CVE-2026-97984: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-5m3w-7wwr-wqm2
Share
Published
Advisory Summary

CVE-2026-97984 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-97984 at a Glance

CVE Identifier CVE-2026-97984
GHSA Identifier GHSA-5m3w-7wwr-wqm2
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-97984

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-97984, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork->base.fragsize to IP6_MAX_MTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udp_set_len_short when setsockopt IPV6_MTU_DISCOVER is set to IPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE, and a large packet is sent over a netdev with an unusually large MTU. Steps to reproduce (included in the new selftest): 1. Set device MTU bigger than IP6_MAX_MTU. cork->base.fragsize will be set to that MTU in ip6_setup_cork. 2. Set IPV6_MTU_DISCOVER to IPV6_PMTUDISC_PROBE or IPV6_PMTUDISC_DO. It lets maxnonfragsize be set to device MTU (cork->fragsize) in __ip6_append_data, rather than to IP6_MAX_MTU. 3. Send 65528 bytes of payload (+8 bytes of UDP header, +40 bytes of IPv6 header). Device MTU allows it (it's only one byte bigger than IP6_MAX_MTU, and the device MTU is bigger than that). 4. The UDP length in the built packet is 65536, which overflows the 16-bit length field and triggers the WARN in udp_set_len_short. To avoid breaking sending UDP jumbograms over raw IPv6 sockets, limit the change to UDP sockets only. The original overflow bug with IPv6 and IPV6_PMTUDISC_DO seems to predate git history (verified reproduction on 2.6.21), was fixed later, and then reappeared in commit 427faee167bc ("net: ipv6: introduce ip6_dst_mtu_maybe_forward"), which is chosen as the Fixes tag here. The overflow with IPV6_PMTUDISC_PROBE reproduces since its introduction in commit 628a5c561890 ("[INET]: Add IP(V6)_PMTUDISC_RPOBE").

References

NVD — CVE-2026-97984 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-97984
git.kernel.org/stable/c/0ae10b6be4... WEB
https://git.kernel.org/stable/c/0ae10b6be49b425827659b23bcce498f80eb7182
git.kernel.org/stable/c/1d56a00ec9... WEB
https://git.kernel.org/stable/c/1d56a00ec91f2885c64ea5b8cea18cb746b91bbb
git.kernel.org/stable/c/1dd562f301... WEB
https://git.kernel.org/stable/c/1dd562f3019019ffdf4b396570613053facda9ee
git.kernel.org/stable/c/ce66352d3e... WEB
https://git.kernel.org/stable/c/ce66352d3eb21825410af8b91db7cc4bb8e22c98
git.kernel.org/stable/c/e01b7c176d... WEB
https://git.kernel.org/stable/c/e01b7c176d9af2b7c22bb3fe12cf9a7904f99fdc

Frequently Asked Questions

What is CVE-2026-97984?
CVE-2026-97984 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-97984?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-97984?
CVE-2026-97984 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-97984?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5m3w-7wwr-wqm2",
  "modified" : "2026-10-03T12:31:23Z",
  "published" : "2026-09-25T12:31:31Z",
  "aliases" : [ "CVE-2026-97984" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: Fix UDP length overflow with PMTU discover and big MTU\n\nThis commit bounds cork->base.fragsize to IP6_MAX_MTU for UDP sockets to\navoid a possible overflow of UDP length that triggers a WARN in\nudp_set_len_short when setsockopt IPV6_MTU_DISCOVER is set to\nIPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE, and a large packet is sent over\na netdev with an unusually large MTU.\n\nSteps to reproduce (included in the new selftest):\n\n1. Set device MTU bigger than IP6_MAX_MTU. cork->base.fragsize will be\n   set to that MTU in ip6_setup_cork.\n2. Set IPV6_MTU_DISCOVER to IPV6_PMTUDISC_PROBE or IPV6_PMTUDISC_DO. It\n   lets maxnonfragsize be set to device MTU (cork->fragsize) in\n   __ip6_append_data, rather than to IP6_MAX_MTU.\n3. Send 65528 bytes of payload (+8 bytes of UDP header, +40 bytes of\n   IPv6 header). Device MTU allows it (it's only one byte bigger than\n   IP6_MAX_MTU, and the device MTU is bigger than that).\n4. The UDP length in the built packet is 65536, which overflows the\n   16-bit length field and triggers the WARN in udp_set_len_short.\n\nTo avoid breaking sending UDP jumbograms over raw IPv6 sockets, limit\nthe change to UDP sockets only.\n\nThe original overflow bug with IPv6 and IPV6_PMTUDISC_DO seems to\npredate git history (verified reproduction on 2.6.21), was fixed later,\nand then reappeared in commit 427faee167bc (\"net: ipv6: introduce\nip6_dst_mtu_maybe_forward\"), which is chosen as the Fixes tag here. The\noverflow with IPV6_PMTUDISC_PROBE reproduces since its introduction in\ncommit 628a5c561890 (\"[INET]: Add IP(V6)_PMTUDISC_RPOBE\").",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-97984"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0ae10b6be49b425827659b23bcce498f80eb7182"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1d56a00ec91f2885c64ea5b8cea18cb746b91bbb"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1dd562f3019019ffdf4b396570613053facda9ee"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ce66352d3eb21825410af8b91db7cc4bb8e22c98"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/e01b7c176d9af2b7c22bb3fe12cf9a7904f99fdc"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-25T11:17:26Z"
  }
}