CVE-2026-53208: Software Security Vulnerability Vulnerability

MODERATE
Advisory Identifier: GHSA-hhxp-r7j7-v7jv
Share
CVSS 5.5
Published
Advisory Summary

CVE-2026-53208 is a MODERATE (CVSS 5.5) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-53208 at a Glance

CVE Identifier CVE-2026-53208
GHSA Identifier GHSA-hhxp-r7j7-v7jv
Severity MODERATE
CVSS v3.1 Base Score 5.5
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 5.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2026-53208

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-53208, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig net/bluetooth/l2cap_core.c:l2cap_sig_channel() accepts BR/EDR signaling packets up to the channel MTU and dispatches each command without enforcing the signaling MTU (MTUsig). A Bluetooth BR/EDR peer within radio range can send a fixed-channel CID 0x0001 packet that is larger than MTUsig and contains many L2CAP_ECHO_REQ commands before pairing. In a real-radio stock-kernel run, one 681-byte signaling packet containing 168 zero-length ECHO_REQ commands made the target transmit 168 ECHO_RSP frames over about 220 ms. Impact: a Bluetooth BR/EDR peer within radio range, before pairing, can force 168 ECHO_RSP frames from one 681-byte fixed-channel signaling packet containing packed ECHO_REQ commands. Define Linux's BR/EDR signaling MTU as the spec minimum of 48 bytes and reject any larger signaling packet with one L2CAP_COMMAND_REJECT_RSP carrying L2CAP_REJ_MTU_EXCEEDED before any command is dispatched. The Bluetooth Core spec wording for MTUExceeded says the reject identifier shall match the first request command in the packet, and that packets containing only responses shall be silently discarded. Linux intentionally deviates from that prescription: silently discarding desynchronizes the peer because the remote stack never learns its responses were dropped, and locating the first request command requires walking command headers past MTUsig, i.e. processing bytes from a packet we have already decided is too large to process. We therefore always emit one reject and use the identifier from the first command header, a single fixed-offset byte read. The unrestricted BR/EDR signaling parser and ECHO_REQ response path both trace to the initial git import; no later introducing commit is available for a Fixes tag.

References

NVD — CVE-2026-53208 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-53208
cert-portal.siemens.com/productcert/html/ss... WEB
https://cert-portal.siemens.com/productcert/html/ssa-784472.html
git.kernel.org/stable/c/214a2042b1... WEB
https://git.kernel.org/stable/c/214a2042b16b3c8d798a8b9ef9f36094f13a9859
git.kernel.org/stable/c/a8335f3db1... WEB
https://git.kernel.org/stable/c/a8335f3db15bd1e0e82e0db5d488fabc7d10d1ab
git.kernel.org/stable/c/b20e8a98dd... WEB
https://git.kernel.org/stable/c/b20e8a98dd29b121f58fcdf51e8576119aba536a
git.kernel.org/stable/c/dd21473354... WEB
https://git.kernel.org/stable/c/dd214733544427587a95f66dbf3adff072568990
git.kernel.org/stable/c/dedc92b96d... WEB
https://git.kernel.org/stable/c/dedc92b96dc1d8919a3bdf2495ede68922ef7ebc
git.kernel.org/stable/c/e05c4ac575... WEB
https://git.kernel.org/stable/c/e05c4ac575b457978a7ef441053394169084869c
git.kernel.org/stable/c/e2b8acf940... WEB
https://git.kernel.org/stable/c/e2b8acf9405bd9b1baf1c54dc897b0905db689bf
git.kernel.org/stable/c/fa58231262... WEB
https://git.kernel.org/stable/c/fa5823126239b3e453fac1a2fe50726c7f4a55e1

Frequently Asked Questions

What is CVE-2026-53208?
CVE-2026-53208 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-53208?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-53208?
CVE-2026-53208 has a CVSS v3.1 base score of 5.5 (MODERATE) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2026-53208?
CVE-2026-53208 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-53208?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-hhxp-r7j7-v7jv",
  "modified" : "2026-10-15T03:36:15Z",
  "published" : "2026-06-25T09:31:21Z",
  "aliases" : [ "CVE-2026-53208" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig\n\nnet/bluetooth/l2cap_core.c:l2cap_sig_channel() accepts BR/EDR\nsignaling packets up to the channel MTU and dispatches each command\nwithout enforcing the signaling MTU (MTUsig). A Bluetooth BR/EDR peer\nwithin radio range can send a fixed-channel CID 0x0001 packet that is\nlarger than MTUsig and contains many L2CAP_ECHO_REQ commands before\npairing. In a real-radio stock-kernel run, one 681-byte signaling\npacket containing 168 zero-length ECHO_REQ commands made the target\ntransmit 168 ECHO_RSP frames over about 220 ms.\n\nImpact: a Bluetooth BR/EDR peer within radio range, before pairing, can\nforce 168 ECHO_RSP frames from one 681-byte fixed-channel signaling\npacket containing packed ECHO_REQ commands.\n\nDefine Linux's BR/EDR signaling MTU as the spec minimum of 48 bytes and\nreject any larger signaling packet with one L2CAP_COMMAND_REJECT_RSP\ncarrying L2CAP_REJ_MTU_EXCEEDED before any command is dispatched.\n\nThe Bluetooth Core spec wording for MTUExceeded says the reject\nidentifier shall match the first request command in the packet, and\nthat packets containing only responses shall be silently discarded.\nLinux intentionally deviates from that prescription: silently\ndiscarding desynchronizes the peer because the remote stack never\nlearns its responses were dropped, and locating the first request\ncommand requires walking command headers past MTUsig, i.e. processing\nbytes from a packet we have already decided is too large to process.\nWe therefore always emit one reject and use the identifier from the\nfirst command header, a single fixed-offset byte read.\n\nThe unrestricted BR/EDR signaling parser and ECHO_REQ response path both\ntrace to the initial git import; no later introducing commit is\navailable for a Fixes tag.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-53208"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/214a2042b16b3c8d798a8b9ef9f36094f13a9859"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a8335f3db15bd1e0e82e0db5d488fabc7d10d1ab"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b20e8a98dd29b121f58fcdf51e8576119aba536a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/dd214733544427587a95f66dbf3adff072568990"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/dedc92b96dc1d8919a3bdf2495ede68922ef7ebc"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/e05c4ac575b457978a7ef441053394169084869c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/e2b8acf9405bd9b1baf1c54dc897b0905db689bf"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fa5823126239b3e453fac1a2fe50726c7f4a55e1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "MODERATE",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-06-25T09:16:38Z"
  }
}