CVE-2026-25534
- Source
- https://cve.org/CVERecord?id=CVE-2026-25534
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25534.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-25534
- Aliases
- Related
- Published
- 2026-03-17T17:27:41Z
- Modified
- 2026-08-12T15:31:55Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L CVSS Calculator
- Summary
- Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames
- Details
-
Impact
Spinnaker updated URL Validation logic on user input to provide sanitation on user inputted URLs for clouddriver. However, they missed that Java URL objects do not correctly handle underscores on parsing. This led to a bypass of the previous CVE (CVE-2025-61916) through the use of carefully crafted URLs. Note, Spinnaker found this not just in that CVE, but in the existing URL validations in Orca fromUrl expression handling. This CVE impacts BOTH artifacts as a result.
Patches
This has been merged and will be available in versions 2025.4.1, 2025.3.1, 2025.2.4 and 2026.0.0.
Workarounds
You can disable the various artifacts on this system to work around these limits.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-918" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25534.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25534.json
- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-8r8j-gfhg-fw38
- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-vrjc-q2fh-6x9h
- https://nvd.nist.gov/vuln/detail/CVE-2026-25534
- https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda
Affected packages
Git / github.com/spinnaker/spinnaker
Affected ranges
- Type
- GIT
- Repo
- https://github.com/spinnaker/spinnaker
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedIntroducedIntroducedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "2025.2.4" }, { "introduced": "2025.3.0" }, { "fixed": "2025.3.1" }, { "introduced": "2025.4.0" }, { "fixed": "2025.4.1" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }
Affected versions
bn-clouddriver-release-2025.*
bn-clouddriver-release-2025.2.x-5
Other
bn-deck-kayenta-main-2
clouddriver-main-10
clouddriver-main-11
clouddriver-main-12
clouddriver-main-13
clouddriver-main-14
clouddriver-main-15
clouddriver-main-16
clouddriver-main-17
clouddriver-main-18
clouddriver-main-19
clouddriver-main-2
clouddriver-main-20
clouddriver-main-21
clouddriver-main-22
clouddriver-main-23
clouddriver-main-24
clouddriver-main-25
clouddriver-main-26
clouddriver-main-27
clouddriver-main-28
clouddriver-main-29
clouddriver-main-3
clouddriver-main-30
clouddriver-main-31
clouddriver-main-32
clouddriver-main-33
clouddriver-main-34
clouddriver-main-35
clouddriver-main-36
clouddriver-main-37
clouddriver-main-38
clouddriver-main-39
clouddriver-main-4
clouddriver-main-40
clouddriver-main-41
clouddriver-main-42
clouddriver-main-43
clouddriver-main-5
clouddriver-main-6
clouddriver-main-60
clouddriver-main-61
clouddriver-main-62
clouddriver-main-7
clouddriver-main-72
