CVE-2026-74458: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-2x39-h24h-r965
Share
Published
Advisory Summary

CVE-2026-74458 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-74458 at a Glance

CVE Identifier CVE-2026-74458
GHSA Identifier GHSA-2x39-h24h-r965
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-74458

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-74458, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMD_HEADER_LEN can still be dispatched, and the wait path copies a matching command into a fixed caller-owned struct kvaser_cmd using the device-provided length. Reject nonzero commands that do not contain the fixed header or that extend beyond the current USB buffer item. In the wait path, also reject a matching command that exceeds the destination before copying it.

References

NVD — CVE-2026-74458 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-74458
git.kernel.org/stable/c/0293dd153f... WEB
https://git.kernel.org/stable/c/0293dd153f9dbc1ddf5dacdccc76b363bce4a8ee
git.kernel.org/stable/c/185cb1fa38... WEB
https://git.kernel.org/stable/c/185cb1fa38142a3cbf223dd8b3abb24217f330d3
git.kernel.org/stable/c/21f0465fd8... WEB
https://git.kernel.org/stable/c/21f0465fd86d77794aaed8e05f833634f68d178d
git.kernel.org/stable/c/3d0897ec62... WEB
https://git.kernel.org/stable/c/3d0897ec623e422695d70d80ae456f89476c5328
git.kernel.org/stable/c/695aea154b... WEB
https://git.kernel.org/stable/c/695aea154bb2d453e6daada1510972fafd075285
git.kernel.org/stable/c/72f96c2942... WEB
https://git.kernel.org/stable/c/72f96c2942f11a0ae8663adcb3d9ee986e07d4fa
git.kernel.org/stable/c/c00ec53d7d... WEB
https://git.kernel.org/stable/c/c00ec53d7dec08134e97071850cc00ef000c5b77
git.kernel.org/stable/c/d9e9167252... WEB
https://git.kernel.org/stable/c/d9e91672526ffa279709b15490118aea1bdee714

Frequently Asked Questions

What is CVE-2026-74458?
CVE-2026-74458 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-74458?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-74458?
CVE-2026-74458 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-74458?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2x39-h24h-r965",
  "modified" : "2026-08-19T18:32:27Z",
  "published" : "2026-08-15T15:30:33Z",
  "aliases" : [ "CVE-2026-74458" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents\n\nThe wait and bulk receive paths walk variable-length commands from a\nUSB buffer. A nonzero command shorter than CMD_HEADER_LEN can still be\ndispatched, and the wait path copies a matching command into a fixed\ncaller-owned struct kvaser_cmd using the device-provided length.\n\nReject nonzero commands that do not contain the fixed header or that\nextend beyond the current USB buffer item. In the wait path, also reject\na matching command that exceeds the destination before copying it.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-74458"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0293dd153f9dbc1ddf5dacdccc76b363bce4a8ee"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/185cb1fa38142a3cbf223dd8b3abb24217f330d3"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/21f0465fd86d77794aaed8e05f833634f68d178d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3d0897ec623e422695d70d80ae456f89476c5328"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/695aea154bb2d453e6daada1510972fafd075285"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/72f96c2942f11a0ae8663adcb3d9ee986e07d4fa"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c00ec53d7dec08134e97071850cc00ef000c5b77"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d9e91672526ffa279709b15490118aea1bdee714"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T13:17:50Z"
  }
}