You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@sling.apache.org by "Rishabh Daim (Jira)" <ji...@apache.org> on 2026/10/12 07:51:00 UTC

[jira] [Created] (SLING-13385) JCR DavEx: update embedded Jackrabbit for CVE-2026-92414

Rishabh Daim created SLING-13385:
------------------------------------

             Summary: JCR DavEx: update embedded Jackrabbit for CVE-2026-92414
                 Key: SLING-13385
                 URL: https://issues.apache.org/jira/browse/SLING-13385
             Project: Sling
          Issue Type: Bug
    Affects Versions: JCR Davex 1.3.14
            Reporter: Rishabh Daim
             Fix For: JCR Davex 1.3.16


JCR DavEx 1.3.14 embeds Jackrabbit JCR server 2.22.4, affected by [CVE-2026-92414|https://github.com/advisories/GHSA-3mf8-5fj8-p748] (cached-session reuse across users).

Update the embedded Jackrabbit dependency to a secure compatible release (currently 2.22.5) and release a corrected DavEx bundle. Verify the packaged classes and cross-user session isolation.

Confirmed by published POM/JAR inspection; runtime reproduction has not been performed.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)