CVE-2026-22865
- Source
- https://cve.org/CVERecord?id=CVE-2026-22865
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22865.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-22865
- Aliases
-
- BIT-gradle-2026-22865
- GHSA-mqwm-5m85-gmcv
- Downstream
- Related
- Published
- 2026-01-16T22:46:19.741Z
- Modified
- 2026-07-15T01:49:05.637541197Z
- Severity
-
- 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N CVSS Calculator
- Summary
- Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts
- Details
-
Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and would not cause a repository to be disabled. If a build encountered one of these exceptions, Gradle would continue to the next repository in the list and potentially resolve dependencies from a different repository. An exception like NoHttpResponseException can indicate transient errors. If the errors persist after a maximum number of retries, Gradle would continue to the next repository. This behavior could allow an attacker to disrupt the service of a repository and leverage another repository to serve malicious artifacts. This attack requires the attacker to have control over a repository after the disrupted repository. Gradle has introduced a change in behavior in Gradle 9.3.0 to stop searching other repositories when encountering these errors.
- Database specific
{ "cwe_ids": [ "CWE-494", "CWE-829" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22865.json", "cna_assigner": "GitHub_M" }- References
Affected packages
Git / github.com/gradle/gradle
Affected ranges
- Type
- GIT
- Repo
- https://github.com/gradle/gradle
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixed
- Database specific
{ "cpe": "cpe:2.3:a:gradle:gradle:*:*:*:*:*:*:*:*", "source": "CPE_RANGE", "extracted_events": [ { "introduced": "0" }, { "fixed": "8.14.4" }, { "introduced": "9.0.0" }, { "fixed": "9.3.0" } ] }