8 matches found
OGNL Stricter-invocation Block List Bypass Via Java.lang.reflect Reflection Proxies
Summary OGNL's optional stricter invocation mode maintains a block list that prevents expressions from directly calling methods on dangerous classes such as "Runtime", "ProcessBuilder", and "ClassLoader". The block list filters on the declaring class of the method OGNL invokes. Because...
OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies
Summary OGNL's optional stricter invocation mode maintains a block list that prevents expressions from directly calling methods on dangerous classes such as Runtime, ProcessBuilder, and ClassLoader. The block list filters on the declaring class of the method OGNL invokes. Because...
GHSA-CRWC-VW2R-QR6M OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies
Summary OGNL's optional stricter invocation mode maintains a block list that prevents expressions from directly calling methods on dangerous classes such as Runtime, ProcessBuilder, and ClassLoader. The block list filters on the declaring class of the method OGNL invokes. Because...
CVE-2026-113730
The OGNL (Object Graph Navigation Library for Java) library versions prior to 3.4.13 are vulnerable to a stricter-invocation block list bypass . The root cause is that OgnlRuntime.invokeMethod fails to block java.lang.reflect.Method, java.lang.reflect.Constructor, or java.lang.reflect.Field. This...
CVE-2026-113730 OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies
OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Method, java.lang.reflect.Constructor, or java.lang.reflect.Field...
CVE-2026-113730 OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies
OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Method, java.lang.reflect.Constructor, or java.lang.reflect.Field...
CVE-2026-113730 OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies
OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Method, java.lang.reflect.Constructor, or java.lang.reflect.Field...
