CVE-2026-92415: Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

As cited

Copy frozen at 2026-10-07 20:34 UTC (site build).

vulnerabilities

CVE-2026-92415: Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

CVE-2026-92415 affects Apache Jackrabbit versions 2.20.0 through 2.23.5, where the WebDAV/DavEx client processes server-controlled error bodies through Class.forName and string constructors. A malicious server or network-positioned attacker can exploit this to instantiate arbitrary classes, potentially achieving information disclosure or other impacts. The vulnerability carries a CVSS 4.0 base score of 6.9 (medium).

Why it matters: Organizations running affected Jackrabbit versions and connecting to untrusted or compromised WebDAV/DavEx servers face remote information disclosure and potential code execution through crafted error responses; prioritize patching or network isolation.

Source published

2026-10-07 15:31 UTC

First seen by Cybersecurity Tracker

2026-10-07 19:13 UTC