CVE-2026-64116: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-6p6q-g32r-gx25
Share
CVSS 7.5
CWE-476
Published
Advisory Summary

CVE-2026-64116 is a HIGH (CVSS 7.5) security vulnerability vulnerability (CWE-476: NULL Pointer Dereference) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product dereferences a pointer that it expects to be valid but is null.. Remediation is available in the latest vendor maintenance releases.

CVE-2026-64116 at a Glance

CVE Identifier CVE-2026-64116
GHSA Identifier GHSA-6p6q-g32r-gx25
Severity HIGH
CVSS v3.1 Base Score 7.5
CWE Classification CWE-476: NULL Pointer Dereference
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2026-64116

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-64116, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-476: NULL Pointer Dereference, where the product dereferences a pointer that it expects to be valid but is null. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() Reported by Sashiko: The function ipv6_hop_ioam() accesses __in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned idev pointer. Because addrconf_ifdown() can concurrently clear dev->ip6_ptr via RCU, __in6_dev_get() can return NULL during interface teardown, which could cause a NULL pointer dereference when processing an IOAM Hop-by-Hop option. Let's add a check and use SKB_DROP_REASON_IPV6DISABLED accordingly.

References

NVD — CVE-2026-64116 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-64116
git.kernel.org/stable/c/09cbfd4b81... WEB
https://git.kernel.org/stable/c/09cbfd4b81ae90963dadb1de99b63b702e73290a
git.kernel.org/stable/c/1dca7e491f... WEB
https://git.kernel.org/stable/c/1dca7e491f070ac49b3d934f16ee953a53b37f38
git.kernel.org/stable/c/902daac307... WEB
https://git.kernel.org/stable/c/902daac307eb7e1955ce05b071950f3cba88c963
git.kernel.org/stable/c/abdd032294... WEB
https://git.kernel.org/stable/c/abdd03229414b5a52943b65a60f34b84cea5ac59
git.kernel.org/stable/c/c7e8971abd... WEB
https://git.kernel.org/stable/c/c7e8971abd70e9d022f1c251ba2508f8dc7f2db8
git.kernel.org/stable/c/cf75eb6617... WEB
https://git.kernel.org/stable/c/cf75eb6617042c8cff6112daeed7791809fc9dd2
git.kernel.org/stable/c/d4ea0dfd75... WEB
https://git.kernel.org/stable/c/d4ea0dfd75011b78cebf3808f98ac4c4f51a6fb9

Frequently Asked Questions

What is CVE-2026-64116?
CVE-2026-64116 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-476: NULL Pointer Dereference.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-64116?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-64116?
CVE-2026-64116 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2026-64116?
CVE-2026-64116 is classified under CWE-476: NULL Pointer Dereference (The product dereferences a pointer that it expects to be valid but is NULL.).
How can I check Maven dependencies for CVE-2026-64116?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-6p6q-g32r-gx25",
  "modified" : "2026-07-20T15:32:00Z",
  "published" : "2026-07-19T18:31:52Z",
  "aliases" : [ "CVE-2026-64116" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ioam: add NULL check for idev in ipv6_hop_ioam()\n\nReported by Sashiko:\n\nThe function ipv6_hop_ioam() accesses\n__in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned\nidev pointer. Because addrconf_ifdown() can concurrently clear dev->ip6_ptr\nvia RCU, __in6_dev_get() can return NULL during interface teardown, which\ncould cause a NULL pointer dereference when processing an IOAM Hop-by-Hop\noption.\n\nLet's add a check and use SKB_DROP_REASON_IPV6DISABLED accordingly.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-64116"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/09cbfd4b81ae90963dadb1de99b63b702e73290a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1dca7e491f070ac49b3d934f16ee953a53b37f38"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/902daac307eb7e1955ce05b071950f3cba88c963"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/abdd03229414b5a52943b65a60f34b84cea5ac59"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c7e8971abd70e9d022f1c251ba2508f8dc7f2db8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/cf75eb6617042c8cff6112daeed7791809fc9dd2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d4ea0dfd75011b78cebf3808f98ac4c4f51a6fb9"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-476" ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-07-19T16:17:53Z"
  }
}