CVE-2026-90054: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-cwq3-366f-g758
Share
Published
Advisory Summary

CVE-2026-90054 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-90054 at a Glance

CVE Identifier CVE-2026-90054
GHSA Identifier GHSA-cwq3-366f-g758
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-90054

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-90054, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the normal xmit path, while in urgent mode we refuse to build a multi-segment TSO packet, so every segment gets its own urg_ptr: /* tcp_write_xmit() */ limit = mss_now; if (tso_segs > 1 && !tcp_urg_mode(tp)) limit = tcp_mss_split_point(...); The retransmit path has no such guard. __tcp_retransmit_skb() builds a segs > 1 skb and hands it to the GSO layer, which only advances th->seq per segment and copies urg_ptr verbatim: /* __tcp_retransmit_skb() */ len = cur_mss * segs; /* segs > 1, no urg_mode check */ ... /* tcp_gso_segment(): bumps seq only, urg_ptr is copied */ urg_ptr is an offset from the segment's own seq, so a copied value points at a different place on each segment. The receiver rebuilds the absolute urgent seq as seg.seq + urg_ptr, so it walks a moving urgent point instead of the one OOB byte: seg1 seq 1 urg_ptr 5001 -> urgent @ 5001 (ok) seg2 seq 1001 urg_ptr 5001 -> urgent @ 6001 (wrong, +MSS) seg3 seq 2001 urg_ptr 5001 -> urgent @ 7001 (wrong, +2*MSS) The real OOB byte is never pointed at, so the receiver stops splicing it out and delivers it as normal in-band data, corrupting the stream. Guard the retransmit length like the xmit path: keep segs = 1 while in urgent mode.

References

NVD — CVE-2026-90054 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90054
git.kernel.org/stable/c/3d4e005c19... WEB
https://git.kernel.org/stable/c/3d4e005c198dc410ad568f832bffa7569c059ff8
git.kernel.org/stable/c/47eb90299e... WEB
https://git.kernel.org/stable/c/47eb90299e6882d6445672530dd7c51ac33ebdbd
git.kernel.org/stable/c/4fd2ee4ac1... WEB
https://git.kernel.org/stable/c/4fd2ee4ac154c204d95d8db72221446dac5af9b8
git.kernel.org/stable/c/711bfd762b... WEB
https://git.kernel.org/stable/c/711bfd762bec05fb19bc3b17cbb157c39f4e66da
git.kernel.org/stable/c/8eb51013b6... WEB
https://git.kernel.org/stable/c/8eb51013b6308870479a64b4a2a018697b997849
git.kernel.org/stable/c/b8f08a94b2... WEB
https://git.kernel.org/stable/c/b8f08a94b2a4addc39249dcf9c792e786108621b
git.kernel.org/stable/c/ce2b807f42... WEB
https://git.kernel.org/stable/c/ce2b807f42ed5e55567b8864ab72963f90779270
git.kernel.org/stable/c/ebe5540640... WEB
https://git.kernel.org/stable/c/ebe55406404f3cb28e36d2b668e2c6c05026ec29

Frequently Asked Questions

What is CVE-2026-90054?
CVE-2026-90054 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-90054?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-90054?
CVE-2026-90054 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-90054?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-cwq3-366f-g758",
  "modified" : "2026-09-17T18:31:48Z",
  "published" : "2026-09-17T18:31:48Z",
  "aliases" : [ "CVE-2026-90054" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix corruption of urgent data on multi-segment retransmit\n\nOn the normal xmit path, while in urgent mode we refuse to build a\nmulti-segment TSO packet, so every segment gets its own urg_ptr:\n\n\t/* tcp_write_xmit() */\n\tlimit = mss_now;\n\tif (tso_segs > 1 && !tcp_urg_mode(tp))\n\t\tlimit = tcp_mss_split_point(...);\n\nThe retransmit path has no such guard. __tcp_retransmit_skb() builds a\nsegs > 1 skb and hands it to the GSO layer, which only advances th->seq\nper segment and copies urg_ptr verbatim:\n\n\t/* __tcp_retransmit_skb() */\n\tlen = cur_mss * segs;\t\t/* segs > 1, no urg_mode check */\n\t...\n\t/* tcp_gso_segment(): bumps seq only, urg_ptr is copied */\n\nurg_ptr is an offset from the segment's own seq, so a copied value points\nat a different place on each segment. The receiver rebuilds the absolute\nurgent seq as seg.seq + urg_ptr, so it walks a moving urgent point instead\nof the one OOB byte:\n\n\tseg1  seq 1     urg_ptr 5001 -> urgent @ 5001   (ok)\n\tseg2  seq 1001  urg_ptr 5001 -> urgent @ 6001   (wrong, +MSS)\n\tseg3  seq 2001  urg_ptr 5001 -> urgent @ 7001   (wrong, +2*MSS)\n\nThe real OOB byte is never pointed at, so the receiver stops splicing it\nout and delivers it as normal in-band data, corrupting the stream.\n\nGuard the retransmit length like the xmit path: keep segs = 1 while in\nurgent mode.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-90054"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3d4e005c198dc410ad568f832bffa7569c059ff8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/47eb90299e6882d6445672530dd7c51ac33ebdbd"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4fd2ee4ac154c204d95d8db72221446dac5af9b8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/711bfd762bec05fb19bc3b17cbb157c39f4e66da"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8eb51013b6308870479a64b4a2a018697b997849"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b8f08a94b2a4addc39249dcf9c792e786108621b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ce2b807f42ed5e55567b8864ab72963f90779270"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ebe55406404f3cb28e36d2b668e2c6c05026ec29"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-17T17:16:53Z"
  }
}