CVE-2026-22816

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2026-22816
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22816.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-22816
Aliases
Downstream
Published
2026-01-16T22:45:48.937Z
Modified
2026-01-21T09:41:13.825599Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N CVSS Calculator
Summary
Gradle fails to disable repositories which can expose builds to malicious artifacts
Details

Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and would not cause a repository to be disabled. If a build encountered one of these exceptions, Gradle would continue to the next repository in the list and potentially resolve dependencies from a different repository. If a Gradle build used an unresolvable host name, Gradle would continue to work as long as all dependencies could be resolved from another repository. An unresolvable host name could be caused by allowing a repository's domain name registration to lapse or typo-ing the real domain name. This behavior could allow an attacker to register a service under the host name used by the build and serve malicious artifacts. The attack requires the repository to be listed before others in the build configuration. Gradle has introduced a change in behavior in Gradle 9.3.0 to stop searching other repositories when encountering these errors.

Database specific 
{
    "cwe_ids": [
        "CWE-494",
        "CWE-829"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22816.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/gradle/gradle

Affected ranges

Type
GIT
Repo
https://github.com/gradle/gradle
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
701205ed2f78811508466c8e1952304c2ea869f5

Affected versions

REL-0.*

REL-0.8
REL-0.9-preview-1
REL-0.9-preview-2
REL-0.9-preview-3
REL-0.9-rc-1

REL_0.*

REL_0.9
REL_0.9-rc-2
REL_0.9-rc-3
REL_0.9.1
REL_0.9.2

REL_1.*

REL_1.0
REL_1.0-milestone-1
REL_1.0-milestone-2
REL_1.0-milestone-3
REL_1.0-milestone-4
REL_1.0-milestone-5
REL_1.0-milestone-6
REL_1.0-milestone-7
REL_1.0-milestone-8
REL_1.0-milestone-8a
REL_1.0-milestone-9
REL_1.0-rc-1
REL_1.0-rc-2
REL_1.0-rc-3
REL_1.1
REL_1.1-rc-1
REL_1.1-rc-2
REL_1.10
REL_1.10-rc-1
REL_1.10-rc-2
REL_1.11
REL_1.11-rc-1
REL_1.12
REL_1.12-rc-1
REL_1.12-rc-2
REL_1.2
REL_1.2-rc-1
REL_1.3
REL_1.3-rc-1
REL_1.3-rc-2
REL_1.4
REL_1.4-rc-1
REL_1.4-rc-2
REL_1.4-rc-3
REL_1.5
REL_1.5-rc-1
REL_1.5-rc-2
REL_1.5-rc-3
REL_1.6
REL_1.6-rc-1
REL_1.7
REL_1.7-rc-1
REL_1.7-rc-2
REL_1.8
REL_1.8-rc-1
REL_1.8-rc-2
REL_1.9
REL_1.9-rc-1
REL_1.9-rc-2
REL_1.9-rc-3
REL_1.9-rc-4

REL_2.*

REL_2.0
REL_2.0-rc-1
REL_2.0-rc-2
REL_2.1
REL_2.1-rc-1
REL_2.1-rc-2
REL_2.1-rc-3
REL_2.1-rc-4
REL_2.10
REL_2.10-rc-1
REL_2.10-rc-2
REL_2.11
REL_2.11-rc-1
REL_2.11-rc-2
REL_2.11-rc-3
REL_2.12
REL_2.12-rc-1
REL_2.13
REL_2.13-rc-1
REL_2.13-rc-2
REL_2.14
REL_2.14-rc-1
REL_2.14-rc-2
REL_2.14-rc-3
REL_2.14-rc-4
REL_2.14-rc-5
REL_2.14-rc-6
REL_2.14.1
REL_2.14.1-rc-1
REL_2.14.1-rc-2
REL_2.2
REL_2.2-rc-1
REL_2.2-rc-2
REL_2.2.1
REL_2.2.1-rc-1
REL_2.3
REL_2.3-rc-1
REL_2.3-rc-2
REL_2.3-rc-3
REL_2.3-rc-4
REL_2.4
REL_2.4-rc-1
REL_2.4-rc-2
REL_2.5
REL_2.5-rc-1
REL_2.5-rc-2
REL_2.6
REL_2.6-rc-1
REL_2.6-rc-2
REL_2.7
REL_2.7-rc-1
REL_2.7-rc-2
REL_2.8
REL_2.8-rc-1
REL_2.8-rc-2
REL_2.9
REL_2.9-rc-1

