com.primust:primust-cedar (>=1.0.2, <=1.0.3), io.github.devnico:cedar4s-client_2.13 (>=0.1.0, <=0.1.6) +12 more potentially affected by CVE-2026-55771 via com.cedarpolicy:cedar-java (>=4.3.0, <=4.8.0)

com.cedarpolicy:cedar-java MAVEN version =4.3.0, =1.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.6 Source cves: CVE-2026-55771 Source advisory: GHSA-4R9R-4425-74P7...

com.primust:primust-cedar (>=1.0.2, <=1.0.3), io.github.devnico:cedar4s-client_2.13 (>=0.1.0, <=0.1.6) +12 more potentially affected by CVE-2026-55772 via com.cedarpolicy:cedar-java (>=4.3.0, <=4.8.0)

com.cedarpolicy:cedar-java MAVEN version =4.3.0, =1.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.6 Source cves: CVE-2026-55772 Source advisory: MEND:CVE-2026-55772...

Cedar-Expression Injection

com.cedarpolicy, cedar-java is vulnerable to Cedar-expression injection. The vulnerability is due to the toCedarExpr method failing to escape special characters in user-controlled input, which allows an attacker to inject arbitrary Cedar expressions and manipulate authorization decisions...

com.primust:primust-cedar (>=1.0.2, <=1.0.3), io.github.devnico:cedar4s-client_2.13 (>=0.1.0, <=0.1.6) +12 more potentially affected by CVE-2026-55773 via com.cedarpolicy:cedar-java (>=4.3.0, <=4.8.0)

com.cedarpolicy:cedar-java MAVEN version =4.3.0, =1.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.6 Source cves: CVE-2026-55773 Source advisory: GHSA-QMCH-V2Q9-WG4P...