CVE-2026-80603: Software Security Vulnerability Vulnerability

CRITICAL
Advisory Identifier: GHSA-66q8-v4rr-393c
Share
CVSS 9.1
Published
Advisory Summary

CVE-2026-80603 is a CRITICAL (CVSS 9.1) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-80603 at a Glance

CVE Identifier CVE-2026-80603
GHSA Identifier GHSA-66q8-v4rr-393c
Severity CRITICAL
CVSS v3.1 Base Score 9.1
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 9.1

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability None (A:N)

How to Fix CVE-2026-80603

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-80603, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read parse_dcc() treats data_end as an inclusive end pointer, but its only caller passes data_limit = ib_ptr + datalen, which points one past the last valid byte. The newline search loop iterates while tmp <= data_end, so when no newline is present, *tmp is read at tmp == data_end, one byte beyond the region filled by skb_header_pointer(). irc_buffer is kmalloc'd as MAX_SEARCH_SIZE + 1 bytes and datalen is capped at MAX_SEARCH_SIZE, so the stray read does not fault. The byte is uninitialized or stale; if it contains an ASCII digit, simple_strtoul will consume it and produce a wrong DCC IP or port in the conntrack expectation. The extra allocation byte is also a fragile guard: if the cap or allocation size changes, this becomes a real out-of-bounds read. Change the loop and its post-loop check to use strict less-than, consistent with the caller's exclusive-end convention. Update the function comment accordingly.

References

NVD — CVE-2026-80603 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-80603
git.kernel.org/stable/c/2393f0bd7a... WEB
https://git.kernel.org/stable/c/2393f0bd7a467ad475598f3a5b9de27ca36e3037
git.kernel.org/stable/c/2b70f61f56... WEB
https://git.kernel.org/stable/c/2b70f61f569bb29acb380e6f616a1bbdee15668f
git.kernel.org/stable/c/437e0a3854... WEB
https://git.kernel.org/stable/c/437e0a3854b3a44ec15afa9ab88ec215adf3a2fd
git.kernel.org/stable/c/910c33e4a8... WEB
https://git.kernel.org/stable/c/910c33e4a8c046c3cc1fa5a465a4d41a1bb398f1
git.kernel.org/stable/c/abb8c32b88... WEB
https://git.kernel.org/stable/c/abb8c32b88ea3f46beb68c34fe9a3ac8ed664e7e
git.kernel.org/stable/c/aff589556e... WEB
https://git.kernel.org/stable/c/aff589556ed772cb1c0c2d7b4d91ec45c0c39416
git.kernel.org/stable/c/eeef3b81f4... WEB
https://git.kernel.org/stable/c/eeef3b81f449560653662df2dde6f6fe247c5365
git.kernel.org/stable/c/ef6400ca25... WEB
https://git.kernel.org/stable/c/ef6400ca25a13fd6dedbe8ef4a1d0979bbbfe88a

Frequently Asked Questions

What is CVE-2026-80603?
CVE-2026-80603 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-80603?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-80603?
CVE-2026-80603 has a CVSS v3.1 base score of 9.1 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
What CWE is associated with CVE-2026-80603?
CVE-2026-80603 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-80603?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-66q8-v4rr-393c",
  "modified" : "2026-08-29T09:30:25Z",
  "published" : "2026-08-28T09:31:46Z",
  "aliases" : [ "CVE-2026-80603" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read\n\nparse_dcc() treats data_end as an inclusive end pointer, but its only\ncaller passes data_limit = ib_ptr + datalen, which points one past the\nlast valid byte.\n\nThe newline search loop iterates while tmp <= data_end, so when no\nnewline is present, *tmp is read at tmp == data_end, one byte beyond\nthe region filled by skb_header_pointer().\n\nirc_buffer is kmalloc'd as MAX_SEARCH_SIZE + 1 bytes and datalen is\ncapped at MAX_SEARCH_SIZE, so the stray read does not fault.  The byte\nis uninitialized or stale; if it contains an ASCII digit, simple_strtoul\nwill consume it and produce a wrong DCC IP or port in the conntrack\nexpectation.  The extra allocation byte is also a fragile guard: if the\ncap or allocation size changes, this becomes a real out-of-bounds read.\n\nChange the loop and its post-loop check to use strict less-than,\nconsistent with the caller's exclusive-end convention.  Update the\nfunction comment accordingly.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-80603"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2393f0bd7a467ad475598f3a5b9de27ca36e3037"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2b70f61f569bb29acb380e6f616a1bbdee15668f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/437e0a3854b3a44ec15afa9ab88ec215adf3a2fd"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/910c33e4a8c046c3cc1fa5a465a4d41a1bb398f1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/abb8c32b88ea3f46beb68c34fe9a3ac8ed664e7e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/aff589556ed772cb1c0c2d7b4d91ec45c0c39416"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/eeef3b81f449560653662df2dde6f6fe247c5365"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ef6400ca25a13fd6dedbe8ef4a1d0979bbbfe88a"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "CRITICAL",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-28T08:16:44Z"
  }
}