CVE-2026-90067: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-prv5-g54g-rmhh
Share
CVSS 7.5
Published
Advisory Summary

CVE-2026-90067 is a HIGH (CVSS 7.5) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-90067 at a Glance

CVE Identifier CVE-2026-90067
GHSA Identifier GHSA-prv5-g54g-rmhh
Severity HIGH
CVSS v3.1 Base Score 7.5
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2026-90067

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-90067, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the `payload_len` field is decoded from the banner prefix. If a client sends a banner with a `payload_len` of 0, the kernel sets up a 0-length socket read. This violates an invariant in the state machine, triggering a warning in `populate_in_iter()`: ------------[ cut here ]------------ !iov_iter_count(&con->v2.in_iter) WARNING: net/ceph/messenger_v2.c:3129 at populate_in_iter net/ceph/messenger_v2.c:3129 [inline], CPU#1: kworker/1:3/5070 WARNING: net/ceph/messenger_v2.c:3129 at ceph_con_v2_try_read+0x6634/0x6810 net/ceph/messenger_v2.c:3159, CPU#1: kworker/1:3/5070 ... Call Trace: <TASK> ceph_con_workfn+0x1f5/0x14a0 net/ceph/messenger.c:1575 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> According to the msgr2 protocol specification, the banner payload is expected to contain at least two 64-bit integers (`server_feat` and `server_req_feat`). Therefore, `payload_len` must be at least 16 bytes. Fix this by adding a check in `process_banner_prefix()` to reject a `payload_len` smaller than 16 bytes. This prevents the 0-length read and correctly aborts the connection with a protocol error.

References

NVD — CVE-2026-90067 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90067
git.kernel.org/stable/c/279c085299... WEB
https://git.kernel.org/stable/c/279c0852999fd2384f4a88155091a99e81f96873
git.kernel.org/stable/c/3b2e62a765... WEB
https://git.kernel.org/stable/c/3b2e62a7655d347a845a91155610ddae11daffc6
git.kernel.org/stable/c/6cf666e47f... WEB
https://git.kernel.org/stable/c/6cf666e47f2b51d5a887ec8a3226cde951757d27
git.kernel.org/stable/c/6d1c6f2288... WEB
https://git.kernel.org/stable/c/6d1c6f228854aa89844fd0152d7ed7ac72a55e89
git.kernel.org/stable/c/c1b937ff24... WEB
https://git.kernel.org/stable/c/c1b937ff24b19e69aa7fb1b0f46a74d4c9668692
git.kernel.org/stable/c/c77633a959... WEB
https://git.kernel.org/stable/c/c77633a9595658210a6e216a071e5a396a0835a7
git.kernel.org/stable/c/f374967fcd... WEB
https://git.kernel.org/stable/c/f374967fcdf04001c9b66df1c19106fa83cd91f7

Frequently Asked Questions

What is CVE-2026-90067?
CVE-2026-90067 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-90067?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-90067?
CVE-2026-90067 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2026-90067?
CVE-2026-90067 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-90067?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-prv5-g54g-rmhh",
  "modified" : "2026-09-18T18:31:26Z",
  "published" : "2026-09-17T18:31:49Z",
  "aliases" : [ "CVE-2026-90067" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: validate banner payload length\n\nWhen parsing the Ceph messenger v2 protocol banner, the `payload_len` field\nis decoded from the banner prefix. If a client sends a banner with a\n`payload_len` of 0, the kernel sets up a 0-length socket read. This\nviolates an invariant in the state machine, triggering a warning in\n`populate_in_iter()`:\n\n------------[ cut here ]------------\n!iov_iter_count(&con->v2.in_iter)\nWARNING: net/ceph/messenger_v2.c:3129 at populate_in_iter\nnet/ceph/messenger_v2.c:3129 [inline], CPU#1: kworker/1:3/5070\nWARNING: net/ceph/messenger_v2.c:3129 at ceph_con_v2_try_read+0x6634/0x6810\nnet/ceph/messenger_v2.c:3159, CPU#1: kworker/1:3/5070\n...\nCall Trace:\n <TASK>\n ceph_con_workfn+0x1f5/0x14a0 net/ceph/messenger.c:1575\n process_one_work kernel/workqueue.c:3322 [inline]\n process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405\n worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486\n kthread+0x388/0x470 kernel/kthread.c:436\n ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n </TASK>\n\nAccording to the msgr2 protocol specification, the banner payload is\nexpected to contain at least two 64-bit integers (`server_feat` and\n`server_req_feat`). Therefore, `payload_len` must be at least 16 bytes.\n\nFix this by adding a check in `process_banner_prefix()` to reject a\n`payload_len` smaller than 16 bytes. This prevents the 0-length read and\ncorrectly aborts the connection with a protocol error.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-90067"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/279c0852999fd2384f4a88155091a99e81f96873"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3b2e62a7655d347a845a91155610ddae11daffc6"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6cf666e47f2b51d5a887ec8a3226cde951757d27"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6d1c6f228854aa89844fd0152d7ed7ac72a55e89"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c1b937ff24b19e69aa7fb1b0f46a74d4c9668692"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c77633a9595658210a6e216a071e5a396a0835a7"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f374967fcdf04001c9b66df1c19106fa83cd91f7"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-17T17:16:55Z"
  }
}