CVE-2026-74742: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-pp8f-5mj5-qp78
Share
CVSS 7.5
Published
Advisory Summary

CVE-2026-74742 is a HIGH (CVSS 7.5) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-74742 at a Glance

CVE Identifier CVE-2026-74742
GHSA Identifier GHSA-pp8f-5mj5-qp78
Severity HIGH
CVSS v3.1 Base Score 7.5
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2026-74742

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-74742, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to wake the peer txq in veth_poll veth_poll() derives the index of the peer TX queue to wake from rq->xdp_rxq.queue_index. That field is only initialized by xdp_rxq_info_reg() in veth_enable_xdp_range(), which runs only when an XDP program is attached. On the plain GRO/NAPI path (veth_napi_enable_range()) xdp_rxq_info_reg() is never called, so queue_index stays 0 for every queue, as priv->rq is zero-allocated. So in a multi-queue setup with GRO enabled and no XDP program attached, every NAPI instance looks at the peer's TX queue 0. If veth_xmit() stops peer TX queue 1 because the ptr_ring is full (NETDEV_TX_BUSY), nothing ever wakes it again: the poller draining queue 1 wakes queue 0 instead. veth implements no ndo_tx_timeout, so the netdev watchdog does not kick in either, and the queue stays stopped indefinitely. Derive the index from the position of the rq within priv->rq instead, which is correct regardless of whether XDP was ever enabled. Scripts to reproduce the stall are available at https://github.com/netoptimizer/veth-backpressure-performance-testing

References

NVD — CVE-2026-74742 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-74742
git.kernel.org/stable/c/60db47f02b... WEB
https://git.kernel.org/stable/c/60db47f02bfa2aa688938aa199117ec4f8e31d23
git.kernel.org/stable/c/73f8dd22b1... WEB
https://git.kernel.org/stable/c/73f8dd22b1e533a99ecc3f9b5de6c6daccaecace
git.kernel.org/stable/c/90bb11fb29... WEB
https://git.kernel.org/stable/c/90bb11fb29d3c55a2c46dc7c386d096b286e7fcf
git.kernel.org/stable/c/b662a1fb4f... WEB
https://git.kernel.org/stable/c/b662a1fb4f3a5ea19bac24eea8315b1d05be51e7

Frequently Asked Questions

What is CVE-2026-74742?
CVE-2026-74742 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-74742?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-74742?
CVE-2026-74742 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2026-74742?
CVE-2026-74742 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-74742?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-pp8f-5mj5-qp78",
  "modified" : "2026-08-27T06:31:30Z",
  "published" : "2026-08-27T06:31:30Z",
  "aliases" : [ "CVE-2026-74742" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: fix queue index used to wake the peer txq in veth_poll\n\nveth_poll() derives the index of the peer TX queue to wake from\nrq->xdp_rxq.queue_index. That field is only initialized by\nxdp_rxq_info_reg() in veth_enable_xdp_range(), which runs only when an\nXDP program is attached. On the plain GRO/NAPI path\n(veth_napi_enable_range()) xdp_rxq_info_reg() is never called, so\nqueue_index stays 0 for every queue, as priv->rq is zero-allocated.\n\nSo in a multi-queue setup with GRO enabled and no XDP program attached,\nevery NAPI instance looks at the peer's TX queue 0. If veth_xmit() stops\npeer TX queue 1 because the ptr_ring is full (NETDEV_TX_BUSY), nothing\never wakes it again: the poller draining queue 1 wakes queue 0 instead.\nveth implements no ndo_tx_timeout, so the netdev watchdog does not kick\nin either, and the queue stays stopped indefinitely.\n\nDerive the index from the position of the rq within priv->rq instead,\nwhich is correct regardless of whether XDP was ever enabled.\n\nScripts to reproduce the stall are available at\nhttps://github.com/netoptimizer/veth-backpressure-performance-testing",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-74742"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/60db47f02bfa2aa688938aa199117ec4f8e31d23"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/73f8dd22b1e533a99ecc3f9b5de6c6daccaecace"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/90bb11fb29d3c55a2c46dc7c386d096b286e7fcf"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b662a1fb4f3a5ea19bac24eea8315b1d05be51e7"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-26T15:16:52Z"
  }
}