CVE-2026-31402: Software Security Vulnerability Vulnerability

CRITICAL
Advisory Identifier: GHSA-7xf5-3qmr-j4c6
Share
CVSS 9.8
CWE-122 CWE-787
Published
Advisory Summary

CVE-2026-31402 is a CRITICAL (CVSS 9.8) security vulnerability vulnerability (CWE-122: Heap-based Buffer Overflow) affecting Software libraries in the Maven ecosystem. The weakness occurs when a heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().. Remediation is available in the latest vendor maintenance releases.

CVE-2026-31402 at a Glance

CVE Identifier CVE-2026-31402
GHSA Identifier GHSA-7xf5-3qmr-j4c6
Severity CRITICAL
CVSS v3.1 Base Score 9.8
CWE Classification CWE-122: Heap-based Buffer Overflow
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-31402

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-31402, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-122: Heap-based Buffer Overflow, where a heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses. This size was calculated based on OPEN responses and does not account for LOCK denied responses, which include the conflicting lock owner as a variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT). When a LOCK operation is denied due to a conflict with an existing lock that has a large owner, nfsd4_encode_operation() copies the full encoded response into the undersized replay buffer via read_bytes_from_xdr_buf() with no bounds check. This results in a slab-out-of-bounds write of up to 944 bytes past the end of the buffer, corrupting adjacent heap memory. This can be triggered remotely by an unauthenticated attacker with two cooperating NFSv4.0 clients: one sets a lock with a large owner string, then the other requests a conflicting lock to provoke the denial. We could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full opaque, but that would increase the size of every stateowner, when most lockowners are not that large. Instead, fix this by checking the encoded response length against NFSD4_REPLAY_ISIZE before copying into the replay buffer. If the response is too large, set rp_buflen to 0 to skip caching the replay payload. The status is still cached, and the client already received the correct response on the original request.

References

NVD — CVE-2026-31402 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-31402
access.redhat.com/errata/rhsa-2026:10... WEB
https://access.redhat.com/errata/RHSA-2026:10108
access.redhat.com/errata/rhsa-2026:36... WEB
https://access.redhat.com/errata/RHSA-2026:36531
access.redhat.com/errata/rhsa-2026:36... WEB
https://access.redhat.com/errata/RHSA-2026:36532
access.redhat.com/errata/rhsa-2026:36... WEB
https://access.redhat.com/errata/RHSA-2026:36533
access.redhat.com/errata/rhsa-2026:36... WEB
https://access.redhat.com/errata/RHSA-2026:36534
Software Security Information SECURITY
https://access.redhat.com/security/cve/CVE-2026-31402
bugzilla.redhat.com/show_bug.cgi WEB
https://bugzilla.redhat.com/show_bug.cgi?id=2454844
cert-portal.siemens.com/productcert/html/ss... WEB
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
cert-portal.siemens.com/productcert/html/ss... WEB
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
cert-portal.siemens.com/productcert/html/ss... WEB
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
access.redhat.com/errata/rhsa-2026:11... WEB
https://access.redhat.com/errata/RHSA-2026:11313
git.kernel.org/stable/c/0f0e2a54a3... WEB
https://git.kernel.org/stable/c/0f0e2a54a31a7f9ad2915db99156114872317388
git.kernel.org/stable/c/2665887a69... WEB
https://git.kernel.org/stable/c/2665887a69437a8a4f552f69509eecfb73d4aa19
git.kernel.org/stable/c/5133b61aaf... WEB
https://git.kernel.org/stable/c/5133b61aaf437e5f25b1b396b14242a6bb0508e2
git.kernel.org/stable/c/8afb437ea1... WEB
https://git.kernel.org/stable/c/8afb437ea1f70cacb4bbdf11771fb5c4d720b965
git.kernel.org/stable/c/ae8498337d... WEB
https://git.kernel.org/stable/c/ae8498337dfdfda71bdd0b807c9a23a126011d76
git.kernel.org/stable/c/c9452c0797... WEB
https://git.kernel.org/stable/c/c9452c0797c95cf2378170df96cf4f4b3bca7eff
git.kernel.org/stable/c/dad0c3c0a8... WEB
https://git.kernel.org/stable/c/dad0c3c0a8e5d1d6eb0fc455694ce3e25e6c57d0
git.kernel.org/stable/c/f9fcb4441f... WEB
https://git.kernel.org/stable/c/f9fcb4441f6c02bb20c2eb340101e27dfe23607c
Software Security Information SECURITY
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31402.json
access.redhat.com/errata/rhsa-2026:13... WEB
https://access.redhat.com/errata/RHSA-2026:13565
access.redhat.com/errata/rhsa-2026:13... WEB
https://access.redhat.com/errata/RHSA-2026:13566
access.redhat.com/errata/rhsa-2026:13... WEB
https://access.redhat.com/errata/RHSA-2026:13577
access.redhat.com/errata/rhsa-2026:13... WEB
https://access.redhat.com/errata/RHSA-2026:13578
access.redhat.com/errata/rhsa-2026:13... WEB
https://access.redhat.com/errata/RHSA-2026:13664
access.redhat.com/errata/rhsa-2026:13... WEB
https://access.redhat.com/errata/RHSA-2026:13681
access.redhat.com/errata/rhsa-2026:13... WEB
https://access.redhat.com/errata/RHSA-2026:13734
access.redhat.com/errata/rhsa-2026:13... WEB
https://access.redhat.com/errata/RHSA-2026:13936
access.redhat.com/errata/rhsa-2026:14... WEB
https://access.redhat.com/errata/RHSA-2026:14137
access.redhat.com/errata/rhsa-2026:14... WEB
https://access.redhat.com/errata/RHSA-2026:14165
access.redhat.com/errata/rhsa-2026:14... WEB
https://access.redhat.com/errata/RHSA-2026:14301
access.redhat.com/errata/rhsa-2026:14... WEB
https://access.redhat.com/errata/RHSA-2026:14823
access.redhat.com/errata/rhsa-2026:14... WEB
https://access.redhat.com/errata/RHSA-2026:14869
access.redhat.com/errata/rhsa-2026:14... WEB
https://access.redhat.com/errata/RHSA-2026:14925
access.redhat.com/errata/rhsa-2026:15... WEB
https://access.redhat.com/errata/RHSA-2026:15883
access.redhat.com/errata/rhsa-2026:19... WEB
https://access.redhat.com/errata/RHSA-2026:19568
access.redhat.com/errata/rhsa-2026:19... WEB
https://access.redhat.com/errata/RHSA-2026:19569
access.redhat.com/errata/rhsa-2026:36... WEB
https://access.redhat.com/errata/RHSA-2026:36530

