CVE-2026-92415

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

DEBIAN-CVE-2026-92415

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

CVE-2026-92415

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

UBUNTU-CVE-2026-92415

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

CVE-2026-92415 Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

CVE-2026-92415 Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

org.apache.jackrabbit.vault:org.apache.jackrabbit.vault (4.0.0), org.apache.jackrabbit.vault:org.apache.jackrabbit.vault.rcp (4.0.0) +6 more potentially affected by CVE-2026-92415 via org.apache.jackrabbit:jackrabbit-spi2dav (>=2.22.0, <=2.22.4)

org.apache.jackrabbit:jackrabbit-spi2dav MAVEN version =2.22.0, =4.0.0, =2.22.0, =2.22.0, =2.22.4 - org.apache.sling:org.apache.sling.starter.integration-tests 14 Source cves: CVE-2026-92415 Source advisory: MEND:CVE-2026-92415...

org.apache.jackrabbit:jackrabbit-jcr2dav (>=2.23.0-beta, <=2.23.5-beta), org.apache.jackrabbit:jackrabbit-standalone-components (>=2.23.0-beta, <=2.23.5-beta) potentially affected by CVE-2026-92415 via org.apache.jackrabbit:jackrabbit-spi2dav (>=2.23.0-beta, <=2.23.5-beta)

org.apache.jackrabbit:jackrabbit-spi2dav MAVEN version =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.5-beta Source cves: CVE-2026-92415 Source advisory: MEND:CVE-2026-92415...

CVE-2026-92415

The Apache Jackrabbit WebDAV/DavEx client is vulnerable to unsafe reflection when interacting with a malicious WebDAV/DavEx server or an intercepted connection. The root cause is that the client runs Class.forName and a (String)-constructor on server-controlled error bodies, allowing an attacker ...

CVE-2026-92415

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

PT-2026-107580

Name of the Vulnerable Software and Affected Versions Apache Jackrabbit versions 2.23.0 through 2.23.5 Apache Jackrabbit versions 2.22.0 through 2.22.4 Apache Jackrabbit versions 2.20.0 through 2.20.17 Description The WebDAV/DavEx client contains a flaw where it uses externally-controlled input t...

de.pfabulist.lindwurm:niodav (>=0.2.4, <=0.4.2), de.pfabulist.lindwurm:stellvertreter-app (0.5.2) +5 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.10.0, <=2.10.3)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.10.0, =0.2.4, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.3 Source cves: CVE-2016-6801 Source advisory: OSV:GHSA-9FC7-RHQ3-WM7X...

de.pfabulist.lindwurm:niodav (>=0.2.4, <=0.4.2), de.pfabulist.lindwurm:stellvertreter-app (0.5.2) +5 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.10.0, <=2.10.3)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.10.0, =0.2.4, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.3 Source cves: CVE-2016-6801 Source advisory: GHSA-9FC7-RHQ3-WM7X...

org.apache.jackrabbit:jackrabbit-bundle (>=2.12.0, <=2.12.3), org.apache.jackrabbit:jackrabbit-jcr-server (>=2.12.0, <=2.12.3) +5 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.12.0, <=2.12.3)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =1.3.2, =1.3.4 - org.apache.sling:org.apache.sling.jcr.webdav 2.3.4 Source cves: CVE-2016-6801 Source advisory: OSV:GHSA-9FC7-RHQ3-WM7X...

org.apache.jackrabbit:jackrabbit-bundle (>=2.12.0, <=2.12.3), org.apache.jackrabbit:jackrabbit-jcr-server (>=2.12.0, <=2.12.3) +5 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.12.0, <=2.12.3)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =1.3.2, =1.3.4 - org.apache.sling:org.apache.sling.jcr.webdav 2.3.4 Source cves: CVE-2016-6801 Source advisory: GHSA-9FC7-RHQ3-WM7X...

net.oneandone.cosmo:cosmo-core (>=1.3.0, <=3.2.4), org.apache.jackrabbit:jackrabbit-bundle (>=2.13.0, <=2.13.2) +5 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.13.0, <=2.13.2)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.13.0, =1.3.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.2 Source cves: CVE-2016-6801 Source advisory: OSV:GHSA-9FC7-RHQ3-WM7X...

net.oneandone.cosmo:cosmo-core (>=1.3.0, <=3.2.4), org.apache.jackrabbit:jackrabbit-bundle (>=2.13.0, <=2.13.2) +5 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.13.0, <=2.13.2)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.13.0, =1.3.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.2 Source cves: CVE-2016-6801 Source advisory: GHSA-9FC7-RHQ3-WM7X...

com.day.cq:cq-compat-codeupgrade (>=1.0.4, <=1.2.10), org.apache.jackrabbit:jackrabbit-core (>=2.0-beta4, <=2.0.5) +6 more potentially affected by CVE-2016-6809 via org.apache.tika:tika-core (0.5)

org.apache.tika:tika-core MAVEN version 0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tika:tika-core and may be impacted: - com.day.cq:cq-compat-codeupgrade =1.0.4, =2.0-beta4, =2.0-beta4, =2.0-beta4, =2.0-beta4, =2.0-beta4, =2.0.5 -...

org.apache.jackrabbit:jackrabbit-core (>=2.0-beta1, <=2.0-beta3), org.apache.jackrabbit:jackrabbit-jca (>=2.0-beta1, <=2.0-beta3) +9 more potentially affected by CVE-2016-6809 via org.apache.tika:tika-core (0.4)

org.apache.tika:tika-core MAVEN version 0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tika:tika-core and may be impacted: - org.apache.jackrabbit:jackrabbit-core =2.0-beta1, =2.0-beta1, =2.0-beta1, =2.0-beta1, =2.0-beta1, =1.4.0,...

com.khubla.com.pragmatach.examples:jcrexample (1.40), com.khubla.pragmatach:pragmatach-jcr (1.40) +15 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.8.0, <=2.8.2)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.8.0, =2.1.0, =2.1.0, =2.8.0, =2.8.0, =2.8.0, =2.8.0, =2.8.0, =1.0.9, =1.0, =0.9.5, =5.13.1, =5.13.1, =5.22.7 and more Source cves: CVE-2016-6801 Source advisory: MEND:CVE-2016-6801...