{"schemaVersion":3,"id":"CVE-2026-27830","aliases":["UBUNTU-CVE-2026-27830","DEBIAN-CVE-2026-27830","CGA-7qc8-j4gw-p7g4","CGA-2qp7-7v5r-hm5w","CGA-5r4h-hffw-3j7q","CGA-62v7-2jcf-w3jv","CGA-grxj-m546-q7x4","CGA-pjcp-wgfc-m62f","GHSA-5476-xc4j-rqcv","CGA-xcp6-mr8m-7qx6","CGA-xhmg-mwpg-qjv9"],"status":"published","duplicateOf":null,"title":null,"description":"c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map<String,Map<String,String>>`. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDataSource` or via maliciously crafted serialized objects or `javax.naming.Reference` instances could be tailored execute unexpected code on the application's `CLASSPATH`. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote `factoryClassLocation` values. Attackers could set c3p0's `userOverridesAsString` hex-encoded serialized objects that include objects \"indirectly serialized\" via JNDI references. Deserialization of those objects and dereferencing of the embedded `javax.naming.Reference` objects could provoke download and execution of malicious code from a remote `factoryClassLocation`. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The `userOverridesAsString` property of c3p0 `ConnectionPoolDataSource` classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote `factoryClassLocation` values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java `com.mchange.v2.naming.nameGuardClassName` to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.","dates":{"published":"2026-02-26T00:45:18.222Z","modified":"2026-09-15T12:04:22.713Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.9,"severity":"high","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":8.9,"severity":"high","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8,"severity":"high","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":8.9,"severity":"high","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":8,"severity":"high","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":5.4,"impact":9.8,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Debian","score":8.9,"severity":"high","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":8.9,"severity":"high","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":8.9,"severity":"high","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Maven","score":8.9,"severity":"high","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":8.9,"severity":"high","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8,"severity":"high","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02039,"percentile":0.80842,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":1.5049999999999997,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00534},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00534,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00534,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00534,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00534,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00534,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00534,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00534,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00534,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00534,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00534,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01645,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02039,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02039,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02039,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02039,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02039,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.02039,"percentile":0.80842}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00534,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00534,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00534,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00534,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01645,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0215,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02039,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02039,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02039,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02039,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02039,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.02039,"percentile":0.80842}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-94","name":"Improper Control of Generation of Code ('Code Injection')","description":"The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/94.html"},{"id":"CWE-502","name":"Deserialization of Untrusted Data","description":"The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/502.html"}],"affected":[{"vendor":"chainguard","product":"debezium-3.3-connector-jdbc","name":"debezium-3.3-connector-jdbc","label":"debezium-3.3-connector-jdbc","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/debezium-3.3-connector-jdbc","purlType":"apk","versions":[{"text":"< 3.3.2-r2","noFixRecorded":false,"fixedIn":null},{"text":"< 3.3.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.3.2-r2 | < 3.3.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"debezium-3.4-connector-jdbc","name":"debezium-3.4-connector-jdbc","label":"debezium-3.4-connector-jdbc","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/debezium-3.4-connector-jdbc","purlType":"apk","versions":[{"text":"< 3.4.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.4.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hono-service-device-registry-jdbc","name":"hono-service-device-registry-jdbc","label":"hono-service-device-registry-jdbc","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hono-service-device-registry-jdbc","purlType":"apk","versions":[{"text":"< 2.7.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.7.