Frequently Asked Questions

What is CVE-2026-31402?
CVE-2026-31402 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-122: Heap-based Buffer Overflow.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-31402?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-31402?
CVE-2026-31402 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-31402?
CVE-2026-31402 is classified under CWE-122: Heap-based Buffer Overflow (A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().).
How can I check Maven dependencies for CVE-2026-31402?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-7xf5-3qmr-j4c6",
  "modified" : "2026-10-15T03:35:32Z",
  "published" : "2026-04-03T18:31:23Z",
  "aliases" : [ "CVE-2026-31402" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix heap overflow in NFSv4.0 LOCK replay cache\n\nThe NFSv4.0 replay cache uses a fixed 112-byte inline buffer\n(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.\nThis size was calculated based on OPEN responses and does not account\nfor LOCK denied responses, which include the conflicting lock owner as\na variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).\n\nWhen a LOCK operation is denied due to a conflict with an existing lock\nthat has a large owner, nfsd4_encode_operation() copies the full encoded\nresponse into the undersized replay buffer via read_bytes_from_xdr_buf()\nwith no bounds check. This results in a slab-out-of-bounds write of up\nto 944 bytes past the end of the buffer, corrupting adjacent heap memory.\n\nThis can be triggered remotely by an unauthenticated attacker with two\ncooperating NFSv4.0 clients: one sets a lock with a large owner string,\nthen the other requests a conflicting lock to provoke the denial.\n\nWe could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full\nopaque, but that would increase the size of every stateowner, when most\nlockowners are not that large.\n\nInstead, fix this by checking the encoded response length against\nNFSD4_REPLAY_ISIZE before copying into the replay buffer. If the\nresponse is too large, set rp_buflen to 0 to skip caching the replay\npayload. The status is still cached, and the client already received the\ncorrect response on the original request.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-31402"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:10108"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:36531"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:36532"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:36533"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:36534"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/CVE-2026-31402"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2454844"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0f0e2a54a31a7f9ad2915db99156114872317388"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2665887a69437a8a4f552f69509eecfb73d4aa19"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5133b61aaf437e5f25b1b396b14242a6bb0508e2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8afb437ea1f70cacb4bbdf11771fb5c4d720b965"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ae8498337dfdfda71bdd0b807c9a23a126011d76"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c9452c0797c95cf2378170df96cf4f4b3bca7eff"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/dad0c3c0a8e5d1d6eb0fc455694ce3e25e6c57d0"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f9fcb4441f6c02bb20c2eb340101e27dfe23607c"
  }, {
    "type" : "WEB",
    "url" : "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31402.json"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:11313"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:13565"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:13566"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:13577"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:13578"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:13664"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:13681"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:13734"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:13936"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:14137"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:14165"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:14301"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:14823"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:14869"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:14925"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:15883"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:19568"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:19569"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:36530"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-122", "CWE-787" ],
    "severity" : "CRITICAL",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-04-03T16:16:39Z"
  }
}