CVE-2026-43302: Software Security Vulnerability Vulnerability
MODERATECVE-2026-43302 is a MODERATE (CVSS 5.5) security vulnerability vulnerability (CWE-131: Incorrect Calculation of Buffer Size) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.. Remediation is available in the latest vendor maintenance releases.
CVE-2026-43302 at a Glance
Security Impact
CVSS: 5.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
How to Fix CVE-2026-43302
To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
mvn dependency:treeHow to Check if You Are Affected
To determine whether your Java application is affected by CVE-2026-43302, inspect your build dependencies using the Maven Dependency Plugin:
mvn dependency:treeAnalyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-131: Incorrect Calculation of Buffer Size, where the product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
References
Frequently Asked Questions
What is CVE-2026-43302?
Which Software versions are affected?
What version fixes CVE-2026-43302?
What is the CVSS score of CVE-2026-43302?
What CWE is associated with CVE-2026-43302?
How can I check Maven dependencies for CVE-2026-43302?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-v89v-4458-f6hp",
"modified" : "2026-05-15T15:30:33Z",
"published" : "2026-05-08T15:31:22Z",
"aliases" : [ "CVE-2026-43302" ],
"details" : "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Set DMA segment size to avoid debug warnings\n\nWhen using V3D rendering with CONFIG_DMA_API_DEBUG enabled, the\nkernel occasionally reports a segment size mismatch. This is because\n'max_seg_size' is not set. The kernel defaults to 64K. setting\n'max_seg_size' to the maximum will prevent 'debug_dma_map_sg()'\nfrom complaining about the over-mapping of the V3D segment length.\n\nDMA-API: v3d 1002000000.v3d: mapping sg segment longer than device\n claims to support [len=8290304] [max=65536]\nWARNING: CPU: 0 PID: 493 at kernel/dma/debug.c:1179 debug_dma_map_sg+0x330/0x388\nCPU: 0 UID: 0 PID: 493 Comm: Xorg Not tainted 6.12.53-yocto-standard #1\nHardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)\npstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : debug_dma_map_sg+0x330/0x388\nlr : debug_dma_map_sg+0x330/0x388\nsp : ffff8000829a3ac0\nx29: ffff8000829a3ac0 x28: 0000000000000001 x27: ffff8000813fe000\nx26: ffffc1ffc0000000 x25: ffff00010fdeb760 x24: 0000000000000000\nx23: ffff8000816a9bf0 x22: 0000000000000001 x21: 0000000000000002\nx20: 0000000000000002 x19: ffff00010185e810 x18: ffffffffffffffff\nx17: 69766564206e6168 x16: 74207265676e6f6c x15: 20746e656d676573\nx14: 20677320676e6970 x13: 5d34303334393134 x12: 0000000000000000\nx11: 00000000000000c0 x10: 00000000000009c0 x9 : ffff8000800e0b7c\nx8 : ffff00010a315ca0 x7 : ffff8000816a5110 x6 : 0000000000000001\nx5 : 000000000000002b x4 : 0000000000000002 x3 : 0000000000000008\nx2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00010a315280\nCall trace:\n debug_dma_map_sg+0x330/0x388\n __dma_map_sg_attrs+0xc0/0x278\n dma_map_sgtable+0x30/0x58\n drm_gem_shmem_get_pages_sgt+0xb4/0x140\n v3d_bo_create_finish+0x28/0x130 [v3d]\n v3d_create_bo_ioctl+0x54/0x180 [v3d]\n drm_ioctl_kernel+0xc8/0x140\n drm_ioctl+0x2d4/0x4d8",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
} ],
"affected" : [ ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-43302"
}, {
"type" : "WEB",
"url" : "https://git.kernel.org/stable/c/0290934d30abe7c88e18140fd5184c3f386b1e44"
}, {
"type" : "WEB",
"url" : "https://git.kernel.org/stable/c/14d0d6c8b4504a60cfeea74775ab2e0164019e65"
}, {
"type" : "WEB",
"url" : "https://git.kernel.org/stable/c/225023e3619b81af6d8d0e680503fc2d68633023"
}, {
"type" : "WEB",
"url" : "https://git.kernel.org/stable/c/2663ef70c6123b2232190f917275e5c3175f97d0"
}, {
"type" : "WEB",
"url" : "https://git.kernel.org/stable/c/9eb018828b1b30dfba689c060735c50fc5b9f704"
}, {
"type" : "WEB",
"url" : "https://git.kernel.org/stable/c/cf510785f74e74c54de40a43a955b7f844857487"
}, {
"type" : "WEB",
"url" : "https://git.kernel.org/stable/c/db15f469a88d3bbeeaa9f8c9f5e74d856ba5d7d2"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-131" ],
"severity" : "MODERATE",
"github_reviewed" : false,
"github_reviewed_at" : null,
"nvd_published_at" : "2026-05-08T14:16:37Z"
}
}