CVE-2026-45841: Software Security Vulnerability Vulnerability

MODERATE
Advisory Identifier: GHSA-w9m2-286p-3583
Share
CVSS 5.5
CWE-369
Published
Advisory Summary

CVE-2026-45841 is a MODERATE (CVSS 5.5) security vulnerability vulnerability (CWE-369: Divide By Zero) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product divides a value by zero.. Remediation is available in the latest vendor maintenance releases.

CVE-2026-45841 at a Glance

CVE Identifier CVE-2026-45841
GHSA Identifier GHSA-w9m2-286p-3583
Severity MODERATE
CVSS v3.1 Base Score 5.5
CWE Classification CWE-369: Divide By Zero
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 5.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2026-45841

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-45841, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-369: Divide By Zero, where the product divides a value by zero. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO nf_osf_match_one() computes ctx->window % f->wss.val in the OSF_WSS_MODULO branch with no guard for f->wss.val == 0. A CAP_NET_ADMIN user can add such a fingerprint via nfnetlink; a subsequent matching TCP SYN divides by zero and panics the kernel. Reject the bogus fingerprint in nfnl_osf_add_callback() above the per-option for-loop. f->wss is per-fingerprint, not per-option, so the check must run regardless of f->opt_num (including 0). Also reject wss.wc >= OSF_WSS_MAX; nf_osf_match_one() already treats that as "should not happen". Crash: Oops: divide error: 0000 [#1] SMP KASAN NOPTI RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98) Call Trace: <IRQ> nf_osf_match (net/netfilter/nfnetlink_osf.c:220) xt_osf_match_packet (net/netfilter/xt_osf.c:32) ipt_do_table (net/ipv4/netfilter/ip_tables.c:348) nf_hook_slow (net/netfilter/core.c:622) ip_local_deliver (net/ipv4/ip_input.c:265) ip_rcv (include/linux/skbuff.h:1162) __netif_receive_skb_one_core (net/core/dev.c:6181) process_backlog (net/core/dev.c:6642) __napi_poll (net/core/dev.c:7710) net_rx_action (net/core/dev.c:7945) handle_softirqs (kernel/softirq.c:622)

References

NVD — CVE-2026-45841 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45841
cert-portal.siemens.com/productcert/html/ss... WEB
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
cert-portal.siemens.com/productcert/html/ss... WEB
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
cert-portal.siemens.com/productcert/html/ss... WEB
https://cert-portal.siemens.com/productcert/html/ssa-784472.html
git.kernel.org/stable/c/0694618cf3... WEB
https://git.kernel.org/stable/c/0694618cf3e9b120666e31f5f383a6e466d95a0d
git.kernel.org/stable/c/2195574dc6... WEB
https://git.kernel.org/stable/c/2195574dc6d9017d32ac346987e12659f931d932
git.kernel.org/stable/c/26900306a5... WEB
https://git.kernel.org/stable/c/26900306a5a2c3e4f75c643a064525526bb6e5f3
git.kernel.org/stable/c/8def8fbd23... WEB
https://git.kernel.org/stable/c/8def8fbd23f40e945febe913d04b731012ce0082
git.kernel.org/stable/c/9a05e19561... WEB
https://git.kernel.org/stable/c/9a05e195618a6d474f2bcd5b6376d0ffc2f00366
git.kernel.org/stable/c/c559408952... WEB
https://git.kernel.org/stable/c/c55940895245d8ef658ab381248a28755218d625
git.kernel.org/stable/c/cb833bbc1b... WEB
https://git.kernel.org/stable/c/cb833bbc1b3c51e08652d3c86298307c07d3f2db
git.kernel.org/stable/c/fb965b1cfe... WEB
https://git.kernel.org/stable/c/fb965b1cfe92b28d28b5ebe3116b81dbef9f2d2f

Frequently Asked Questions

What is CVE-2026-45841?
CVE-2026-45841 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-369: Divide By Zero.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-45841?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-45841?
CVE-2026-45841 has a CVSS v3.1 base score of 5.5 (MODERATE) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2026-45841?
CVE-2026-45841 is classified under CWE-369: Divide By Zero (The product divides a value by zero.).
How can I check Maven dependencies for CVE-2026-45841?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-w9m2-286p-3583",
  "modified" : "2026-10-15T03:35:55Z",
  "published" : "2026-05-27T12:31:23Z",
  "aliases" : [ "CVE-2026-45841" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO\n\nnf_osf_match_one() computes ctx->window % f->wss.val in the\nOSF_WSS_MODULO branch with no guard for f->wss.val == 0. A\nCAP_NET_ADMIN user can add such a fingerprint via nfnetlink; a\nsubsequent matching TCP SYN divides by zero and panics the kernel.\n\nReject the bogus fingerprint in nfnl_osf_add_callback() above the\nper-option for-loop. f->wss is per-fingerprint, not per-option, so\nthe check must run regardless of f->opt_num (including 0). Also\nreject wss.wc >= OSF_WSS_MAX; nf_osf_match_one() already treats that\nas \"should not happen\".\n\nCrash:\n Oops: divide error: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)\n Call Trace:\n <IRQ>\n  nf_osf_match (net/netfilter/nfnetlink_osf.c:220)\n  xt_osf_match_packet (net/netfilter/xt_osf.c:32)\n  ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)\n  nf_hook_slow (net/netfilter/core.c:622)\n  ip_local_deliver (net/ipv4/ip_input.c:265)\n  ip_rcv (include/linux/skbuff.h:1162)\n  __netif_receive_skb_one_core (net/core/dev.c:6181)\n  process_backlog (net/core/dev.c:6642)\n  __napi_poll (net/core/dev.c:7710)\n  net_rx_action (net/core/dev.c:7945)\n  handle_softirqs (kernel/softirq.c:622)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-45841"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0694618cf3e9b120666e31f5f383a6e466d95a0d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2195574dc6d9017d32ac346987e12659f931d932"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/26900306a5a2c3e4f75c643a064525526bb6e5f3"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8def8fbd23f40e945febe913d04b731012ce0082"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9a05e195618a6d474f2bcd5b6376d0ffc2f00366"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c55940895245d8ef658ab381248a28755218d625"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/cb833bbc1b3c51e08652d3c86298307c07d3f2db"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fb965b1cfe92b28d28b5ebe3116b81dbef9f2d2f"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-369" ],
    "severity" : "MODERATE",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-05-27T11:16:23Z"
  }
}