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"solr-9-full","name":"solr-9-full","label":"solr-9-full","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/solr-9-full","purlType":"apk","versions":[{"text":"< 9.10.1-r14","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.10.1-r14","eol":null,"hubHref":null},{"vendor":"chainguard","product":"solr-fips-9-full","name":"solr-fips-9-full","label":"solr-fips-9-full","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/solr-fips-9-full","purlType":"apk","versions":[{"text":"< 9.10.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.10.1-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"debezium-3.4-connector-jdbc","name":"debezium-3.4-connector-jdbc","label":"debezium-3.4-connector-jdbc","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/debezium-3.4-connector-jdbc","purlType":"apk","versions":[{"text":"< 3.4.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.4.1-r1","eol":null,"hubHref":null},{"vendor":"debian","product":"c3p0","name":"c3p0","label":"c3p0","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/c3p0","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"c3p0","name":"c3p0","label":"c3p0","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/c3p0","purlType":"deb","versions":[{"text":"< 0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm2","noFixRecorded":false,"fixedIn":null},{"text":"< 0.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 0.9.1.2-10ubuntu0.20.04.1+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 0.9.1.2-10ubuntu1+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 0.9.1.2-10ubuntu2+esm1","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 0.9.1.2-11ubuntu0.1~esm1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm2 | < 0.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1 | < 0.9.1.2-10ubuntu0.20.04.1+esm1 | < 0.9.1.2-10ubuntu1+esm1 | < 0.9.1.2-10ubuntu2+esm1 | All versions (No fix recorded) | < 0.9.1.2-11ubuntu0.1~esm1","eol":null,"hubHref":null},{"vendor":"com.mchange","product":"c3p0","name":"com.mchange:c3p0","label":"c3p0","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/com.mchange/c3p0","purlType":"maven","versions":[{"text":"< 0.12.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.12.0","eol":null,"hubHref":null},{"vendor":"swaldman","product":"c3p0","name":"c3p0","label":"c3p0","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.12.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.12.0","eol":null,"hubHref":"/vendor/swaldman/c3p0"}],"affectedCount":10,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/swaldman/c3p0/security/advisories/GHSA-5476-xc4j-rqcv","label":"github.com/swaldman/c3p0/security/advisories/GHSA-5476-xc4j-rqcv","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Advisory","WEB"]},{"url":"https://github.com/swaldman/c3p0/commit/e14cbd8166e423e2e9a9d6f08b2add3433492d6e","label":"github.com/swaldman/c3p0/commit/e14cbd8166e423e2e9a9d6f08b2add3433492d6e","hostname":"github.com","tags":["X Refsource MISC","REPORT","FIX","WEB"]},{"url":"https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal","label":"mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal","hostname":"mogwailabs.de","tags":["X Refsource MISC","REPORT","ARTICLE","WEB"]},{"url":"https://www.mchange.com/projects/c3p0/#configuring_security","label":"www.mchange.com/projects/c3p0/","hostname":"www.mchange.com","tags":["X Refsource MISC","REPORT","WEB"]},{"url":"https://www.mchange.com/projects/c3p0/#security-note","label":"www.mchange.com/projects/c3p0/","hostname":"www.mchange.com","tags":["X Refsource MISC","REPORT","WEB"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27830","label":"access.redhat.com/security/cve/CVE-2026-27830","hostname":"access.redhat.com","tags":["VDB Entry","X Refsource REDHAT","Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442908","label":"bugzilla.redhat.com/show_bug.cgi?id=2442908","hostname":"bugzilla.redhat.com","tags":["Issue Tracking","X Refsource REDHAT","REPORT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27830.json","label":"security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27830.json","hostname":"security.access.redhat.com","tags":["X Sadp Csaf Vex","WEB"]},{"url":"https://access.redhat.com/errata/RHSA-2026:18054","label":"access.redhat.com/errata/RHSA-2026:18054","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:18055","label":"access.redhat.com/errata/RHSA-2026:18055","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28385","label":"access.redhat.com/errata/RHSA-2026:28385","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:4285","label":"access.redhat.com/errata/RHSA-2026:4285","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:18059","label":"access.redhat.com/errata/RHSA-2026:18059","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3890","label":"access.redhat.com/errata/RHSA-2026:3890","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-27830","label":"ubuntu.com/security/CVE-2026-27830","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27830","label":"www.cve.org/CVERecord?id=CVE-2026-27830","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-8642-1","label":"ubuntu.com/security/notices/USN-8642-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-27830","label":"security-tracker.debian.org/tracker/CVE-2026-27830","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27830.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27830.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27830","label":"nvd.nist.gov/vuln/detail/CVE-2026-27830","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/swaldman/c3p0","label":"github.com/swaldman/c3p0","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":["RHSA-2026:18054","RHSA-2026:18055","RHSA-2026:28385","RHSA-2026:73644","RHSA-2026:73976","SUSE-SU-2026:0855-1","USN-8642-1"],"duplicates":[],"related":["CGA-6VHX-88G4-42R5","SUSE-SU-2026:0855-1","USN-8642-1"]},"timeline":[{"kind":"published","date":"2026-02-26T00:45:18.222Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-15T12:04:22.713Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":36,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T14:29:37.833Z","stale":false,"partial":false}}