RHLW-2026-9bd677f780e42d38

See a problem?
Please try reporting it to the source first.
Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-9bd677f780e42d38.json
Import Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-9bd677f780e42d38.json
JSON Data
https://api.test.osv.dev/v1/vulns/RHLW-2026-9bd677f780e42d38
Upstream
Published
2026-10-08T19:45:33Z
Modified
2026-10-22T00:08:35Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Lightwell Security Advisory: classgraph 4.8.36.rhlw-00001
Details

Red Hat Lightwell has released io.github.classgraph:classgraph 4.8.36.rhlw-00001 with a backported security fix.

CVE-2021-47621: ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.

This patched artifact is a drop-in replacement for io.github.classgraph:classgraph 4.8.36 from Maven Central.

References
Credits
    • Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / io.github.classgraph:classgraph

Package

Name
io.github.classgraph:classgraph
Purl
pkg:maven/io.github.classgraph/classgraph

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.8.36.rhlw-00001

Affected versions

4.*
4.0.0-beta-11
4.0.0-beta-12
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.2.9
4.2.10
4.2.11
4.2.12
4.3.0
4.3.1
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.4.6
4.4.7
4.4.8
4.4.9
4.4.10
4.4.11
4.4.12
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.15
4.6.16
4.6.17
4.6.18
4.6.19
4.6.20
4.6.21
4.6.22
4.6.23
4.6.24
4.6.25
4.6.26
4.6.27
4.6.28
4.6.29
4.6.30
4.6.31
4.6.32
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.8.10
4.8.11
4.8.12
4.8.13
4.8.14
4.8.15
4.8.16
4.8.17
4.8.19
4.8.20
4.8.21
4.8.22
4.8.23
4.8.24
4.8.25
4.8.26
4.8.27
4.8.28
4.8.29
4.8.30
4.8.31
4.8.32
4.8.33
4.8.34
4.8.35
4.8.36

Database specific

lightwell 
{
    "backport_base_version": "4.8.36",
    "remediated_version": "4.8.36.rhlw-00001",
    "repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}
source 
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-9bd677f780e42d38.json"