CVE-2026-74402: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-5f8p-9776-4575
Share
Published
Advisory Summary

CVE-2026-74402 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-74402 at a Glance

CVE Identifier CVE-2026-74402
GHSA Identifier GHSA-5f8p-9776-4575
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-74402

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-74402, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix blocking and non-blocking rng logic The blocking and non-blocking paths were failing to provide valid entropy due to improper buffer management. Reading the buffer starting from byte 1, only fetch the 32 bytes of random data from the return message. Tested on an Atmel SHA204A device. Before (here for blocking), tests showed repeatedly reading reduced bytes. $ head -c 32 /dev/hwrng | hexdump -C 00000000 02 28 85 b3 47 40 f2 ee 00 00 00 00 00 00 00 00 |.(..G@..........| 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000020 After, the result will be similar to the following: $ head -c 32 /dev/hwrng | hexdump -C 00000000 5a fc 3f 13 14 68 fe 06 68 0a bd 04 83 6e 09 69 |Z.?..h..h....n.i| 00000010 75 ff cf 87 10 84 3b c9 c1 df ae eb 45 53 4c c3 |u.....;.....ESL.| 00000020

References

NVD — CVE-2026-74402 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-74402
git.kernel.org/stable/c/2fa302bbc6... WEB
https://git.kernel.org/stable/c/2fa302bbc62dec7cb6339c9494e0e3f2f884afeb
git.kernel.org/stable/c/319400fc5e... WEB
https://git.kernel.org/stable/c/319400fc5ee15db5793aa45f854968141326effc
git.kernel.org/stable/c/76269a91fd... WEB
https://git.kernel.org/stable/c/76269a91fd9560c5f03c3e59421a0329e39a6661
git.kernel.org/stable/c/9039bb4f23... WEB
https://git.kernel.org/stable/c/9039bb4f238474379221fc933c34f19f0cba501b
git.kernel.org/stable/c/938ae1fb4a... WEB
https://git.kernel.org/stable/c/938ae1fb4a8f5db43b62b6206d409efbf317f0d9
git.kernel.org/stable/c/aac63bbea8... WEB
https://git.kernel.org/stable/c/aac63bbea8fd5a34f1a4305cb73369068f952d32
git.kernel.org/stable/c/d4aa6141ff... WEB
https://git.kernel.org/stable/c/d4aa6141ff03ec82eed6fcef814300fb855ce5d8
git.kernel.org/stable/c/e833e865e4... WEB
https://git.kernel.org/stable/c/e833e865e4944ba75120db534bd931db6cf677d3

Frequently Asked Questions

What is CVE-2026-74402?
CVE-2026-74402 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-74402?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-74402?
CVE-2026-74402 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-74402?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5f8p-9776-4575",
  "modified" : "2026-08-15T06:32:32Z",
  "published" : "2026-08-15T06:32:32Z",
  "aliases" : [ "CVE-2026-74402" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: atmel-sha204a - fix blocking and non-blocking rng logic\n\nThe blocking and non-blocking paths were failing to provide valid entropy\ndue to improper buffer management. Reading the buffer starting from byte 1,\nonly fetch the 32 bytes of random data from the return message.\n\nTested on an Atmel SHA204A device.\n\nBefore (here for blocking), tests showed repeatedly reading reduced bytes.\n$ head -c 32 /dev/hwrng | hexdump -C\n00000000  02 28 85 b3 47 40 f2 ee  00 00 00 00 00 00 00 00  |.(..G@..........|\n00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|\n00000020\n\nAfter, the result will be similar to the following:\n$ head -c 32 /dev/hwrng | hexdump -C\n00000000  5a fc 3f 13 14 68 fe 06  68 0a bd 04 83 6e 09 69  |Z.?..h..h....n.i|\n00000010  75 ff cf 87 10 84 3b c9  c1 df ae eb 45 53 4c c3  |u.....;.....ESL.|\n00000020",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-74402"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2fa302bbc62dec7cb6339c9494e0e3f2f884afeb"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/319400fc5ee15db5793aa45f854968141326effc"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/76269a91fd9560c5f03c3e59421a0329e39a6661"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9039bb4f238474379221fc933c34f19f0cba501b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/938ae1fb4a8f5db43b62b6206d409efbf317f0d9"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/aac63bbea8fd5a34f1a4305cb73369068f952d32"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d4aa6141ff03ec82eed6fcef814300fb855ce5d8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/e833e865e4944ba75120db534bd931db6cf677d3"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T06:22:42Z"
  }
}