CVE update for 26.0.0.11

未关闭
  • 哪里不对？
#8,583 4 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

维护者通常 1 天内回复

@ramkumar-k-9286 已经在做这个了。

开始于 2026年10月26日。

评估

这个 Issue 还没有评估数据。

描述

26.0.0.11 Developer reviewed

This issue is opened for updating the OpenLiberty CVE list for 26.0.0.11 to include the following. @ayoho @cluk FYI

|https://www.cve.org/CVERecord?id=CVE-2026-101294[CVE-2026-101294]
|8.7
|Improper Verification of Cryptographic Signature
|17.0.0.3-26.0.0.10
|26.0.0.11
|Affects the openidConnectClient-1.0, openidConnectServer-1.0, socialLogin-1.0, jwt-1.0, and jwtSso-1.0 features

|https://www.cve.org/CVERecord?id=CVE-2026-103320[CVE-2026-103320]
|4.3
|Information Disclosure
|17.0.0.3-26.0.0.10
|26.0.0.11
|Affects the restConnector-2.0 feature

|https://www.cve.org/CVERecord?id=CVE-2026-103499[CVE-2026-103499]
|7.5
|Denial of Service
|17.0.0.3-26.0.0.10
|26.0.0.11
|Affects the servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, and servlet-6.1 features

|https://www.cve.org/CVERecord?id=CVE-2026-105442[CVE-2026-105442]
|7.5
|Denial of Service
|17.0.0.3-26.0.0.10
|26.0.0.11
|Affects the messagingServer-3.0, and wasJmsServer-1.0 features

|https://www.cve.org/CVERecord?id=CVE-2026-108284[CVE-2026-108284]
|6.5
|Information Disclosure
|17.0.0.3-26.0.0.10
|26.0.0.11
|Affects the restConnector-2.0 feature

|https://www.cve.org/CVERecord?id=CVE-2026-10844[CVE-2026-10844]
|4.3
|Open Redirect
|17.0.0.3-26.0.0.10
|26.0.0.11
|Affects the appSecurity-1.0, appSecurity-2.0, appSecurity-3.0, appSecurity-4.0, appSecurity-5.0, and appSecurity-6.0 features

|https://www.cve.org/CVERecord?id=CVE-2026-11547[CVE-2026-11547]
|4.3
|Server-Side Request Forgery
|17.0.0.3-26.0.0.10
|26.0.0.11
|Affects the adminCenter-1.0 feature

|https://www.cve.org/CVERecord?id=CVE-2026-17615[CVE-2026-17615]
|7.5
|Improper Restriction of XML External Entity Reference
|17.0.0.3-26.0.0.10
|26.0.0.11
|Affects the restfulWS-3.0, restfulWS-3.1, and restfulWS-4.0 features

|https://www.cve.org/CVERecord?id=CVE-2026-76646[CVE-2026-76646]
|7.5
|Denial of Service
|17.0.0.3-26.0.0.10
|26.0.0.11
|Affects the jsf-2.2, faces-3.0, faces-4.0, and faces-4.1 features

|https://www.cve.org/CVERecord?id=CVE-2026-78636[CVE-2026-78636]
|4.3
|Information Disclosure 
|17.0.0.3-26.0.0.10
|26.0.0.11
|Affects the restConnector-2.0 feature

|https://www.cve.org/CVERecord?id=CVE-2026-93895[CVE-2026-93895]
|9.1
|Authorization Bypass
|17.0.0.3-26.0.0.10
|26.0.0.11
|Affects the grpc-1.0 feature

|https://www.cve.org/CVERecord?id=CVE-2026-93905[CVE-2026-93905]
|8.2
|Deserialization of Untrusted Data
|17.0.0.3-26.0.0.10
|26.0.0.11
|Affects the batchManagement-1.0 feature

|https://www.cve.org/CVERecord?id=CVE-2026-93909[CVE-2026-93909]
|9.1
|Authentication Bypass
|17.0.0.3-26.0.0.10
|26.0.0.11
|Affects the samlWeb-2.0 feature

|https://www.cve.org/CVERecord?id=CVE-2026-68536[CVE-2026-68536]
|9.8
|Server-Side Request Forgery
|17.0.0.3-26.0.0.10
|26.0.0.11
|Affects the jsf-2.2, faces-3.0, faces-4.0, and faces-4.1 features

|https://www.cve.org/CVERecord?id=CVE-2026-95695[CVE-2026-95695]
|7.4
|Authorization Bypass
|17.0.0.3-26.0.0.10
|26.0.0.11
|Affects the grpc-1.0 feature

|https://www.cve.org/CVERecord?id=CVE-2026-95696[CVE-2026-95696]
|6.5
|Information Disclosure
|17.0.0.3-26.0.0.10
|26.0.0.11
|Affects the grpc-1.0 feature
主要语言
没有语言数据
星标
14
派生
58
平均合并
1 小时 5 分钟
30 天内合并 PR
21

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

OpenLiberty/docs 的其他 Issue

查看 OpenLiberty/docs 的全部 Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。