REL_3.*

REL_3.0
REL_3.0-milestone-1
REL_3.0-milestone-2
REL_3.0-rc-1
REL_3.0-rc-2
REL_3.1
REL_3.1-rc-1
REL_3.2
REL_3.2-rc-1
REL_3.2-rc-2
REL_3.2-rc-3
REL_3.2.1
REL_3.3
REL_3.3-rc-1
REL_3.4
REL_3.4-rc-2
REL_3.4-rc-3
REL_3.4.1
REL_3.5
REL_3.5-rc-1
REL_3.5-rc-2
REL_3.5-rc-3
REL_3.5.1

REL_4.*

REL_4.0
REL_4.0-milestone-1
REL_4.0-milestone-2
REL_4.0-rc-1
REL_4.0-rc-2
REL_4.0-rc-3
REL_4.0.1
REL_4.0.2
REL_4.1
REL_4.1-milestone-1
REL_4.1-rc-1
REL_4.1-rc-2
REL_4.2
REL_4.2-rc-1
REL_4.2-rc-2
REL_4.2.1
REL_4.3
REL_4.3-rc-1
REL_4.3-rc-2
REL_4.3-rc-3
REL_4.3-rc-4
REL_4.3.1
REL_4.4
REL_4.4-rc-1
REL_4.4-rc-2
REL_4.4-rc-3
REL_4.4-rc-4
REL_4.4-rc-5
REL_4.4-rc-6

v0.*

v0.8
v0.8.0
v0.9
v0.9-RC1
v0.9-RC2
v0.9-RC3
v0.9.0
v0.9.0-RC1
v0.9.0-RC2
v0.9.0-RC3
v0.9.1
v0.9.2

v1.*

v1.0
v1.0-M1
v1.0-M2
v1.0-M3
v1.0-M4
v1.0-M5
v1.0-M6
v1.0-M7
v1.0-M8
v1.0-M8a
v1.0-M9
v1.0-RC1
v1.0-RC2
v1.0-RC3
v1.0.0
v1.0.0-M1
v1.0.0-M2
v1.0.0-M3
v1.0.0-M4
v1.0.0-M5
v1.0.0-M6
v1.0.0-M7
v1.0.0-M8
v1.0.0-M8a
v1.0.0-M9
v1.0.0-RC1
v1.0.0-RC2
v1.0.0-RC3
v1.1
v1.1-RC1
v1.1-RC2
v1.1.0
v1.1.0-RC1
v1.1.0-RC2
v1.10
v1.10-RC1
v1.10-RC2
v1.10.0
v1.10.0-RC1
v1.10.0-RC2
v1.11
v1.11-RC1
v1.11.0
v1.11.0-RC1
v1.12
v1.12-RC1
v1.12-RC2
v1.12.0
v1.12.0-RC1
v1.12.0-RC2
v1.2
v1.2-RC1
v1.2.0
v1.2.0-RC1
v1.3
v1.3-RC1
v1.3-RC2
v1.3.0
v1.3.0-RC1
v1.3.0-RC2
v1.4
v1.4-RC1
v1.4-RC2
v1.4-RC3
v1.4.0
v1.4.0-RC1
v1.4.0-RC2
v1.4.0-RC3
v1.5
v1.5-RC1
v1.5-RC2
v1.5-RC3
v1.5.0
v1.5.0-RC1
v1.5.0-RC2
v1.5.0-RC3
v1.6
v1.6-RC1
v1.6.0
v1.6.0-RC1
v1.7
v1.7-RC1
v1.7-RC2
v1.7.0
v1.7.0-RC1
v1.7.0-RC2
v1.8
v1.8-RC1
v1.8-RC2
v1.8.0
v1.8.0-RC1
v1.8.0-RC2
v1.9
v1.9-RC1
v1.9-RC2
v1.9-RC3
v1.9-RC4
v1.9.0
v1.9.0-RC1
v1.9.0-RC2
v1.9.0-RC3
v1.9.0-RC4

