 2.19.0 , < 2.21.6 (maven) Unaffected: 2.21.6 (maven) Affected: 2.22.0 , < 2.22.2 (maven) Unaffected: 2.22.2 (maven)
FasterXML	jackson-core	Affected: 3.0.0 , < 3.1.6 (maven) Unaffected: 3.1.6 (maven) Affected: 3.2.0 , < 3.2.2 (maven) Unaffected: 3.2.2 (maven)

Credits

tinyb0y tinyb0y cowtowncoder (Tatu Saloranta)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68498",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T17:31:30.585739Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T18:08:01.960Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "com.fasterxml.jackson.core:jackson-core",
          "product": "jackson-core",
          "programFiles": [
            "src/main/java/com/fasterxml/jackson/core/json/ReaderBasedJsonParser.java"
          ],
          "programRoutines": [
            {
              "name": "ReaderBasedJsonParser._parseName2"
            }
          ],
          "repo": "https://github.com/FasterXML/jackson-core",
          "vendor": "FasterXML",
          "versions": [
            {
              "lessThan": "2.18.10",
              "status": "affected",
              "version": "2.16.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "2.18.10",
              "versionType": "maven"
            },
            {
              "lessThan": "2.21.6",
              "status": "affected",
              "version": "2.19.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "2.21.6",
              "versionType": "maven"
            },
            {
              "lessThan": "2.22.2",
              "status": "affected",
              "version": "2.22.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "2.22.2",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "tools.jackson.core:jackson-core",
          "product": "jackson-core",
          "programFiles": [
            "src/main/java/tools/jackson/core/json/ReaderBasedJsonParser.java"
          ],
          "programRoutines": [
            {
              "name": "ReaderBasedJsonParser._parseName2"
            }
          ],
          "repo": "https://github.com/FasterXML/jackson-core",
          "vendor": "FasterXML",
          "versions": [
            {
              "lessThan": "3.1.6",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "3.1.6",
              "versionType": "maven"
            },
            {
              "lessThan": "3.2.2",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "3.2.2",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "tinyb0y"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "tinyb0y"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "cowtowncoder (Tatu Saloranta)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eStreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input \u2014 Reader, String or char[] sources, all served by ReaderBasedJsonParser \u2014 that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default.\u003c/p\u003e\u003cp\u003eIn the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name \u2014 up to maxStringLength characters \u2014 has already been buffered in memory.\u003c/p\u003e\u003cp\u003eA remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration.\u003c/p\u003e\u003cp\u003eByte-input parsers are \u003cb\u003enot\u003c/b\u003e affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] \u2014 for example an HTTP request body already read into a String \u2014 rather than from raw UTF-8 bytes.\u003c/p\u003e\u003cp\u003eThis issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.\u003c/p\u003e"
            }
          ],
          "value": "StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input \u2014 Reader, String or char[] sources, all served by ReaderBasedJsonParser \u2014 that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default.\n\n\n\nIn the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name \u2014 up to maxStringLength characters \u2014 has already been buffered in memory.\n\n\n\nA remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration.\n\n\n\nByte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] \u2014 for example an HTTP request body already read into a String \u2014 rather than from raw UTF-8 bytes.\n\n\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Application parses attacker-supplied JSON from a String, Reader or char[] source -- for example an HTTP request body read into a String -- using JsonFactory.createParser(String/Reader/char[]) directly or via jackson-databind. Byte-input and non-blocking parsers are not affected."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T21:11:03.551Z",
        "orgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
        "shortName": "HeroDevs"
      },
      "references": [
        {
          "name": "GHSA-649p-m576-vr99",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-649p-m576-vr99"
        },
        {
          "name": "FasterXML/jackson-core#1643 - Enforce maxNameLength incrementally in ReaderBasedJsonParser",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FasterXML/jackson-core/pull/1643"
        },
        {
          "name": "FasterXML/jackson-core@2cd206d - fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FasterXML/jackson-core/commit/2cd206de1163e3fcff7bdaca425274f00668b075"
        },
        {
          "name": "Release notes (2.x)",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/FasterXML/jackson-core/blob/2.x/release-notes/VERSION-2.x"
        },
        {
          "name": "Release notes (3.x)",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/FasterXML/jackson-core/blob/3.x/release-notes/VERSION"
        }
      ],
      "source": {
        "advisory": "GHSA-649p-m576-vr99",
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-29T01:52:00.000Z",
          "value": "Fix merged upstream via FasterXML/jackson-core#1643"
        },
        {
          "lang": "en",
          "time": "2026-08-14T00:00:00.000Z",
          "value": "Fix released in jackson-core 2.21.6, 3.1.6 and 3.2.2"
        },
        {
          "lang": "en",
          "time": "2026-08-15T00:00:00.000Z",
          "value": "Fix released in jackson-core 2.18.10"
        },
        {
          "lang": "en",
          "time": "2026-08-16T00:00:00.000Z",
          "value": "Fix released in jackson-core 2.22.2"
        },
        {
          "lang": "en",
          "time": "2026-09-11T00:00:00.000Z",
          "value": "GHSA-649p-m576-vr99 published by the maintainer in FasterXML/jackson-core"
        }
      ],
      "title": "jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
    "assignerShortName": "HeroDevs",
    "cveId": "CVE-2026-68498",
    "datePublished": "2026-10-16T21:11:03.551Z",
    "dateReserved": "2026-07-30T15:20:37.473Z",
    "dateUpdated": "2026-10-20T18:08:01.960Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:99018

CVE-2026-102495 (GCVE-0-2026-102495)

CVE-2026-102496 (GCVE-0-2026-102496)

CVE-2026-12802 (GCVE-0-2026-12802)

CVE-2026-12977 (GCVE-0-2026-12977)

CVE-2026-58060 (GCVE-0-2026-58060)

CVE-2026-58061 (GCVE-0-2026-58061)

CVE-2026-59639 (GCVE-0-2026-59639)

CVE-2026-59642 (GCVE-0-2026-59642)

CVE-2026-59645 (GCVE-0-2026-59645)

CVE-2026-68498 (GCVE-0-2026-68498)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour