CVE-2026-90307: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-24j7-gr38-qhjc
Share
Published
Advisory Summary

CVE-2026-90307 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-90307 at a Glance

CVE Identifier CVE-2026-90307
GHSA Identifier GHSA-24j7-gr38-qhjc
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-90307

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-90307, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ srp_recv_done() passes wc->byte_len to srp_process_rsp(). It passes nothing to srp_process_cred_req() and srp_process_aer_req(), which read fixed-size fields from the receive buffer without checking that those fields were received. The buffer size is max_ti_iu_len, which comes from the login response and is not validated. A target that advertises 8 and then sends an 8-byte SRP_CRED_REQ makes the initiator read req->tag from beyond the end of the buffer. req->tag is copied into the SRP_CRED_RSP and sent back, so those bytes reach the target. SRP_AER_REQ behaves the same way and also reads req->lun. The leak is 8 bytes per response. max_ti_iu_len also decides which slab cache the buffer comes from. With 8 the buffer is a kmalloc-8 object and the read is entirely outside it: BUG: KASAN: slab-out-of-bounds in srp_recv_done+0x172b/0x1aa0 Read of size 8 at addr ffff888104714da8 by task kworker/u8:3/50 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 0 bytes to the right of allocated 8-byte region [ffff888104714da0, ffff888104714da8) Without KASAN the returned bytes are whatever is next in the slab. One run returned ".strtab". rsp->data[3] in srp_process_rsp() has the same problem: only resp_data_len is checked before it is read. Drop a request that is shorter than the structure being parsed, and check byte_len before the tsk_mgmt read.

References

NVD — CVE-2026-90307 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90307
git.kernel.org/stable/c/001adf2fe8... WEB
https://git.kernel.org/stable/c/001adf2fe87d1ab677c014a97467bbea5153ae5f
git.kernel.org/stable/c/0e7ba61751... WEB
https://git.kernel.org/stable/c/0e7ba617514902501514d577647d866e670dad90
git.kernel.org/stable/c/138eb2f0ef... WEB
https://git.kernel.org/stable/c/138eb2f0ef02adfe6ad126afad5b54c56b5046ee
git.kernel.org/stable/c/3787f4c3e0... WEB
https://git.kernel.org/stable/c/3787f4c3e0d813d6c56be9f6dfaf66f8551fb0a7
git.kernel.org/stable/c/3f7fdf561f... WEB
https://git.kernel.org/stable/c/3f7fdf561f1ec3b523c39708df00bd808671668d
git.kernel.org/stable/c/961ac0f0c5... WEB
https://git.kernel.org/stable/c/961ac0f0c5e414abdd6b33fae84b311d9fde0bd0
git.kernel.org/stable/c/dc2272c00d... WEB
https://git.kernel.org/stable/c/dc2272c00d7c00ee2a69b57f7ca9caaefcbdb8cd
git.kernel.org/stable/c/fa1b33fdab... WEB
https://git.kernel.org/stable/c/fa1b33fdab3e79dce83721ead3220200a2dbec22

Frequently Asked Questions

What is CVE-2026-90307?
CVE-2026-90307 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-90307?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-90307?
CVE-2026-90307 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-90307?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-24j7-gr38-qhjc",
  "modified" : "2026-09-17T18:32:00Z",
  "published" : "2026-09-17T18:32:00Z",
  "aliases" : [ "CVE-2026-90307" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ\n\nsrp_recv_done() passes wc->byte_len to srp_process_rsp(). It passes\nnothing to srp_process_cred_req() and srp_process_aer_req(), which read\nfixed-size fields from the receive buffer without checking that those\nfields were received.\n\nThe buffer size is max_ti_iu_len, which comes from the login response\nand is not validated. A target that advertises 8 and then sends an\n8-byte SRP_CRED_REQ makes the initiator read req->tag from beyond the\nend of the buffer. req->tag is copied into the SRP_CRED_RSP and sent\nback, so those bytes reach the target. SRP_AER_REQ behaves the same way\nand also reads req->lun.\n\nThe leak is 8 bytes per response. max_ti_iu_len also decides which slab\ncache the buffer comes from. With 8 the buffer is a kmalloc-8 object and\nthe read is entirely outside it:\n\n  BUG: KASAN: slab-out-of-bounds in srp_recv_done+0x172b/0x1aa0\n  Read of size 8 at addr ffff888104714da8 by task kworker/u8:3/50\n   which belongs to the cache kmalloc-8 of size 8\n  The buggy address is located 0 bytes to the right of\n   allocated 8-byte region [ffff888104714da0, ffff888104714da8)\n\nWithout KASAN the returned bytes are whatever is next in the slab. One\nrun returned \".strtab\".\n\nrsp->data[3] in srp_process_rsp() has the same problem: only\nresp_data_len is checked before it is read.\n\nDrop a request that is shorter than the structure being parsed, and\ncheck byte_len before the tsk_mgmt read.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-90307"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/001adf2fe87d1ab677c014a97467bbea5153ae5f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0e7ba617514902501514d577647d866e670dad90"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/138eb2f0ef02adfe6ad126afad5b54c56b5046ee"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3787f4c3e0d813d6c56be9f6dfaf66f8551fb0a7"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3f7fdf561f1ec3b523c39708df00bd808671668d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/961ac0f0c5e414abdd6b33fae84b311d9fde0bd0"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/dc2272c00d7c00ee2a69b57f7ca9caaefcbdb8cd"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fa1b33fdab3e79dce83721ead3220200a2dbec22"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-17T17:17:28Z"
  }
}