CVE-2026-72149: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-jjfr-vvvg-vj2f
Share
CVSS 7.5
Published
Advisory Summary

CVE-2026-72149 is a HIGH (CVSS 7.5) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-72149 at a Glance

CVE Identifier CVE-2026-72149
GHSA Identifier GHSA-jjfr-vvvg-vj2f
Severity HIGH
CVSS v3.1 Base Score 7.5
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2026-72149

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-72149, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra: Fix burst size calculation Currently, the Tegra GPC DMA hardware requires the transfer length to be a multiple of the max burst size configured for the channel. When a client requests a transfer where the length is not evenly divisible by the configured max burst size, the DMA hangs with partial burst at the end. Fix this by reducing the burst size to the largest power-of-2 value that evenly divides the transfer length. For example, a 40-byte transfer with a 16-byte max burst will now use an 8-byte burst (40 / 8 = 5 complete bursts) instead of causing a hang. This issue was observed with the PL011 UART driver where TX DMA transfers of arbitrary lengths were stuck.

References

NVD — CVE-2026-72149 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-72149
git.kernel.org/stable/c/4651df83b6... WEB
https://git.kernel.org/stable/c/4651df83b6c796daead3447e8fd874322918ee4f
git.kernel.org/stable/c/6e37e9e230... WEB
https://git.kernel.org/stable/c/6e37e9e230c7e848bd8e8cd4db15bb18bcf11ad1
git.kernel.org/stable/c/735951baa3... WEB
https://git.kernel.org/stable/c/735951baa311c66353405dcac39375dd66441db0
git.kernel.org/stable/c/7926c1e4be... WEB
https://git.kernel.org/stable/c/7926c1e4be86379945fb5f168888ac4d2aaf6c91
git.kernel.org/stable/c/8f0f5de109... WEB
https://git.kernel.org/stable/c/8f0f5de1091119679d87f60dfb1acbff4b2a0ed3
git.kernel.org/stable/c/a3b76b54e0... WEB
https://git.kernel.org/stable/c/a3b76b54e06d73166af4d1a284a0e0711889060c

Frequently Asked Questions

What is CVE-2026-72149?
CVE-2026-72149 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-72149?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-72149?
CVE-2026-72149 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2026-72149?
CVE-2026-72149 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-72149?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jjfr-vvvg-vj2f",
  "modified" : "2026-08-17T06:33:12Z",
  "published" : "2026-08-15T06:32:14Z",
  "aliases" : [ "CVE-2026-72149" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: tegra: Fix burst size calculation\n\nCurrently, the Tegra GPC DMA hardware requires the transfer length to\nbe a multiple of the max burst size configured for the channel. When a\nclient requests a transfer where the length is not evenly divisible by\nthe configured max burst size, the DMA hangs with partial burst at\nthe end.\n\nFix this by reducing the burst size to the largest power-of-2 value\nthat evenly divides the transfer length. For example, a 40-byte\ntransfer with a 16-byte max burst will now use an 8-byte burst\n(40 / 8 = 5 complete bursts) instead of causing a hang.\n\nThis issue was observed with the PL011 UART driver where TX DMA\ntransfers of arbitrary lengths were stuck.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-72149"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4651df83b6c796daead3447e8fd874322918ee4f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6e37e9e230c7e848bd8e8cd4db15bb18bcf11ad1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/735951baa311c66353405dcac39375dd66441db0"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/7926c1e4be86379945fb5f168888ac4d2aaf6c91"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8f0f5de1091119679d87f60dfb1acbff4b2a0ed3"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a3b76b54e06d73166af4d1a284a0e0711889060c"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T06:21:32Z"
  }
}