CVE-2026-53392: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-3gfh-mq5v-c264
Share
CVSS 7.5
CWE-20 CWE-476
Published
Advisory Summary

CVE-2026-53392 is a HIGH (CVSS 7.5) security vulnerability vulnerability (CWE-20: Improper Input Validation) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.. Remediation is available in the latest vendor maintenance releases.

CVE-2026-53392 at a Glance

CVE Identifier CVE-2026-53392
GHSA Identifier GHSA-3gfh-mq5v-c264
Severity HIGH
CVSS v3.1 Base Score 7.5
CWE Classification CWE-20: Improper Input Validation
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2026-53392

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-53392, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-20: Improper Input Validation, where the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count ff_layout_alloc_lseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzalloc_objs(), and the current code only rejects NULL. A zero count yields ZERO_SIZE_PTR, which can be stored in dss_info->fh_versions even though later flexfiles paths assume that at least one filehandle version exists. Reject fh_count == 0 before the allocation, matching the existing zero version_count validation in the flexfiles GETDEVICEINFO parser. A QEMU/KASAN run with a malformed flexfiles layout hit: KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750 ff_layout_encode_layoutreturn+0x683/0x970 nfs4_xdr_enc_layoutreturn+0x278/0x3a0 Kernel panic - not syncing: Fatal exception The patched kernel rejects the malformed layout without KASAN/oops/panic, and a valid fh_count=1 regression still opens, reads, and unmounts cleanly.

References

NVD — CVE-2026-53392 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-53392
git.kernel.org/stable/c/18cc6d57a1... WEB
https://git.kernel.org/stable/c/18cc6d57a14fa65ab2a2b52279f549041c4bc9cf
git.kernel.org/stable/c/2131ed64b7... WEB
https://git.kernel.org/stable/c/2131ed64b767ffa8bcdb3677d90f3964e39aabc8
git.kernel.org/stable/c/2c6bb3c40b... WEB
https://git.kernel.org/stable/c/2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2
git.kernel.org/stable/c/7779c85028... WEB
https://git.kernel.org/stable/c/7779c85028a0676fb190cde4f0c540f4f8e97761
git.kernel.org/stable/c/9033591535... WEB
https://git.kernel.org/stable/c/9033591535c066726f5b505126ccb4068b98fa4f
git.kernel.org/stable/c/be7829715e... WEB
https://git.kernel.org/stable/c/be7829715e341b42846437dd9e721005db59f0cc
git.kernel.org/stable/c/d8c90c7cc0... WEB
https://git.kernel.org/stable/c/d8c90c7cc061265d5f2813a1f5c82ef2f4707e67
git.kernel.org/stable/c/eeabb90207... WEB
https://git.kernel.org/stable/c/eeabb9020721db6bc132e68eeae380b8d4fb4b04

Frequently Asked Questions

What is CVE-2026-53392?
CVE-2026-53392 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-20: Improper Input Validation.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-53392?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-53392?
CVE-2026-53392 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2026-53392?
CVE-2026-53392 is classified under CWE-20: Improper Input Validation (The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.).
How can I check Maven dependencies for CVE-2026-53392?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3gfh-mq5v-c264",
  "modified" : "2026-07-24T15:32:42Z",
  "published" : "2026-07-19T12:30:22Z",
  "aliases" : [ "CVE-2026-53392" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/flexfiles: reject zero filehandle version count\n\nff_layout_alloc_lseg() decodes the filehandle-version array count\nfrom the flexfiles layout body. The value is used as the count for\nkzalloc_objs(), and the current code only rejects NULL.\n\nA zero count yields ZERO_SIZE_PTR, which can be stored in\ndss_info->fh_versions even though later flexfiles paths assume that at\nleast one filehandle version exists.\n\nReject fh_count == 0 before the allocation, matching the existing zero\nversion_count validation in the flexfiles GETDEVICEINFO parser.\n\nA QEMU/KASAN run with a malformed flexfiles layout hit:\n\n  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n  RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750\n  ff_layout_encode_layoutreturn+0x683/0x970\n  nfs4_xdr_enc_layoutreturn+0x278/0x3a0\n  Kernel panic - not syncing: Fatal exception\n\nThe patched kernel rejects the malformed layout without KASAN/oops/panic,\nand a valid fh_count=1 regression still opens, reads, and unmounts cleanly.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-53392"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/18cc6d57a14fa65ab2a2b52279f549041c4bc9cf"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2131ed64b767ffa8bcdb3677d90f3964e39aabc8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/7779c85028a0676fb190cde4f0c540f4f8e97761"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9033591535c066726f5b505126ccb4068b98fa4f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/be7829715e341b42846437dd9e721005db59f0cc"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d8c90c7cc061265d5f2813a1f5c82ef2f4707e67"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/eeabb9020721db6bc132e68eeae380b8d4fb4b04"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20", "CWE-476" ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-07-19T12:16:50Z"
  }
}