CVE-2026-52955: Software Security Vulnerability Vulnerability

CRITICAL
Advisory Identifier: GHSA-jh5w-4gpm-r5xw
Share
CVSS 9.8
CWE-125 CWE-131
Published
Advisory Summary

CVE-2026-52955 is a CRITICAL (CVSS 9.8) security vulnerability vulnerability (CWE-125: Out-of-bounds Read) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product reads data past the end, or before the beginning, of the intended buffer.. Remediation is available in the latest vendor maintenance releases.

CVE-2026-52955 at a Glance

CVE Identifier CVE-2026-52955
GHSA Identifier GHSA-jh5w-4gpm-r5xw
Severity CRITICAL
CVSS v3.1 Base Score 9.8
CWE Classification CWE-125: Out-of-bounds Read
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-52955

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-52955, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-125: Out-of-bounds Read, where the product reads data past the end, or before the beginning, of the intended buffer. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in crush_decode() A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one bucket has two fields holding the bucket algorithm. If the values in these two fields differ, an out-of-bounds access can occur. This is the case because the first algorithm field (alg) is used to allocate the correct amount of memory for a bucket of this type, while the second algorithm field inside the bucket (b->alg) is used in the subsequent processing. This patch fixes the issue by adding a check that compares alg and b->alg and aborts the processing in case they differ. Furthermore, b->alg is set to 0 in this case, because the destruction of the crush map also uses this field to determine the bucket type, which can again result in an out-of-bounds access when trying to free the memory pointed to by the fields of the bucket. To correctly free the memory allocated for the bucket in such a case, the corresponding call to kfree is moved from the algorithm-specific crush_destroy_bucket functions to the generic crush_destroy_bucket().

References

NVD — CVE-2026-52955 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-52955
Software Security Information SECURITY
https://access.redhat.com/security/cve/CVE-2026-52955
bugzilla.redhat.com/show_bug.cgi WEB
https://bugzilla.redhat.com/show_bug.cgi?id=2492328
git.kernel.org/stable/c/0f3604cbe4... WEB
https://git.kernel.org/stable/c/0f3604cbe4df14c5e58288ac9f57511e726a222d
git.kernel.org/stable/c/3f42508191... WEB
https://git.kernel.org/stable/c/3f42508191e129ee6b5ea96578d5cab14f2a013a
git.kernel.org/stable/c/4c79fc2d59... WEB
https://git.kernel.org/stable/c/4c79fc2d598694bda845b46229c9d48b65042970
git.kernel.org/stable/c/6e70ef53e8... WEB
https://git.kernel.org/stable/c/6e70ef53e818c53eab28d7b0026b7fd03dddaba5
git.kernel.org/stable/c/cceb10023e... WEB
https://git.kernel.org/stable/c/cceb10023e76bc89f3fe9238ebd0ccab0fc7c7c5
git.kernel.org/stable/c/ea0d42137f... WEB
https://git.kernel.org/stable/c/ea0d42137f0c06da71e37ffc647aab4c5309599a
git.kernel.org/stable/c/ebe76d58a4... WEB
https://git.kernel.org/stable/c/ebe76d58a48a48031b98543d86c4cd30a825b622
git.kernel.org/stable/c/fb176a99e4... WEB
https://git.kernel.org/stable/c/fb176a99e4c1a5a8448a83d83d3606203ba81faa
Software Security Information SECURITY
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52955.json

Frequently Asked Questions

What is CVE-2026-52955?
CVE-2026-52955 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-125: Out-of-bounds Read.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-52955?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-52955?
CVE-2026-52955 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-52955?
CVE-2026-52955 is classified under CWE-125: Out-of-bounds Read (The product reads data past the end, or before the beginning, of the intended buffer.).
How can I check Maven dependencies for CVE-2026-52955?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jh5w-4gpm-r5xw",
  "modified" : "2026-06-30T03:37:11Z",
  "published" : "2026-06-24T18:32:41Z",
  "aliases" : [ "CVE-2026-52955" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix potential out-of-bounds access in crush_decode()\n\nA message of type CEPH_MSG_OSD_MAP containing a crush map with at least\none bucket has two fields holding the bucket algorithm. If the values\nin these two fields differ, an out-of-bounds access can occur. This is\nthe case because the first algorithm field (alg) is used to allocate\nthe correct amount of memory for a bucket of this type, while the second\nalgorithm field inside the bucket (b->alg) is used in the subsequent\nprocessing.\n\nThis patch fixes the issue by adding a check that compares alg and\nb->alg and aborts the processing in case they differ. Furthermore,\nb->alg is set to 0 in this case, because the destruction of the crush\nmap also uses this field to determine the bucket type, which can again\nresult in an out-of-bounds access when trying to free the memory pointed\nto by the fields of the bucket. To correctly free the memory allocated\nfor the bucket in such a case, the corresponding call to kfree is moved\nfrom the algorithm-specific crush_destroy_bucket functions to the\ngeneric crush_destroy_bucket().",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-52955"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/CVE-2026-52955"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2492328"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0f3604cbe4df14c5e58288ac9f57511e726a222d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3f42508191e129ee6b5ea96578d5cab14f2a013a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4c79fc2d598694bda845b46229c9d48b65042970"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6e70ef53e818c53eab28d7b0026b7fd03dddaba5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/cceb10023e76bc89f3fe9238ebd0ccab0fc7c7c5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ea0d42137f0c06da71e37ffc647aab4c5309599a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ebe76d58a48a48031b98543d86c4cd30a825b622"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fb176a99e4c1a5a8448a83d83d3606203ba81faa"
  }, {
    "type" : "WEB",
    "url" : "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52955.json"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-125", "CWE-131" ],
    "severity" : "CRITICAL",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-06-24T17:17:05Z"
  }
}