SB20261109112 - Multiple vulnerabilities in gradle

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109112

SB20261109112 - Multiple vulnerabilities in gradle

Published: November 9, 2026

Security Bulletin ID SB20261109112
CSH Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Download of code without integrity check (CVE-ID: N/A)

CWE-ID: CWE-494 - Download of Code Without Integrity Check

CVSSv4: 7.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to inject malicious artifacts into Gradle builds.

The vulnerability exists due to Gradle dependency resolution continuing to later repositories after SSL connection establishment errors instead of disabling the failing repository. An unauthenticated remote attacker can disrupt an earlier repository and serve dependencies from a controlled later repository when a victim runs a build without strict repository content filtering or dependency verification.


2) Deserialization of Untrusted Data (CVE-ID: N/A)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged local attacker to execute code with the build user's privileges or cause denial of service.

The vulnerability exists due to the Gradle daemon deserializing untrusted Java objects before verifying the authentication token on its loopback client communication channel. A low-privileged local attacker can send a malicious serialized object graph to a running daemon to trigger exploitation, even when no build is active.


3) Deserialization of Untrusted Data (CVE-ID: N/A)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged local attacker to execute code in the Gradle daemon with the privileges of the user running the build.

The vulnerability exists due to unauthenticated Java deserialization on Gradle's loopback worker-to-daemon channel during worker startup. A low-privileged local attacker can win the brief connection race during an actively running build and send a hostile object graph to execute code.


Remediation

Install update from vendor's website.

References