v2.*

v2.0
v2.0-RC1
v2.0-RC2
v2.0.0
v2.0.0-RC1
v2.0.0-RC2
v2.1
v2.1-RC1
v2.1-RC2
v2.1-RC3
v2.1-RC4
v2.1.0
v2.1.0-RC1
v2.1.0-RC2
v2.1.0-RC3
v2.1.0-RC4
v2.10
v2.10-RC1
v2.10-RC2
v2.10.0
v2.10.0-RC1
v2.10.0-RC2
v2.11
v2.11-RC1
v2.11-RC2
v2.11-RC3
v2.11.0
v2.11.0-RC1
v2.11.0-RC2
v2.11.0-RC3
v2.12
v2.12-RC1
v2.12.0
v2.12.0-RC1
v2.13
v2.13-RC1
v2.13-RC2
v2.13.0
v2.13.0-RC1
v2.13.0-RC2
v2.14
v2.14-RC1
v2.14-RC2
v2.14-RC3
v2.14-RC4
v2.14-RC5
v2.14-RC6
v2.14.0
v2.14.0-RC1
v2.14.0-RC2
v2.14.0-RC3
v2.14.0-RC4
v2.14.0-RC5
v2.14.0-RC6
v2.14.1
v2.14.1-RC1
v2.14.1-RC2
v2.2
v2.2-RC1
v2.2-RC2
v2.2.0
v2.2.0-RC1
v2.2.0-RC2
v2.2.1
v2.2.1-RC1
v2.3
v2.3-RC1
v2.3-RC2
v2.3-RC3
v2.3-RC4
v2.3.0
v2.3.0-RC1
v2.3.0-RC2
v2.3.0-RC3
v2.3.0-RC4
v2.4
v2.4-RC1
v2.4-RC2
v2.4.0
v2.4.0-RC1
v2.4.0-RC2
v2.5
v2.5-RC1
v2.5-RC2
v2.5.0
v2.5.0-RC1
v2.5.0-RC2
v2.6
v2.6-RC1
v2.6-RC2
v2.6.0
v2.6.0-RC1
v2.6.0-RC2
v2.7
v2.7-RC1
v2.7-RC2
v2.7.0
v2.7.0-RC1
v2.7.0-RC2
v2.8
v2.8-RC1
v2.8-RC2
v2.8.0
v2.8.0-RC1
v2.8.0-RC2
v2.9
v2.9-RC1
v2.9.0
v2.9.0-RC1

v3.*

v3.0.0
v3.0.0-M1
v3.0.0-M2
v3.0.0-RC1
v3.0.0-RC2
v3.1.0
v3.1.0-RC1
v3.2.0
v3.2.0-RC1
v3.2.0-RC2
v3.2.0-RC3
v3.2.1
v3.3.0
v3.3.0-RC1
v3.4.0
v3.4.0-RC1
v3.4.0-RC2
v3.4.0-RC3
v3.4.1
v3.5.0
v3.5.0-RC1
v3.5.0-RC2
v3.5.0-RC3
v3.5.1

