CVE-2026-53332: Software Security Vulnerability Vulnerability

MODERATE
Advisory Identifier: GHSA-4447-2m4q-w32j
Share
CVSS 5.5
Published
Advisory Summary

CVE-2026-53332 is a MODERATE (CVSS 5.5) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-53332 at a Glance

CVE Identifier CVE-2026-53332
GHSA Identifier GHSA-4447-2m4q-w32j
Severity MODERATE
CVSS v3.1 Base Score 5.5
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 5.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2026-53332

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-53332, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd When the remoteproc starts in parallel with the NGD driver being probed, or the remoteproc is already up when the PDR lookup is being registered, or in the theoretical event that we get an interrupt from the hardware, these callbacks will operate on uninitialized data. This result in issues to boot the affected boards. One such example can be seen in the following fault, where qcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work. [ 21.858578] ------------[ cut here ]------------ [ 21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116 ... [ 21.859251] Call trace: [ 21.859255] __queue_work+0x5e0/0x790 (P) [ 21.859265] queue_work_on+0x6c/0xf0 [ 21.859273] qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl] [ 21.859304] qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl] [ 21.859318] notifier_call_chain+0xa4/0x230 [ 21.859329] srcu_notifier_call_chain+0x64/0xb8 [ 21.859338] ssr_notify_start+0x40/0x78 [qcom_common] [ 21.859355] rproc_start+0x130/0x230 [ 21.859367] rproc_boot+0x3d4/0x518 ... Move the enablement of interrupts, and the registration of SSR and PDR until after the NGD device has been registered. This could be further refined by moving initialization to the control driver probe and by removing the platform driver model from the picture.

References

NVD — CVE-2026-53332 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-53332
git.kernel.org/stable/c/08564e15c4... WEB
https://git.kernel.org/stable/c/08564e15c47a5fb0af6643a43ee15521d49bcdea
git.kernel.org/stable/c/2047eeb38d... WEB
https://git.kernel.org/stable/c/2047eeb38db878a31f58db19d98f8aedf284342e
git.kernel.org/stable/c/24ec89123f... WEB
https://git.kernel.org/stable/c/24ec89123fc9d0d24ce719dcf7fd6c57e5b0d753
git.kernel.org/stable/c/290014c798... WEB
https://git.kernel.org/stable/c/290014c7987636e6105bba89fa04cb4d59f775c1
git.kernel.org/stable/c/2a9d50e9ea... WEB
https://git.kernel.org/stable/c/2a9d50e9ea406e0c8735938484adc20515ef1b47
git.kernel.org/stable/c/946b97d632... WEB
https://git.kernel.org/stable/c/946b97d632f0f58a705dafac644c1e9346e01f35
git.kernel.org/stable/c/afc631e246... WEB
https://git.kernel.org/stable/c/afc631e246936a40558f494112a4188401382671
git.kernel.org/stable/c/fa3790c7ea... WEB
https://git.kernel.org/stable/c/fa3790c7ea98328ddc3f7d8bf40247556245a6fc

Frequently Asked Questions

What is CVE-2026-53332?
CVE-2026-53332 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-53332?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-53332?
CVE-2026-53332 has a CVSS v3.1 base score of 5.5 (MODERATE) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2026-53332?
CVE-2026-53332 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-53332?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-4447-2m4q-w32j",
  "modified" : "2026-07-24T15:32:37Z",
  "published" : "2026-07-01T15:35:19Z",
  "aliases" : [ "CVE-2026-53332" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nslimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd\n\nWhen the remoteproc starts in parallel with the NGD driver being probed,\nor the remoteproc is already up when the PDR lookup is being registered,\nor in the theoretical event that we get an interrupt from the hardware,\nthese callbacks will operate on uninitialized data. This result in\nissues to boot the affected boards.\n\nOne such example can be seen in the following fault, where\nqcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work.\n\n[   21.858578] ------------[ cut here ]------------\n[   21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116\n...\n[   21.859251] Call trace:\n[   21.859255]  __queue_work+0x5e0/0x790 (P)\n[   21.859265]  queue_work_on+0x6c/0xf0\n[   21.859273]  qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl]\n[   21.859304]  qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl]\n[   21.859318]  notifier_call_chain+0xa4/0x230\n[   21.859329]  srcu_notifier_call_chain+0x64/0xb8\n[   21.859338]  ssr_notify_start+0x40/0x78 [qcom_common]\n[   21.859355]  rproc_start+0x130/0x230\n[   21.859367]  rproc_boot+0x3d4/0x518\n...\n\nMove the enablement of interrupts, and the registration of SSR and PDR\nuntil after the NGD device has been registered.\n\nThis could be further refined by moving initialization to the control\ndriver probe and by removing the platform driver model from the picture.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-53332"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/08564e15c47a5fb0af6643a43ee15521d49bcdea"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2047eeb38db878a31f58db19d98f8aedf284342e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/24ec89123fc9d0d24ce719dcf7fd6c57e5b0d753"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/290014c7987636e6105bba89fa04cb4d59f775c1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2a9d50e9ea406e0c8735938484adc20515ef1b47"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/946b97d632f0f58a705dafac644c1e9346e01f35"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/afc631e246936a40558f494112a4188401382671"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fa3790c7ea98328ddc3f7d8bf40247556245a6fc"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "MODERATE",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-07-01T14:16:41Z"
  }
}