CVE-2026-98454: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-q4c4-v5h3-5c35
Share
Published
Advisory Summary

CVE-2026-98454 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98454 at a Glance

CVE Identifier CVE-2026-98454
GHSA Identifier GHSA-q4c4-v5h3-5c35
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-98454

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98454, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2_parse_contexts() validates the complete create-context area but does not limit each record to its Next field before dispatching it. A malformed chain can therefore expose bytes beyond the current context to a handler. The QFid handler also used a full response-structure cast although it only reads DiskFileId. The SMB2/SMB3 lease parsers made the same layout assumption: they read LeaseState and LeaseFlags at canonical offsets rather than at DataOffset. A valid non-canonical DataOffset could therefore yield unrelated in-bounds data, while a short DataLength was still accepted. Limit each context to its Next value, reject offsets before the context header, and reject malformed chains. Bound the name range by the current context and do not dispatch a known handler when DataLength is zero. Read the QFid DiskFileId only when the context data covers that field. Parse the lease context from DataOffset and require DataLength to match the v1 or v2 lease_context size used by ksmbd. A size mismatch skips lease parsing without failing the open.

References

NVD — CVE-2026-98454 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98454
git.kernel.org/stable/c/05a7fd8002... WEB
https://git.kernel.org/stable/c/05a7fd80024ff32b9b40ab1478bb172eeab1c386
git.kernel.org/stable/c/28bc9a8717... WEB
https://git.kernel.org/stable/c/28bc9a871799363afa3139e961a8e3684feb8704
git.kernel.org/stable/c/67f4c1c6a1... WEB
https://git.kernel.org/stable/c/67f4c1c6a1b51e203d986779299824d1c2c590a6
git.kernel.org/stable/c/cecc539998... WEB
https://git.kernel.org/stable/c/cecc5399987e73a528ce2b662eeb54af69163cbd
git.kernel.org/stable/c/e4c4901270... WEB
https://git.kernel.org/stable/c/e4c49012708c917eafd9c27054b02d0f8b30fe64

Frequently Asked Questions

What is CVE-2026-98454?
CVE-2026-98454 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98454?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-98454?
CVE-2026-98454 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98454?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-q4c4-v5h3-5c35",
  "modified" : "2026-10-18T18:31:49Z",
  "published" : "2026-10-18T18:31:49Z",
  "aliases" : [ "CVE-2026-98454" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix create context out-of-bounds reads\n\nsmb2_parse_contexts() validates the complete create-context area but\ndoes not limit each record to its Next field before dispatching it.  A\nmalformed chain can therefore expose bytes beyond the current context to\na handler.  The QFid handler also used a full response-structure cast\nalthough it only reads DiskFileId.\n\nThe SMB2/SMB3 lease parsers made the same layout assumption: they read\nLeaseState and LeaseFlags at canonical offsets rather than at\nDataOffset.  A valid non-canonical DataOffset could therefore yield\nunrelated in-bounds data, while a short DataLength was still accepted.\n\nLimit each context to its Next value, reject offsets before the context\nheader, and reject malformed chains.  Bound the name range by the current\ncontext and do not dispatch a known handler when DataLength is zero.  Read\nthe QFid DiskFileId only when the context data covers that field.  Parse the\nlease context from DataOffset and require DataLength to match the v1 or v2\nlease_context size used by ksmbd.  A size mismatch skips lease parsing\nwithout failing the open.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98454"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/05a7fd80024ff32b9b40ab1478bb172eeab1c386"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/28bc9a871799363afa3139e961a8e3684feb8704"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/67f4c1c6a1b51e203d986779299824d1c2c590a6"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/cecc5399987e73a528ce2b662eeb54af69163cbd"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/e4c49012708c917eafd9c27054b02d0f8b30fe64"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-10-18T16:16:55Z"
  }
}