Repository navigation
CVE update for 26.0.0.10 #8563
Description
This issue is opened for updating the CVE list for 26.0.0.10 to include the following. @ayoho @cluk fyi
|https://www.cve.org/CVERecord?id=CVE-2026-11713[CVE-2026-11713]
|5.4
|Information Disclosure
|17.0.0.3-26.0.0.9
|26.0.0.10
|Affects the feature:restConnector-2.0 feature
|https://www.cve.org/CVERecord?id=CVE-2026-14909[CVE-2026-14909]
|6.5
|SQL Injection
|17.0.0.3-26.0.0.9
|26.0.0.10
|Affects the feature:restConnector-2.0 feature
|https://www.cve.org/CVERecord?id=CVE-2026-49875[CVE-2026-49875]
|9.8
|Server-Side Request Forgery
|17.0.0.3-26.0.0.9
|26.0.0.10
|Affects the feature:jaxrs-2.0, feature:jaxrs-2.1, feature:jaxws-2.2, feature:xmlWS-3.0, feature:xmlWS-4.0, and feature:wsAtomicTransaction-1.2 features
|https://www.cve.org/CVERecord?id=CVE-2026-65432[CVE-2026-65432]
|7.5
|Cross-Site Scripting
|17.0.0.3-26.0.0.9
|26.0.0.10
|Affects the feature:jaxws-2.2, feature:xmlWS-3.0, feature:xmlWS-4.0, feature:wsSecurity-1.1, and feature:wsAtomicTransaction-1.2 features
|https://www.cve.org/CVERecord?id=CVE-2026-66142[CVE-2026-66142]
|7.5
|Denial of Service
|17.0.0.3-26.0.0.9
|26.0.0.10
|Affects the feature:jaxws-2.2, feature:xmlWS-3.0, and feature:xmlWS-4.0 features
|https://www.cve.org/CVERecord?id=CVE-2026-66143[CVE-2026-66143]
|7.5
|Denial of Service
|17.0.0.3-26.0.0.9
|26.0.0.10
|Affects the feature:jaxws-2.2, feature:xmlWS-3.0, and feature:xmlWS-4.0 features
|https://www.cve.org/CVERecord?id=CVE-2026-66144[CVE-2026-66144]
|7.5
|Denial of Service
|17.0.0.3-26.0.0.9
|26.0.0.10
|Affects the feature:jaxws-2.2, feature:xmlWS-3.0, and feature:xmlWS-4.0 features
|https://www.cve.org/CVERecord?id=CVE-2026-77816[CVE-2026-77816]
|6.5
|Path Traversal
|17.0.0.3-26.0.0.9
|26.0.0.10
|
|https://www.cve.org/CVERecord?id=CVE-2026-79715[CVE-2026-79715]
|5.5
|Path Traversal
|17.0.0.3-26.0.0.9
|26.0.0.10
|
Activity
8563-CVE update for 26.0.0.10-1
ramkumar-k-9286 commentedon Oct 1, 2026
Hi @Faizi-AdnanFahad
Suggested updates have been incorporated to the Security vulnerability (CVE) list page.
Draft site Link: https://docs-draft-openlibertyio.mqj6zf7jocq.us-south.codeengine.appdomain.cloud/docs/latest/security-vulnerabilities.html
When you have it, please share the pending information to update in the page.
Regards,
Ramkumar.
ramkumar-k-9286 commentedon Oct 2, 2026
Hi @Faizi-AdnanFahad
Suggested updates have been incorporated to the Security vulnerability (CVE) list page.
Draft site Link: https://docs-draft-openlibertyio.mqj6zf7jocq.us-south.codeengine.appdomain.cloud/docs/latest/security-vulnerabilities.html
Please share the information to be added to notes for the first two CVE
Regards,
Ramkumar.
Faizi-AdnanFahad commentedon Oct 2, 2026
Regarding the notes missing field in the first two entries, since the SB has not been published, I can't get those until the SB is published on Tuesday. Talking to Ram, the doc building and publishing is a multistage process and can take quite a bit of time which can't be done quickly on Tuesday, we can go ahead and publish this as is and come back and update it on Wednesday.
8563 CVE update for 26.0.0.10-3
ramkumar-k-9286 commentedon Oct 12, 2026
Hi @Faizi-AdnanFahad
Could you have a look at the following updated draft page.
https://docs-draft-openlibertyio.mqj6zf7jocq.us-south.codeengine.appdomain.cloud/docs/latest/security-vulnerabilities.html
Please let me know if you are ok with the updates.
At that point i will proceed to make the updates in 26.0.0.10
Regards,
Ramkumar
ramkumar-k-9286 commentedon Oct 16, 2026
Hi @Faizi-AdnanFahad
Updates have been added to 26.0.0.10 release.
Link: https://openliberty.io/docs/latest/security-vulnerabilities.html
If there are no more updates, please add
Developer Reviewedlabel, so i can proceed to close the issue.Regards,
Ramkumar.