clouddriver-main-73
clouddriver-main-8
clouddriver-main-9
deck-kayenta-main-2
deck-main-2
echo-main-1
echo-main-10
echo-main-11
echo-main-12
echo-main-13
echo-main-14
echo-main-15
echo-main-16
echo-main-17
echo-main-18
echo-main-19
echo-main-2
echo-main-20
echo-main-21
echo-main-22
echo-main-23
echo-main-24
echo-main-25
echo-main-26
echo-main-27
echo-main-28
echo-main-3
echo-main-37
echo-main-38
echo-main-39
echo-main-4
echo-main-40
echo-main-41
echo-main-42
echo-main-43
echo-main-44
echo-main-45
echo-main-46
echo-main-5
echo-main-6
echo-main-7
echo-main-8
fiat-main-1
fiat-main-10
fiat-main-11
fiat-main-12
fiat-main-13
fiat-main-14
fiat-main-15
fiat-main-16
fiat-main-17
fiat-main-18
fiat-main-19
fiat-main-2
fiat-main-20
fiat-main-21
fiat-main-22
fiat-main-3
fiat-main-30
fiat-main-31
fiat-main-32
fiat-main-33
fiat-main-34
fiat-main-35
fiat-main-36
fiat-main-37
fiat-main-38
fiat-main-4
fiat-main-5
fiat-main-6
fiat-main-8
fiat-main-9
front50-main-1
front50-main-10
front50-main-11
front50-main-12
front50-main-13
front50-main-14
front50-main-15
front50-main-16
front50-main-17
front50-main-18
front50-main-19
front50-main-2
front50-main-20
front50-main-21
front50-main-22
front50-main-23
front50-main-3
front50-main-34
front50-main-35
front50-main-36
front50-main-37
front50-main-38
front50-main-39
front50-main-4
front50-main-40
front50-main-41
front50-main-42
front50-main-5
front50-main-6
front50-main-8
front50-main-9
gate-main-1
gate-main-10
gate-main-11
gate-main-12
gate-main-13
gate-main-14
gate-main-15
gate-main-16
gate-main-17
gate-main-18
gate-main-19
gate-main-2
gate-main-20
gate-main-21
gate-main-22
gate-main-23
gate-main-24
gate-main-25
gate-main-26
gate-main-27
gate-main-28
gate-main-29
gate-main-3
gate-main-4
gate-main-46
gate-main-47
gate-main-48
gate-main-49
gate-main-5
gate-main-50
gate-main-51
gate-main-52
gate-main-53
gate-main-54
gate-main-55
gate-main-6
gate-main-8
gate-main-9
halyard-main-1
halyard-main-10
halyard-main-11
halyard-main-12
halyard-main-13
halyard-main-14
halyard-main-15
halyard-main-16
halyard-main-17
halyard-main-18
halyard-main-19
halyard-main-2
halyard-main-20
halyard-main-21
halyard-main-22
halyard-main-23
halyard-main-24
halyard-main-25
halyard-main-26
halyard-main-27
halyard-main-28
halyard-main-29
halyard-main-3
halyard-main-30
halyard-main-31
halyard-main-32
halyard-main-33
halyard-main-34
halyard-main-35
halyard-main-36
halyard-main-37
halyard-main-38
halyard-main-39
halyard-main-4
halyard-main-40
halyard-main-41
halyard-main-42
halyard-main-43
halyard-main-44
halyard-main-45
halyard-main-5
halyard-main-6
halyard-main-65
halyard-main-66
halyard-main-67
halyard-main-68
halyard-main-69
halyard-main-7
halyard-main-70
halyard-main-71
halyard-main-72
halyard-main-73
halyard-main-74
halyard-main-75
halyard-main-76
halyard-main-77
halyard-main-78
halyard-main-79
halyard-main-8
igor-main-1
igor-main-10
igor-main-11
igor-main-12
igor-main-13
igor-main-14
igor-main-15
