GHSA-97jf-46m3-8953

Suggest an improvement
Source
https://github.com/advisories/GHSA-97jf-46m3-8953
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-97jf-46m3-8953/GHSA-97jf-46m3-8953.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-97jf-46m3-8953
Aliases
Downstream
Published
2026-05-12T18:30:42Z
Modified
2026-07-17T21:08:59Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Security feature bypass vulnerability in Azure Key Vault Keys library for Java
Details

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.

Database specific 
{
    "cwe_ids":  [
        "CWE-287",
        "CWE-347"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-02T22:18:30Z",
    "nvd_published_at":  "2026-05-12T18:17:04Z",
    "severity":  "CRITICAL"
}
References

Affected packages

Maven / com.azure:azure-security-keyvault-keys

Package

Name
com.azure:azure-security-keyvault-keys
View open source insights on deps.dev
Purl
pkg:maven/com.azure/azure-security-keyvault-keys

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.10.6

Affected versions

4.*
4.0.0
4.0.1
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.2.0-beta.1
4.2.0-beta.2
4.2.0-beta.3
4.2.0-beta.4
4.2.0-beta.5
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0-beta.1
4.3.0-beta.2
4.3.0-beta.3
4.3.0-beta.4
4.3.0-beta.5
4.3.0-beta.6
4.3.0-beta.7
4.3.0-beta.8
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.4.0-beta.1
4.4.0-beta.2
4.4.0-beta.3
4.4.0-beta.4
4.4.0-beta.5
4.4.0-beta.6
4.4.0-beta.7
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.4.6
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.6.0-beta.1
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.7.0
4.7.1
4.7.2
4.7.3
4.8.0-beta.1
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0-beta.1
4.9.0
4.9.1
4.9.2
4.9.3
4.9.4
4.10.0-beta.1
4.10.0
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-97jf-46m3-8953/GHSA-97jf-46m3-8953.json"