Download of code without integrity check in gradle - #VU162845
Published: November 9, 2026
Vulnerability identifier: #VU162845
CSH Severity: High
CVSS v4: 7.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-494
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to inject malicious artifacts into Gradle builds.
The vulnerability exists due to Gradle dependency resolution continuing to later repositories after SSL connection establishment errors instead of disabling the failing repository. An unauthenticated remote attacker can disrupt an earlier repository and serve dependencies from a controlled later repository when a victim runs a build without strict repository content filtering or dependency verification.
Affected software
gradle
Remediation
Install security update from vendor's website.
gradle - addressed in versions 8.14.6, 9.8.1