CVE-2026-93787: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-59gw-x2m7-5p58
Share
CVSS 8.1
Published
Advisory Summary

CVE-2026-93787 is a HIGH (CVSS 8.1) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-93787 at a Glance

CVE Identifier CVE-2026-93787
GHSA Identifier GHSA-59gw-x2m7-5p58
Severity HIGH
CVSS v3.1 Base Score 8.1
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 8.1

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction Required (UI:R)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2026-93787

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-93787, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against end of SMB response in cifs_filldir cifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST / FIND_NEXT response using a length (de.namelen) supplied by the server. The kmalloc'd SMB response buffer is bounded, but nothing checks that de.name + de.namelen still lies inside that buffer before the eventual filldir64() -> verify_dirent_name() -> memchr() reads namelen bytes. A hostile SMB1 server that returns an oversized FileNameLength in a directory entry therefore causes memchr() to read past the end of the response slab buffer. Reachable from any user who can list a directory on a CIFS mount served by an attacker-controlled server (getdents64() on the mounted directory): BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80 Read of size 1 at addr ffff88800e0640cc by task poc/115 Call Trace: dump_stack_lvl+0x64/0x80 print_report+0xce/0x620 kasan_report+0xec/0x120 memchr+0x71/0x80 filldir64+0x4c/0x6a0 cifs_filldir.constprop.0+0x9bb/0x1e00 cifs_readdir+0x2101/0x3380 iterate_dir+0x19c/0x520 __x64_sys_getdents64+0x126/0x210 do_syscall_64+0x107/0x5a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Pass the end-of-response pointer down to cifs_filldir() and reject entries whose name would extend past that boundary. This bug was discovered by Artiphishell's vTriage pipeline, which generated a userspace reproducer (an emulated hostile SMB1 server plus a getdents64() client) that reliably triggers the KASAN report on an unpatched kernel. The fix below was drafted with the Claude coding assistant; a userspace reproducer is available on request.

References

NVD — CVE-2026-93787 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93787
git.kernel.org/stable/c/03003506c8... WEB
https://git.kernel.org/stable/c/03003506c86f90312b0966283662c42fcab66e4b
git.kernel.org/stable/c/4cb3d79bee... WEB
https://git.kernel.org/stable/c/4cb3d79beee0fecc739ce07af915d503f29ae557
git.kernel.org/stable/c/6e3b965267... WEB
https://git.kernel.org/stable/c/6e3b965267b7313903baba2739992b1e2e92d540
git.kernel.org/stable/c/cf87ef1e62... WEB
https://git.kernel.org/stable/c/cf87ef1e62ed31a439064cef69d6eec38c68bd92
git.kernel.org/stable/c/f8cf09a53a... WEB
https://git.kernel.org/stable/c/f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6

Frequently Asked Questions

What is CVE-2026-93787?
CVE-2026-93787 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-93787?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-93787?
CVE-2026-93787 has a CVSS v3.1 base score of 8.1 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H.
What CWE is associated with CVE-2026-93787?
CVE-2026-93787 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-93787?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-59gw-x2m7-5p58",
  "modified" : "2026-10-03T12:31:08Z",
  "published" : "2026-09-24T18:31:28Z",
  "aliases" : [ "CVE-2026-93787" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: bound dirent name against end of SMB response in cifs_filldir\n\ncifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST /\nFIND_NEXT response using a length (de.namelen) supplied by the server.\nThe kmalloc'd SMB response buffer is bounded, but nothing checks that\nde.name + de.namelen still lies inside that buffer before the eventual\nfilldir64() -> verify_dirent_name() -> memchr() reads namelen bytes.\n\nA hostile SMB1 server that returns an oversized FileNameLength in a\ndirectory entry therefore causes memchr() to read past the end of the\nresponse slab buffer. Reachable from any user who can list a directory\non a CIFS mount served by an attacker-controlled server (getdents64()\non the mounted directory):\n\n  BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80\n  Read of size 1 at addr ffff88800e0640cc by task poc/115\n  Call Trace:\n   dump_stack_lvl+0x64/0x80\n   print_report+0xce/0x620\n   kasan_report+0xec/0x120\n   memchr+0x71/0x80\n   filldir64+0x4c/0x6a0\n   cifs_filldir.constprop.0+0x9bb/0x1e00\n   cifs_readdir+0x2101/0x3380\n   iterate_dir+0x19c/0x520\n   __x64_sys_getdents64+0x126/0x210\n   do_syscall_64+0x107/0x5a0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nPass the end-of-response pointer down to cifs_filldir() and reject\nentries whose name would extend past that boundary.\n\nThis bug was discovered by Artiphishell's vTriage pipeline, which\ngenerated a userspace reproducer (an emulated hostile SMB1 server plus\na getdents64() client) that reliably triggers the KASAN report on an\nunpatched kernel. The fix below was drafted with the Claude coding\nassistant; a userspace reproducer is available on request.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-93787"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/03003506c86f90312b0966283662c42fcab66e4b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4cb3d79beee0fecc739ce07af915d503f29ae557"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6e3b965267b7313903baba2739992b1e2e92d540"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/cf87ef1e62ed31a439064cef69d6eec38c68bd92"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-24T17:17:11Z"
  }
}