CVE-2026-92415: Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies
Apache Jackrabbit DavEx clients can load attacker-chosen classes from malicious WebDAV error bodies (CVE-2026-92415).
Apache disclosed CVE-2026-92415, a medium-severity flaw in the Jackrabbit WebDAV/DavEx client. A malicious DavEx server, or an attacker who can influence error responses, can cause the client to run Class.forName and a String constructor on server-controlled error bodies. CVSS 4.0 is 6.9 (AV:N/AC:L/PR:N/UI:N), with low integrity impact only. Affected releases are Jackrabbit 2.20.0–2.20.17, 2.22.0–2.22.4, and 2.23.0–2.23.5.
- CVE-2026-92415 affects the Apache Jackrabbit DavEx WebDAV client.
- Malicious servers can drive Class.forName and a String constructor via error bodies.
- CVSS 4.0 is 6.9, with low integrity impact and no confidentiality or availability impact.
- Affected ranges are 2.20.0–2.20.17, 2.22.0–2.22.4, and 2.23.0–2.23.5.
- CVEs
- CVE-2026-92415
- Vendors
- Apache
- Products
- Apache Jackrabbit
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92415 | Unsafe class selection in Apache Jackrabbit DavEx client | 6.9 | — |
From the original article
Posted by Julian Reschke on Oct 07 Severity: CVSS 4. 0: 6. 9 (medium) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.