CVE-2026-90112: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-8m8v-32h4-xj63
Share
Published
Advisory Summary

CVE-2026-90112 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-90112 at a Glance

CVE Identifier CVE-2026-90112
GHSA Identifier GHSA-8m8v-32h4-xj63
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-90112

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-90112, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: net: qlcnic: validate unified ROM sections before loading The unified ROM parser reads directory, product, and data-descriptor fields from the firmware file. Existing validation forms table and data ends with unchecked additions and multiplications. Malformed values can wrap before they are compared with the firmware size. The parser also dereferences typed pointers at firmware-controlled offsets. Valid descriptor extents alone are insufficient for the consumers. The loader reads a fixed-size bootloader regardless of its declared size, the version parser assumes a 17-byte tail, and a partial final firmware word is read as a full u64. A truncated image can therefore make the driver read beyond the firmware allocation during validation or loading. Replace the pointer-returning parser with bounded range helpers. Validate table entry sizes, descriptor indices, section ranges, the fixed bootloader load length, and the version tail before exposing any section. Read all file fields with unaligned little-endian accessors and assemble a partial final word from only the bytes that remain. Apply the same range checks to the legacy image before reading its fixed fields.

References

NVD — CVE-2026-90112 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90112
git.kernel.org/stable/c/4be733a450... WEB
https://git.kernel.org/stable/c/4be733a450c86938c91f9c70a56802ef5069764c
git.kernel.org/stable/c/5e8076e4e4... WEB
https://git.kernel.org/stable/c/5e8076e4e4124dae75a3e080ddc20404700d7585
git.kernel.org/stable/c/684773c4d2... WEB
https://git.kernel.org/stable/c/684773c4d26f7f2211beb31fb90629216f8a61f5
git.kernel.org/stable/c/b9efc17770... WEB
https://git.kernel.org/stable/c/b9efc177703a03312cc2f6e6a4bbd4595e8158a1

Frequently Asked Questions

What is CVE-2026-90112?
CVE-2026-90112 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-90112?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-90112?
CVE-2026-90112 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-90112?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8m8v-32h4-xj63",
  "modified" : "2026-09-17T18:31:51Z",
  "published" : "2026-09-17T18:31:51Z",
  "aliases" : [ "CVE-2026-90112" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qlcnic: validate unified ROM sections before loading\n\nThe unified ROM parser reads directory, product, and data-descriptor fields\nfrom the firmware file.  Existing validation forms table and data ends with\nunchecked additions and multiplications.  Malformed values can wrap before\nthey are compared with the firmware size.  The parser also dereferences\ntyped pointers at firmware-controlled offsets.\n\nValid descriptor extents alone are insufficient for the consumers.  The\nloader reads a fixed-size bootloader regardless of its declared size, the\nversion parser assumes a 17-byte tail, and a partial final firmware word is\nread as a full u64.  A truncated image can therefore make the driver read\nbeyond the firmware allocation during validation or loading.\n\nReplace the pointer-returning parser with bounded range helpers.  Validate\ntable entry sizes, descriptor indices, section ranges, the fixed\nbootloader load length, and the version tail before exposing any section.\nRead all file fields with unaligned little-endian accessors and assemble a\npartial final word from only the bytes that remain.  Apply the same range\nchecks to the legacy image before reading its fixed fields.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-90112"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4be733a450c86938c91f9c70a56802ef5069764c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5e8076e4e4124dae75a3e080ddc20404700d7585"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/684773c4d26f7f2211beb31fb90629216f8a61f5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b9efc177703a03312cc2f6e6a4bbd4595e8158a1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-17T17:17:03Z"
  }
}