Homepage

Out-of-bounds Read The advisory has been revoked - it doesn't affect any version of package maven-resolver  (opens in a new tab)

Threat Intelligence

EPSS
0.38% (31st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-MAVENRESOLVER-20717249
  • published10 Oct 2026
  • disclosed8 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 8 Oct 2026

NewCVE-2026-107726  (opens in a new tab)
CWE-125  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream maven-resolver package and not the maven-resolver package as distributed by RHEL.

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, and JVM process address space. The same flaw can crash cluster members and, in some Hazelcast Enterprise Edition configurations, corrupt memory with possible arbitrary code execution. Both slim and full distributions are affected. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.