CVE-2026-72160: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-42g7-hf2f-vfr8
Share
CVSS 8.8
Published
Advisory Summary

CVE-2026-72160 is a HIGH (CVSS 8.8) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-72160 at a Glance

CVE Identifier CVE-2026-72160
GHSA Identifier GHSA-42g7-hf2f-vfr8
Severity HIGH
CVSS v3.1 Base Score 8.8
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 8.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-72160

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-72160, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject dinodes with non-canonical i_mode type Patch series "ocfs2: harden inode validators against forged metadata", v2. This series adds three structural checks to OCFS2 dinode validation so malformed on-disk fields are rejected before ocfs2_populate_inode() copies them into the in-core inode. The checks cover: - i_mode values whose type bits do not name a canonical POSIX file type; - non-device dinodes whose id1.dev1.i_rdev field is non-zero; and - non-inline dinodes that claim non-zero i_size while i_clusters is zero, covering directories unconditionally and regular files on non-sparse volumes. The normal read path reports these through ocfs2_error(), matching the existing suballoc-slot, inline-data, chain-list, and refcount checks. The online filecheck path uses the same structural predicates but keeps its own reporting contract, returning OCFS2_FILECHECK_ERR_INVALIDINO instead of calling ocfs2_error(). This patch (of 3): ocfs2_validate_inode_block() currently accepts any non-zero i_mode value. ocfs2_populate_inode() then copies that mode verbatim into inode->i_mode and dispatches on i_mode & S_IFMT to the file/dir/symlink/special_file iops; an unrecognised type falls through to ocfs2_special_file_iops and init_special_inode(). Reject dinodes whose type bits do not name one of the seven canonical POSIX file types. Use fs_umode_to_ftype(), the same generic file-type conversion helper OCFS2 already uses for directory entries, so the accepted inode type set matches the kernel file-type vocabulary instead of open-coding a local switch. Apply the same structural check to the online filecheck read path. filecheck keeps its own error namespace, so it reports malformed i_mode through the filecheck logger and OCFS2_FILECHECK_ERR_INVALIDINO instead of calling ocfs2_error(), but it must not allow a malformed dinode to proceed into ocfs2_populate_inode().

References

NVD — CVE-2026-72160 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-72160
git.kernel.org/stable/c/157d31ef45... WEB
https://git.kernel.org/stable/c/157d31ef45038d89cd19620105e082d43c8e41e0
git.kernel.org/stable/c/2e3aac3398... WEB
https://git.kernel.org/stable/c/2e3aac33988ef4e4170141db8e995693ea38357c
git.kernel.org/stable/c/4db3b6a2a8... WEB
https://git.kernel.org/stable/c/4db3b6a2a8ecf2a89d26a4090ace4072c6fad050
git.kernel.org/stable/c/5366a01709... WEB
https://git.kernel.org/stable/c/5366a017099c6a3c443be908a05f26fd72af12a1
git.kernel.org/stable/c/82afe13558... WEB
https://git.kernel.org/stable/c/82afe13558354390d8a592a5334d5f4fd72c0e5c
git.kernel.org/stable/c/a5b555bcab... WEB
https://git.kernel.org/stable/c/a5b555bcabbb0aff8745ad181768eaf9d964c1ee
git.kernel.org/stable/c/b858f2d57c... WEB
https://git.kernel.org/stable/c/b858f2d57cfc9d57ce61b86051d603dc0ebccd40
git.kernel.org/stable/c/fb024ea29f... WEB
https://git.kernel.org/stable/c/fb024ea29f6cb1f01745e5f2e31646f3acb9aa6f

Frequently Asked Questions

What is CVE-2026-72160?
CVE-2026-72160 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-72160?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-72160?
CVE-2026-72160 has a CVSS v3.1 base score of 8.8 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-72160?
CVE-2026-72160 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-72160?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-42g7-hf2f-vfr8",
  "modified" : "2026-08-17T06:33:13Z",
  "published" : "2026-08-15T06:32:14Z",
  "aliases" : [ "CVE-2026-72160" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: reject dinodes with non-canonical i_mode type\n\nPatch series \"ocfs2: harden inode validators against forged metadata\", v2.\n\nThis series adds three structural checks to OCFS2 dinode validation so\nmalformed on-disk fields are rejected before ocfs2_populate_inode() copies\nthem into the in-core inode.\n\nThe checks cover:\n\n  - i_mode values whose type bits do not name a canonical POSIX file\n    type;\n  - non-device dinodes whose id1.dev1.i_rdev field is non-zero; and\n  - non-inline dinodes that claim non-zero i_size while i_clusters is\n    zero, covering directories unconditionally and regular files on\n    non-sparse volumes.\n\nThe normal read path reports these through ocfs2_error(), matching the\nexisting suballoc-slot, inline-data, chain-list, and refcount checks.  The\nonline filecheck path uses the same structural predicates but keeps its\nown reporting contract, returning OCFS2_FILECHECK_ERR_INVALIDINO instead\nof calling ocfs2_error().\n\n\nThis patch (of 3):\n\nocfs2_validate_inode_block() currently accepts any non-zero i_mode value. \nocfs2_populate_inode() then copies that mode verbatim into inode->i_mode\nand dispatches on i_mode & S_IFMT to the file/dir/symlink/special_file\niops; an unrecognised type falls through to ocfs2_special_file_iops and\ninit_special_inode().\n\nReject dinodes whose type bits do not name one of the seven canonical\nPOSIX file types.  Use fs_umode_to_ftype(), the same generic file-type\nconversion helper OCFS2 already uses for directory entries, so the\naccepted inode type set matches the kernel file-type vocabulary instead of\nopen-coding a local switch.\n\nApply the same structural check to the online filecheck read path. \nfilecheck keeps its own error namespace, so it reports malformed i_mode\nthrough the filecheck logger and OCFS2_FILECHECK_ERR_INVALIDINO instead of\ncalling ocfs2_error(), but it must not allow a malformed dinode to proceed\ninto ocfs2_populate_inode().",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-72160"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/157d31ef45038d89cd19620105e082d43c8e41e0"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2e3aac33988ef4e4170141db8e995693ea38357c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4db3b6a2a8ecf2a89d26a4090ace4072c6fad050"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5366a017099c6a3c443be908a05f26fd72af12a1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/82afe13558354390d8a592a5334d5f4fd72c0e5c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a5b555bcabbb0aff8745ad181768eaf9d964c1ee"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b858f2d57cfc9d57ce61b86051d603dc0ebccd40"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fb024ea29f6cb1f01745e5f2e31646f3acb9aa6f"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T06:21:33Z"
  }
}