CVE-2026-72021: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-vp82-2jx6-f675
Share
CVSS 8.2
CWE-20
Published
Advisory Summary

CVE-2026-72021 is a HIGH (CVSS 8.2) security vulnerability vulnerability (CWE-20: Improper Input Validation) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.. Remediation is available in the latest vendor maintenance releases.

CVE-2026-72021 at a Glance

CVE Identifier CVE-2026-72021
GHSA Identifier GHSA-vp82-2jx6-f675
Severity HIGH
CVSS v3.1 Base Score 8.2
CWE Classification CWE-20: Improper Input Validation
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 8.2

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity Low (I:L)
Availability High (A:H)

How to Fix CVE-2026-72021

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-72021, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-20: Improper Input Validation, where the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup set_sctp_state() reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeof(struct ipv6hdr), while the surrounding IPVS code uses iph.len from ip_vs_fill_iph_skb(), where ipv6_find_hdr() has already skipped extension headers and found the real transport header. This makes the state machine read from the wrong offset for IPv6 SCTP packets that carry extension headers. For example, an INIT packet with an 8-byte destination options header can be scheduled correctly by sctp_conn_schedule(), but set_sctp_state() reads the first byte of the SCTP verification tag as a DATA chunk type. The connection then moves from NONE to ESTABLISHED instead of INIT1, gets the longer established timeout, and updates the active/inactive destination counters incorrectly. This happens even though the SCTP handshake has not completed. Use the parsed transport offset passed down from ip_vs_set_state() for the SCTP chunk-header lookup. For IPv4 and IPv6 packets without extension headers this preserves the existing offset.

References

NVD — CVE-2026-72021 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-72021
git.kernel.org/stable/c/247d055504... WEB
https://git.kernel.org/stable/c/247d055504dcc852e539b9f7f30d19f9741474bf
git.kernel.org/stable/c/290e9e8389... WEB
https://git.kernel.org/stable/c/290e9e8389b556efc603522e28bd1543846aa336
git.kernel.org/stable/c/2f75c0faa3... WEB
https://git.kernel.org/stable/c/2f75c0faa3361b28e36cc0512b3299e163e25789
git.kernel.org/stable/c/9cb5ac594c... WEB
https://git.kernel.org/stable/c/9cb5ac594ca76d3a71803b23b74c835b0721e628
git.kernel.org/stable/c/9f94573ab9... WEB
https://git.kernel.org/stable/c/9f94573ab962a9e81954b755da016fa3cd2f5039
git.kernel.org/stable/c/a4a2d2e483... WEB
https://git.kernel.org/stable/c/a4a2d2e483d79cc2ad3a170674cf159644acf22b
git.kernel.org/stable/c/d2b8b1557e... WEB
https://git.kernel.org/stable/c/d2b8b1557ec07ea1bb5dddbceaf4dfe63d388e27
git.kernel.org/stable/c/e5d0bb8871... WEB
https://git.kernel.org/stable/c/e5d0bb8871668f20de8f3c94b5ae3f372346bc6e

Frequently Asked Questions

What is CVE-2026-72021?
CVE-2026-72021 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-20: Improper Input Validation.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-72021?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-72021?
CVE-2026-72021 has a CVSS v3.1 base score of 8.2 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H.
What CWE is associated with CVE-2026-72021?
CVE-2026-72021 is classified under CWE-20: Improper Input Validation (The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.).
How can I check Maven dependencies for CVE-2026-72021?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vp82-2jx6-f675",
  "modified" : "2026-08-17T06:33:05Z",
  "published" : "2026-08-15T06:32:09Z",
  "aliases" : [ "CVE-2026-72021" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: use parsed transport offset in SCTP state lookup\n\nset_sctp_state() reads the SCTP chunk header again in order to drive the\nIPVS SCTP state table. For IPv6 it computes the offset with\nsizeof(struct ipv6hdr), while the surrounding IPVS code uses iph.len from\nip_vs_fill_iph_skb(), where ipv6_find_hdr() has already skipped\nextension headers and found the real transport header.\n\nThis makes the state machine read from the wrong offset for IPv6 SCTP\npackets that carry extension headers. For example, an INIT packet with an\n8-byte destination options header can be scheduled correctly by\nsctp_conn_schedule(), but set_sctp_state() reads the first byte of the\nSCTP verification tag as a DATA chunk type. The connection then moves\nfrom NONE to ESTABLISHED instead of INIT1, gets the longer established\ntimeout, and updates the active/inactive destination counters\nincorrectly. This happens even though the SCTP handshake has not\ncompleted.\n\nUse the parsed transport offset passed down from ip_vs_set_state() for\nthe SCTP chunk-header lookup. For IPv4 and IPv6 packets without\nextension headers this preserves the existing offset.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-72021"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/247d055504dcc852e539b9f7f30d19f9741474bf"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/290e9e8389b556efc603522e28bd1543846aa336"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2f75c0faa3361b28e36cc0512b3299e163e25789"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9cb5ac594ca76d3a71803b23b74c835b0721e628"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9f94573ab962a9e81954b755da016fa3cd2f5039"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a4a2d2e483d79cc2ad3a170674cf159644acf22b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d2b8b1557ec07ea1bb5dddbceaf4dfe63d388e27"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/e5d0bb8871668f20de8f3c94b5ae3f372346bc6e"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20" ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T06:21:01Z"
  }
}