v4.*

v4.0.0
v4.0.0-M1
v4.0.0-M2
v4.0.0-RC1
v4.0.0-RC2
v4.0.0-RC3
v4.0.0-milestone-1
v4.0.1
v4.0.2
v4.1.0
v4.1.0-M1
v4.1.0-RC1
v4.1.0-RC2
v4.10.0
v4.10.0-RC1
v4.10.0-RC2
v4.10.0-RC3
v4.10.1
v4.10.2
v4.2.0
v4.2.0-RC1
v4.2.0-RC2
v4.2.1
v4.3.0
v4.3.0-RC1
v4.3.0-RC2
v4.3.0-RC3
v4.3.0-RC4
v4.3.1
v4.4.0
v4.4.0-RC1
v4.4.0-RC2
v4.4.0-RC3
v4.4.0-RC4
v4.4.0-RC5
v4.4.0-RC6
v4.4.1
v4.5.0
v4.5.0-RC1
v4.5.0-RC2
v4.5.1
v4.6.0
v4.6.0-RC1
v4.6.0-RC2
v4.7.0
v4.7.0-RC1
v4.7.0-RC2
v4.8.0
v4.8.0-RC1
v4.8.0-RC2
v4.8.0-RC3
v4.8.1
v4.9.0
v4.9.0-RC1
v4.9.0-RC2

v5.*

v5.0.0
v5.0.0-M1
v5.0.0-RC1
v5.0.0-RC2
v5.0.0-RC3
v5.0.0-RC4
v5.0.0-RC5
v5.1.0
v5.1.0-M1
v5.1.0-RC1
v5.1.0-RC2
v5.1.0-RC3
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
v5.3.0
v5.3.0-RC1
v5.3.0-RC2
v5.3.0-RC3
v5.3.1
v5.4.0
v5.4.0-RC1
v5.4.1
v5.5.0
v5.5.0-RC1
v5.5.0-RC2
v5.5.0-RC3
v5.5.0-RC4
v5.5.1
v5.6.0
v5.6.0-RC1
v5.6.0-RC2
v5.6.1
v5.6.2
v5.6.3
v5.6.4

v6.*

v6.0.0
v6.0.0-RC1
v6.0.0-RC2
v6.0.0-RC3
v6.0.1
v6.1.0
v6.1.0-M1
v6.1.0-M2
v6.1.0-M3
v6.1.0-RC1
v6.1.0-RC2
v6.1.0-RC3
v6.1.1
v6.2.0
v6.2.0-RC1
v6.2.0-RC2
v6.2.0-RC3
v6.2.1
v6.2.2
v6.3.0
v6.3.0-RC1
v6.3.0-RC2
v6.3.0-RC3
v6.3.0-RC4
v6.4.0
v6.4.0-RC1
v6.4.0-RC2
v6.4.0-RC3
v6.4.0-RC4
v6.4.1
v6.5.0
v6.5.0-M1
v6.5.0-M2
v6.5.0-RC1
v6.5.1
v6.6.0
v6.6.0-M1
v6.6.0-M2
v6.6.0-M3
v6.6.0-RC1
v6.6.0-RC2
v6.6.0-RC3
v6.6.0-RC4
v6.6.0-RC5
v6.6.0-RC6
v6.6.1
v6.7.0
v6.7.0-RC1
v6.7.0-RC2
v6.7.0-RC3
v6.7.0-RC4
v6.7.0-RC5
v6.7.1
v6.8.0
v6.8.0-M1
v6.8.0-M2
v6.8.0-M3
v6.8.0-RC1
v6.8.0-RC2
v6.8.0-RC3
v6.8.0-RC4
v6.8.0-RC5
v6.8.1
v6.8.2
v6.8.3

