CVE-2026-1990

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-1990

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1990.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-1990

Published

2026-02-06T05:02:08.766Z

Modified

2026-07-15T01:49:12.097409283Z

Severity

1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

oatpp Type.hpp ObjectWrapper null pointer dereference

Details

A security vulnerability has been detected in oatpp up to 1.3.1. This impacts the function oatpp::data::type::ObjectWrapper::ObjectWrapper of the file src/oatpp/data/type/Type.hpp. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1990.json",
    "cwe_ids": [
        "CWE-404",
        "CWE-476"
    ],
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/oatpp/oatpp

Affected ranges

Type

GIT

Repo

https://github.com/oatpp/oatpp

Events

Introduced

17ef2a7f6c8a932498799b2a5ae5aab2869975c7

Last affected

17ef2a7f6c8a932498799b2a5ae5aab2869975c7

Database specific

{
    "extracted_events": [
        {
            "introduced": "1.3.0"
        },
        {
            "last_affected": "1.3.0"
        },
        {
            "introduced": "1.3.1"
        },
        {
            "last_affected": "1.3.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.3.0

1.3.0-latest

1.3.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1990.json"