Vulnerabilities

GraphDB is built on the Eclipse Temurin base image. For low and medium severity vulnerabilities, we do not patch individual OS packages in that image out of cycle. Instead, we rely on the Temurin project to address these in their own releases, and we always build GraphDB on the latest available Temurin base image version. The reason is that the OS packages in the base image are tested together as a bundle. Patching a single package in isolation can introduce unexpected behavior, so any base image update goes through our normal testing and release process for a GraphDB version.

For high and critical severity vulnerabilities, if a fix is not yet available by the time of our next scheduled release, we may update the affected packages out of cycle to address the risk sooner.

Vulnerability	Severity	Description	Expected fix version
GDB-SA-2026-001	9.8 Critical	On GraphDB instances that serve HTTPS with an RSA TLS key and have not configured a custom graphdb.auth.token.secret, an unauthenticated remote attacker can derive the internal authentication secret from information already exposed in the server’s public TLS certificate. This allows forged requests that bypass authentication and gain full administrative access, which can be leveraged for arbitrary command execution on the host. Instances with a custom graphdb.auth.token.secret configured are not affected. As an interim mitigation, operators are strongly advised to set a strong, random graphdb.auth.token.secret in graphdb.properties.	11.5.2

Third-party vulnerabilities

GraphDB uses a number of third-party libraries as dependencies. To ensure a secure and reliable product, Graphwise performs regular vulnerability scans and takes appropriate actions to address any newly identified vulnerabilities.

Typically, vulnerabilities are addressed by upgrading the affected libraries to a newer version, where the vulnerability was fixed.

When it is not possible to upgrade a library, Graphwise addresses each case individually. This may include a statement that a vulnerability does not apply to GraphDB, an Graphwise patch for that vulnerability, or both.

Vulnerability	Severity	Description	Expected fix version
CVE-2026-2332	7.4 High	CVE-2026-2332 is an HTTP/1.1 request smuggling vulnerability in Jetty’s server-side HttpParser. Our usage of jetty-http is exclusively as an outbound HTTP client. The vulnerable server-side parsing code path is never executed in our deployment. The attack preconditions are not met. Therefore this is not exploitable in this configuration.
CVE-2026-77422	7.5 High	CVE-2026-77422 is a regular expression denial of service (ReDoS) vulnerability in the built-in grep command of JLine. GraphDB uses JLine only as a transitive dependency of the RDF4J console, and neither GraphDB nor the RDF4J console uses JLine’s built-in commands. The vulnerable code path is never executed. Therefore this is not exploitable in this configuration.	11.5.2
CVE-2026-68497	7.5 High	CVE-2026-68497 is a denial of service vulnerability in jackson-databind 2.x when deserializing Duration or XMLGregorianCalendar values from JSON. GraphDB never deserializes untrusted JSON into these types. The vulnerable code path is not reachable. Therefore this is not exploitable in this configuration.	11.5.2
CVE-2026-84782	8.2 High	CVE-2026-84782 is a memory disclosure and denial of service vulnerability in OpenSSL’s DTLS implementation. It is not in GraphDB itself but in the OpenSSL packages of the Ubuntu 24.04 operating system layer of the eclipse-temurin:21 base image, on which the GraphDB Docker image is built. Ubuntu has released a fix, and it will be included in the GraphDB Docker image once the eclipse-temurin:21 base image is updated. According to the OpenSSL advisory, only DTLS is affected, not TLS. GraphDB does not use the system OpenSSL library and does not use DTLS. Therefore this is not exploitable in this configuration.	11.5.2
CVE-2026-91776	7.5 High	CVE-2026-91776 is a denial of service vulnerability in jackson-databind (2.x and 3.x) where unknown polymorphic type ids are cached without limit when @JsonTypeInfo is used with a default implementation. GraphDB’s only such type accepts a small fixed set of type ids and rejects all others before they are cached. The vulnerable code path is not reachable. Therefore this is not exploitable in this configuration.	11.5.2
CVE-2026-91777	7.5 High	CVE-2026-91777 is a denial of service vulnerability in jackson-databind (2.x and 3.x) affecting classes annotated with @JsonIdentityInfo. GraphDB does not use @JsonIdentityInfo. The vulnerable code path is never executed. Therefore this is not exploitable in this configuration.	11.5.2
CVE-2026-89407	7.5 High	CVE-2026-89407 is a resource-consumption vulnerability in jackson-core: converting a long numeric-looking string to a number triggers disproportionate CPU use through inefficient regular expression backtracking. In GraphDB, a crafted JSON request to the cluster management REST endpoints causes a single request to consume several seconds of CPU, and a large volume of such requests could degrade availability. It affects availability only and does not expose or modify any data. Because GraphDB security is disabled by default, such requests can be sent by any client with network access in a default installation. A fix will be included in an upcoming GraphDB release. In the meantime, mitigate by enabling GraphDB security so that the REST API requires authentication, and by restricting network access to the GraphDB REST API.	11.5.2
CVE-2026-89425	7.5 High	CVE-2026-89425 is a denial of service vulnerability in jackson-core that affects only JSON parsing from a DataInput source. GraphDB does not parse JSON from DataInput sources. The vulnerable code path is never executed. Therefore this is not exploitable in this configuration.	11.5.2
CVE-2026-106451	7.3 High	CVE-2026-106451 is a race condition vulnerability in lz4-java’s native library loader that can lead to local privilege escalation and native code execution. The vulnerability occurs because Native.load() creates a predictable temporary file in a shared directory. Because GraphDB uses LZ4 for backups and relies on the default system-wide temporary folder, this mechanism poses a direct risk. Therefore, this is exploitable in default deployments unless mitigated by configuring a private java.io.tmpdir, using a system library, or enforcing Java-only implementations.	11.5.2
CVE-2026-47884	9.8 Critical	CVE-2026-47884 is a path traversal vulnerability in Spring Framework’s XsltView that can lead to SSRF and remote code execution in Spring MVC applications that render XsltView through a /** mapping without an explicit view name. Spring rates this vulnerability as Medium; the Critical score shown on NVD comes from a third-party (CISA ADP) enrichment. GraphDB does not use XsltView. The vulnerable code path is never executed. Therefore this is not exploitable in this configuration.	12.0
CVE-2026-47890	9.8 Critical	CVE-2026-47890 is a stream tampering vulnerability in Spring Framework that can lead to data forgery and session corruption in applications using Server-Sent Events (SSE) to stream raw HTML or UI code snippets without proper line-break validation. GraphDB uses its REST APIs strictly to stream graph data, SPARQL results, and structured JSON payloads. The vulnerable configuration required to trigger this exploit is not present.	12.0