v7.*

v7.0.0
v7.0.0-M1
v7.0.0-M2
v7.0.0-M3
v7.0.0-RC1
v7.0.0-RC2
v7.0.1
v7.0.2
v7.1.0
v7.1.0-RC1
v7.1.0-RC2
v7.1.1
v7.2.0
v7.2.0-RC1
v7.2.0-RC2
v7.2.0-RC3
v7.3.0
v7.3.0-RC1
v7.3.0-RC2
v7.3.0-RC3
v7.3.0-RC4
v7.3.0-RC5
v7.3.1
v7.3.2
v7.3.3
v7.3.3-RC1
v7.4.0
v7.4.0-RC1
v7.4.0-RC2
v7.4.1
v7.4.2
v7.5.0
v7.5.0-M1
v7.5.0-RC1
v7.5.0-RC2
v7.5.0-RC3
v7.5.0-RC4
v7.5.0-RC5
v7.5.1
v7.6.0
v7.6.0-M1
v7.6.0-RC1
v7.6.0-RC2
v7.6.0-RC3
v7.6.0-RC4
v7.6.1

v8.*

v8.0.0
v8.0.0-M1
v8.0.0-M2
v8.0.0-M3
v8.0.0-M4
v8.0.0-M5
v8.0.0-M6
v8.0.0-RC1
v8.0.0-RC2
v8.0.0-RC3
v8.0.0-RC4
v8.0.0-RC5
v8.0.1
v8.0.2
v8.1.0
v8.1.0-RC1
v8.1.0-RC2
v8.1.0-RC3
v8.1.0-RC4
v8.1.1
v8.10.0
v8.10.0-RC1
v8.10.1
v8.10.2
v8.10.2-M1
v8.11.0
v8.11.0-M1
v8.11.0-RC1
v8.11.0-RC2
v8.11.0-RC3
v8.11.1
v8.12.0
v8.12.0-RC1
v8.12.0-RC2
v8.12.1
v8.12.1-M1
v8.13.0
v8.13.0-M1
v8.13.0-M2
v8.13.0-M3
v8.13.0-RC1
v8.13.0-RC2
v8.14.0
v8.14.0-M1
v8.14.0-M2
v8.14.0-M3
v8.14.0-M4
v8.14.0-M5
v8.14.0-M6
v8.14.0-M7
v8.14.0-M8
v8.14.0-RC1
v8.14.0-RC2
v8.14.0-RC3
v8.14.1
v8.14.2
v8.2.0
v8.2.0-M1
v8.2.0-RC1
v8.2.0-RC2
v8.2.0-RC3
v8.2.1
v8.3.0
v8.3.0-RC1
v8.3.0-RC2
v8.3.0-RC3
v8.3.0-RC4
v8.4.0
v8.4.0-RC1
v8.4.0-RC2
v8.4.0-RC3
v8.5.0
v8.5.0-RC1
v8.5.0-RC2
v8.5.0-RC3
v8.5.0-RC4
v8.6.0
v8.6.0-M1
v8.6.0-RC1
v8.6.0-RC2
v8.6.0-RC3
v8.6.0-RC4
v8.7.0
v8.7.0-RC1
v8.7.0-RC2
v8.7.0-RC3
v8.7.0-RC4
v8.8.0
v8.8.0-RC1
v8.8.0-RC2
v8.9.0
v8.9.0-RC1
v8.9.0-RC2

v9.*

v9.0.0
v9.0.0-M1
v9.0.0-M10
v9.0.0-M2
v9.0.0-M4
v9.0.0-M5
v9.0.0-M6
v9.0.0-M7
v9.0.0-M8
v9.0.0-M9
v9.0.0-RC1
v9.0.0-RC2
v9.0.0-RC3
v9.0.0-RC4
v9.1.0
v9.1.0-RC1
v9.1.0-RC2
v9.1.0-RC3
v9.1.0-RC4
v9.2.0
v9.2.0-M1
v9.2.0-M2
v9.2.0-RC1
v9.2.0-RC2
v9.2.0-RC3
v9.2.1
v9.3.0-M1
v9.3.0-M2
v9.3.0-RC1
v9.3.0-RC2
v9.3.0-RC3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22816.json"