CVE-2026-72115: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-hg3w-cj7m-96gr
Share
CVSS 8.1
Published
Advisory Summary

CVE-2026-72115 is a HIGH (CVSS 8.1) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-72115 at a Glance

CVE Identifier CVE-2026-72115
GHSA Identifier GHSA-hg3w-cj7m-96gr
Severity HIGH
CVSS v3.1 Base Score 8.1
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 8.1

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Attack Vector Adjacent (AV:A)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability None (A:N)

How to Fix CVE-2026-72115

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-72115, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op (ifindex == 0) with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces: bcm_rx_handler() can run concurrently for the same op on different CPUs, racing hrtimer_cancel()/ bcm_rx_starttimer() against bcm_rx_timeout_handler() and causing spurious RX_TIMEOUT notifications and last_frames corruption. The same concurrency lets throttled multiplex frames from different interfaces clobber the single rx_ifindex/rx_stamp fields shared by the op. Add op->if_detected to track the first interface that delivers a matching frame while a timeout/throttle timer is configured, and reject frames from any other interface for that op. The claim is decided in bcm_rx_handler() before hrtimer_cancel() touches op->timer, so a rejected frame can never disturb the claimed interface's watchdog. RTR-mode ops are excluded via RX_RTR_FRAME, independent of kt_ival1/kt_ival2, since those may briefly hold a stale value from an earlier non-RTR configuration. The claim is released in bcm_notify() on NETDEV_UNREGISTER and in bcm_rx_setup() when SETTIMER reconfigures the timer values. A (re-)claim is only possible on CAN devices in NETREG_REGISTERED dev->reg_state to cover the release in bcm_notify() where reg_state becomes NETREG_UNREGISTERING until synchronize_net().

References

NVD — CVE-2026-72115 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-72115
git.kernel.org/stable/c/03dfe347c3... WEB
https://git.kernel.org/stable/c/03dfe347c398fa41a7e30e8dc538f12568c183e6
git.kernel.org/stable/c/18b45251e7... WEB
https://git.kernel.org/stable/c/18b45251e74e35668f0dd0c470549384ae191ecf
git.kernel.org/stable/c/2f5976f54a... WEB
https://git.kernel.org/stable/c/2f5976f54a04e9f18b25283036ac3136be453b17
git.kernel.org/stable/c/3ff8c24b42... WEB
https://git.kernel.org/stable/c/3ff8c24b421070a2db99a5cdb86edc9ff339418e
git.kernel.org/stable/c/57cf104da4... WEB
https://git.kernel.org/stable/c/57cf104da4cf450ae9c16801a3164604b801d2cc
git.kernel.org/stable/c/b6317022b6... WEB
https://git.kernel.org/stable/c/b6317022b685a430a3ae420456716e3c0c02ef4b
git.kernel.org/stable/c/eca8b44d51... WEB
https://git.kernel.org/stable/c/eca8b44d51fc6ab61022258ec968e55e3073b79e
git.kernel.org/stable/c/f147f48837... WEB
https://git.kernel.org/stable/c/f147f48837cb1426521f5b3c3b3134c71128a25d

Frequently Asked Questions

What is CVE-2026-72115?
CVE-2026-72115 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-72115?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-72115?
CVE-2026-72115 has a CVSS v3.1 base score of 8.1 (HIGH) with vector string CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
What CWE is associated with CVE-2026-72115?
CVE-2026-72115 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-72115?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-hg3w-cj7m-96gr",
  "modified" : "2026-08-19T18:32:27Z",
  "published" : "2026-08-15T06:32:12Z",
  "aliases" : [ "CVE-2026-72115" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: track a single source interface for ANYDEV timeout/throttle ops\n\nAn ANYDEV rx op (ifindex == 0) with an active RX timeout and/or\nthrottle timer has no defined semantics when matching frames arrive\nfrom several interfaces: bcm_rx_handler() can run concurrently for\nthe same op on different CPUs, racing hrtimer_cancel()/\nbcm_rx_starttimer() against bcm_rx_timeout_handler() and causing\nspurious RX_TIMEOUT notifications and last_frames corruption. The\nsame concurrency lets throttled multiplex frames from different\ninterfaces clobber the single rx_ifindex/rx_stamp fields shared by\nthe op.\n\nAdd op->if_detected to track the first interface that delivers a\nmatching frame while a timeout/throttle timer is configured, and\nreject frames from any other interface for that op. The claim is\ndecided in bcm_rx_handler() before hrtimer_cancel() touches\nop->timer, so a rejected frame can never disturb the claimed\ninterface's watchdog. RTR-mode ops are excluded via RX_RTR_FRAME,\nindependent of kt_ival1/kt_ival2, since those may briefly hold a\nstale value from an earlier non-RTR configuration.\n\nThe claim is released in bcm_notify() on NETDEV_UNREGISTER and in\nbcm_rx_setup() when SETTIMER reconfigures the timer values.\n\nA (re-)claim is only possible on CAN devices in NETREG_REGISTERED\ndev->reg_state to cover the release in bcm_notify() where reg_state\nbecomes NETREG_UNREGISTERING until synchronize_net().",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-72115"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/03dfe347c398fa41a7e30e8dc538f12568c183e6"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/18b45251e74e35668f0dd0c470549384ae191ecf"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2f5976f54a04e9f18b25283036ac3136be453b17"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3ff8c24b421070a2db99a5cdb86edc9ff339418e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/57cf104da4cf450ae9c16801a3164604b801d2cc"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b6317022b685a430a3ae420456716e3c0c02ef4b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/eca8b44d51fc6ab61022258ec968e55e3073b79e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f147f48837cb1426521f5b3c3b3134c71128a25d"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T06:21:25Z"
  }
}