igor-main-16
igor-main-17
igor-main-18
igor-main-19
igor-main-2
igor-main-20
igor-main-21
igor-main-22
igor-main-23
igor-main-24
igor-main-25
igor-main-26
igor-main-27
igor-main-3
igor-main-36
igor-main-37
igor-main-38
igor-main-39
igor-main-4
igor-main-41
igor-main-42
igor-main-43
igor-main-44
igor-main-5
igor-main-6
igor-main-8
kayenta-main-1
kayenta-main-10
kayenta-main-11
kayenta-main-12
kayenta-main-13
kayenta-main-14
kayenta-main-15
kayenta-main-16
kayenta-main-17
kayenta-main-18
kayenta-main-19
kayenta-main-2
kayenta-main-20
kayenta-main-21
kayenta-main-22
kayenta-main-23
kayenta-main-24
kayenta-main-25
kayenta-main-26
kayenta-main-27
kayenta-main-28
kayenta-main-29
kayenta-main-3
kayenta-main-30
kayenta-main-31
kayenta-main-32
kayenta-main-33
kayenta-main-34
kayenta-main-35
kayenta-main-36
kayenta-main-37
kayenta-main-4
kayenta-main-5
kayenta-main-6
kayenta-main-69
kayenta-main-7
kayenta-main-70
kayenta-main-71
kayenta-main-72
kayenta-main-73
kayenta-main-74
kayenta-main-75
kayenta-main-76
kayenta-main-77
kayenta-main-78
kayenta-main-79
kayenta-main-80
kayenta-main-81
kayenta-main-82
kayenta-main-9
keel-main-1
keel-main-10
keel-main-11
keel-main-12
keel-main-13
keel-main-14
keel-main-15
keel-main-16
keel-main-17
keel-main-18
keel-main-19
keel-main-2
keel-main-20
keel-main-21
keel-main-22
keel-main-23
keel-main-3
keel-main-31
keel-main-32
keel-main-33
keel-main-34
keel-main-35
keel-main-36
keel-main-37
keel-main-38
keel-main-39
keel-main-4
keel-main-5
keel-main-6
keel-main-8
keel-main-9
orca-main-1
orca-main-10
orca-main-11
orca-main-12
orca-main-13
orca-main-14
orca-main-15
orca-main-16
orca-main-17
orca-main-18
orca-main-19
orca-main-2
orca-main-20
orca-main-21
orca-main-22
orca-main-23
orca-main-24
orca-main-25
orca-main-26
orca-main-27
orca-main-28
orca-main-3
orca-main-30
orca-main-31
orca-main-32
orca-main-33
orca-main-34
orca-main-35
orca-main-36
orca-main-4
orca-main-5
orca-main-6
orca-main-68
orca-main-69
orca-main-7
orca-main-70
orca-main-71
orca-main-72
orca-main-73
orca-main-74
orca-main-75
orca-main-76
orca-main-77
orca-main-78
orca-main-79
orca-main-80
orca-main-81
orca-main-9
rosco-main-1
rosco-main-10
rosco-main-11
rosco-main-12
rosco-main-14
rosco-main-15
rosco-main-16
rosco-main-17
rosco-main-18
rosco-main-19
rosco-main-2
rosco-main-20
rosco-main-21
rosco-main-22
rosco-main-3
rosco-main-30
rosco-main-31
rosco-main-32
rosco-main-33
rosco-main-34
rosco-main-36
rosco-main-37
rosco-main-38
rosco-main-39
rosco-main-4
rosco-main-40
rosco-main-5
rosco-main-6
rosco-main-8
rosco-main-9
bn-deck-kayenta-release-2025.*
bn-deck-kayenta-release-2025.0.x-0
bn-deck-kayenta-release-2025.1.x-0
bn-deck-kayenta-release-2025.2.x-4
bn-deck-kayenta-release-2025.3.x-6
bn-deck-release-2025.*
bn-deck-release-2025.0.x-0
bn-deck-release-2025.1.x-0
bn-deck-release-2025.2.x-2
bn-echo-release-2025.*
bn-echo-release-2025.2.x-1
bn-fiat-release-2025.*
bn-fiat-release-2025.2.x-0
bn-front50-release-2025.*
