CVE-2026-63870: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-phq6-q8j5-j858
Share
CVSS 7.8
CWE-119
Published
Advisory Summary

CVE-2026-63870 is a HIGH (CVSS 7.8) security vulnerability vulnerability (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. this may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.. Remediation is available in the latest vendor maintenance releases.

CVE-2026-63870 at a Glance

CVE Identifier CVE-2026-63870
GHSA Identifier GHSA-phq6-q8j5-j858
Severity HIGH
CVSS v3.1 Base Score 7.8
CWE Classification CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-63870

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-63870, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer, where the product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. this may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() The aoe driver (or similar) generates a non-IPv6 packet (e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit() on a 6LoWPAN interface (configured by the user or test case). Since the packet is not IPv6, the 6LoWPAN header_ops->create function (lowpan_header_create or header_create) returns early without initializing the lowpan_addr_info structure in the skb headroom. In the transmit function (lowpan_xmit), the driver calls lowpan_header (or setup_header) which unconditionally copies and uses the lowpan_addr_info from the headroom, which contains uninitialized data. Fix this by dropping non IPv6 packets. A similar fix is needed in net/bluetooth/6lowpan.c bt_xmit().

References

NVD — CVE-2026-63870 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-63870
git.kernel.org/stable/c/1a827b95e6... WEB
https://git.kernel.org/stable/c/1a827b95e62b4cbe851ae7cc9c961cdfa769cca4
git.kernel.org/stable/c/285b0842f2... WEB
https://git.kernel.org/stable/c/285b0842f2e01c3edf805f1fd64da11d9b7f6b4c
git.kernel.org/stable/c/3150e6d322... WEB
https://git.kernel.org/stable/c/3150e6d3223dfc356308125cabf9c34169842d2a
git.kernel.org/stable/c/3a5f3f7aff... WEB
https://git.kernel.org/stable/c/3a5f3f7aff18bcc36a57839cf50cf0cc8de707f3
git.kernel.org/stable/c/87172cc8dc... WEB
https://git.kernel.org/stable/c/87172cc8dc49aaf54407a31edffb0232f8cb93ab
git.kernel.org/stable/c/8da95cb6ad... WEB
https://git.kernel.org/stable/c/8da95cb6ad7d656c871e776a9c7b77e894d6d89c
git.kernel.org/stable/c/af07fffbd5... WEB
https://git.kernel.org/stable/c/af07fffbd53ddc3ec3c2a4ca914f27899fa89bca
git.kernel.org/stable/c/c1819c8def... WEB
https://git.kernel.org/stable/c/c1819c8defa235c7beda859bc185b1c429a55ecd

Frequently Asked Questions

What is CVE-2026-63870?
CVE-2026-63870 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-63870?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-63870?
CVE-2026-63870 has a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-63870?
CVE-2026-63870 is classified under CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer (The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.).
How can I check Maven dependencies for CVE-2026-63870?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-phq6-q8j5-j858",
  "modified" : "2026-07-20T15:31:49Z",
  "published" : "2026-07-19T15:30:28Z",
  "aliases" : [ "CVE-2026-63870" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()\n\nThe aoe driver (or similar) generates a non-IPv6 packet\n(e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit()\non a 6LoWPAN interface (configured by the user or test case).\n\nSince the packet is not IPv6, the 6LoWPAN header_ops->create function\n(lowpan_header_create or header_create) returns early without initializing\nthe lowpan_addr_info structure in the skb headroom.\n\nIn the transmit function (lowpan_xmit), the driver calls lowpan_header\n(or setup_header) which unconditionally copies and uses the lowpan_addr_info\nfrom the headroom, which contains uninitialized data.\n\nFix this by dropping non IPv6 packets.\n\nA similar fix is needed in net/bluetooth/6lowpan.c bt_xmit().",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-63870"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1a827b95e62b4cbe851ae7cc9c961cdfa769cca4"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/285b0842f2e01c3edf805f1fd64da11d9b7f6b4c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3150e6d3223dfc356308125cabf9c34169842d2a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3a5f3f7aff18bcc36a57839cf50cf0cc8de707f3"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/87172cc8dc49aaf54407a31edffb0232f8cb93ab"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8da95cb6ad7d656c871e776a9c7b77e894d6d89c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/af07fffbd53ddc3ec3c2a4ca914f27899fa89bca"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c1819c8defa235c7beda859bc185b1c429a55ecd"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-119" ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-07-19T15:16:53Z"
  }
}