CVE-2026-68120: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-h9m4-2rpx-jm2g
Share
CVSS 7.5
Published
Advisory Summary

CVE-2026-68120 is a HIGH (CVSS 7.5) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-68120 at a Glance

CVE Identifier CVE-2026-68120
GHSA Identifier GHSA-h9m4-2rpx-jm2g
Severity HIGH
CVSS v3.1 Base Score 7.5
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2026-68120

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-68120, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: rtase: Workaround for TX hang caused by hardware packet parsing The hardware performs packet parsing before packet transmission. Parsing incomplete IPv4, IPv6, TCP, or UDP headers may trigger a TX hang because the hardware parser expects additional protocol header data that is not present in the packet. The hardware performs additional PTP parsing on UDP packets identified by destination ports 319/320 at the expected UDP destination port offset. If such a packet has transport data smaller than RTASE_MIN_PAD_LEN, the hardware parser expects additional packet data and may trigger a TX hang. To avoid these hardware issues, the driver applies the following workarounds. Drop malformed packets that may trigger this hardware issue before transmission. For IPv4 non-initial fragments, the hardware does not check the fragment offset before parsing the expected transport header location. As a result, these packets are still subject to transport header parsing even though they do not contain a transport header. If the transport data is shorter than the minimum transport header required by the hardware parser, pad the transport data to the minimum transport header length required by the hardware parser. Packets that also match the hardware PTP parsing conditions continue to follow the corresponding workaround. For IPv6 fragmented packets, neither of the above hardware issues occurs because the hardware only continues packet parsing when the IPv6 Base Header Next Header field directly indicates UDP. Packets carrying a Fragment Header do not continue through the subsequent packet parsing stages. For packets identified for hardware PTP parsing, pad the transport data so it reaches RTASE_MIN_PAD_LEN before transmission.

References

NVD — CVE-2026-68120 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-68120
git.kernel.org/stable/c/0f54f50486... WEB
https://git.kernel.org/stable/c/0f54f5048615e4e2802697855ea6374613548301
git.kernel.org/stable/c/1c50efa1fa... WEB
https://git.kernel.org/stable/c/1c50efa1faf3a1a96e100b07ec7a2f3164d90bee
git.kernel.org/stable/c/4a4f3aa6af... WEB
https://git.kernel.org/stable/c/4a4f3aa6af205bee539b5670afa2cd4e4953750e
git.kernel.org/stable/c/fe3a732071... WEB
https://git.kernel.org/stable/c/fe3a7320711eec6537e4890892f7ab9776d8618f

Frequently Asked Questions

What is CVE-2026-68120?
CVE-2026-68120 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-68120?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-68120?
CVE-2026-68120 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2026-68120?
CVE-2026-68120 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-68120?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-h9m4-2rpx-jm2g",
  "modified" : "2026-08-14T00:31:51Z",
  "published" : "2026-08-10T15:33:36Z",
  "aliases" : [ "CVE-2026-68120" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nrtase: Workaround for TX hang caused by hardware packet parsing\n\nThe hardware performs packet parsing before packet transmission.\nParsing incomplete IPv4, IPv6, TCP, or UDP headers may trigger a TX\nhang because the hardware parser expects additional protocol header\ndata that is not present in the packet.\n\nThe hardware performs additional PTP parsing on UDP packets identified\nby destination ports 319/320 at the expected UDP destination port\noffset.\n\nIf such a packet has transport data smaller than RTASE_MIN_PAD_LEN,\nthe hardware parser expects additional packet data and may trigger a\nTX hang.\n\nTo avoid these hardware issues, the driver applies the following\nworkarounds.\n\nDrop malformed packets that may trigger this hardware issue before\ntransmission.\n\nFor IPv4 non-initial fragments, the hardware does not check the\nfragment offset before parsing the expected transport header location.\nAs a result, these packets are still subject to transport header\nparsing even though they do not contain a transport header. If the\ntransport data is shorter than the minimum transport header required\nby the hardware parser, pad the transport data to the minimum\ntransport header length required by the hardware parser. Packets that\nalso match the hardware PTP parsing conditions continue to follow the\ncorresponding workaround.\n\nFor IPv6 fragmented packets, neither of the above hardware issues\noccurs because the hardware only continues packet parsing when the\nIPv6 Base Header Next Header field directly indicates UDP. Packets\ncarrying a Fragment Header do not continue through the subsequent\npacket parsing stages.\n\nFor packets identified for hardware PTP parsing, pad the transport\ndata so it reaches RTASE_MIN_PAD_LEN before transmission.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-68120"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0f54f5048615e4e2802697855ea6374613548301"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1c50efa1faf3a1a96e100b07ec7a2f3164d90bee"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4a4f3aa6af205bee539b5670afa2cd4e4953750e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fe3a7320711eec6537e4890892f7ab9776d8618f"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-10T13:19:57Z"
  }
}