bn-front50-release-2025.2.x-0
bn-gate-release-2025.*
bn-gate-release-2025.2.x-3
bn-halyard-release-2025.*
bn-halyard-release-2025.2.x-6
bn-igor-release-2025.*
bn-igor-release-2025.2.x-0
bn-kayenta-release-2025.*
bn-kayenta-release-2025.2.x-9
bn-keel-release-2025.*
bn-keel-release-2025.2.x-0
bn-orca-release-2025.*
bn-orca-release-2025.2.x-9
bn-rosco-release-2025.*
bn-rosco-release-2025.2.x-0
bn-spin-release-2025.*
bn-spin-release-2025.0.x-0
bn-spin-release-2025.1.x-0
bn-spin-release-2025.2.x-0
bn-spin-release-2025.3.x-3
bn-spin-release-2025.4.x-0
bn-spinnaker-libraries-release-2025.*
bn-spinnaker-libraries-release-2025.2.x-16
bn-spinnaker-release-2025.*
bn-spinnaker-release-2025.2.x-3
clouddriver-2025.*
clouddriver-2025.0-0
clouddriver-2025.1-0
clouddriver-2025.1.0
clouddriver-2025.2-0
clouddriver-2025.2-1
clouddriver-2025.2-2
clouddriver-2025.2-3
clouddriver-2025.2-4
clouddriver-2025.2-5
clouddriver-2025.2.0
clouddriver-2025.2.1
clouddriver-2025.2.2
clouddriver-2025.2.3
clouddriver-2025.2.4
clouddriver-2025.3-2
clouddriver-2025.3-3
clouddriver-2025.3.0
clouddriver-2025.3.1
clouddriver-2025.4-0
clouddriver-2025.4-1
clouddriver-2025.4-2
clouddriver-2025.4-3
clouddriver-2025.4.0
clouddriver-2025.4.1
deck-2025.*
deck-2025.1-0
deck-2025.1.0
deck-2025.2-0
deck-2025.2-2
deck-2025.2.0
deck-2025.2.1
deck-2025.2.2
deck-2025.2.3
deck-2025.2.4
deck-2025.3-3
deck-2025.3.0
deck-2025.3.1
deck-2025.4-0
deck-2025.4-4
deck-2025.4.0
deck-2025.4.0-rc1
deck-2025.4.1
deck-kayenta-2025.*
deck-kayenta-2025.1-0
deck-kayenta-2025.1.0
deck-kayenta-2025.2-0
deck-kayenta-2025.2.0
deck-kayenta-2025.2.1
deck-kayenta-2025.2.2
deck-kayenta-2025.2.3
deck-kayenta-2025.3.0
deck-kayenta-2025.4-0
deck-kayenta-2025.4.0
echo-2025.*
echo-2025.0-0
echo-2025.1-0
echo-2025.1.0
echo-2025.2-0
echo-2025.2-1
echo-2025.2.0
echo-2025.2.1
echo-2025.2.2
echo-2025.2.3
echo-2025.2.4
echo-2025.3-1
echo-2025.3.0
echo-2025.3.1
echo-2025.4-0
echo-2025.4-1
echo-2025.4.0
echo-2025.4.1
fiat-2025.*
fiat-2025.0-0
fiat-2025.1-0
fiat-2025.1.0
fiat-2025.2-0
fiat-2025.2.0
fiat-2025.2.1
fiat-2025.2.2
fiat-2025.2.3
fiat-2025.2.4
fiat-2025.3-1
fiat-2025.3.0
fiat-2025.3.1
fiat-2025.4-0
fiat-2025.4-1
fiat-2025.4.0
fiat-2025.4.1
front50-2025.*
front50-2025.0-0
front50-2025.1-0
front50-2025.1.0
front50-2025.2-0
front50-2025.2.0
front50-2025.2.1
front50-2025.2.2
front50-2025.2.3
front50-2025.2.4
front50-2025.3-1
front50-2025.3.0
front50-2025.3.1
front50-2025.4-0
front50-2025.4-1
front50-2025.4.0
front50-2025.4.1
gate-2025.*
gate-2025.0-0
gate-2025.1-0
gate-2025.1.0
gate-2025.2-0
gate-2025.2-1
gate-2025.2-2
gate-2025.2-3
gate-2025.2.0
gate-2025.2.1
gate-2025.2.2
gate-2025.2.3
gate-2025.2.4
gate-2025.3-1
gate-2025.3.0
gate-2025.3.1
gate-2025.4-0
gate-2025.4-1
gate-2025.4.0
gate-2025.4.1
halyard-2025.*
halyard-2025.0-0
halyard-2025.1-0
halyard-2025.1.0
halyard-2025.2-0
halyard-2025.2-1
halyard-2025.2-2
halyard-2025.2-3
halyard-2025.2-4
halyard-2025.2-5
halyard-2025.2-6
halyard-2025.2.0
halyard-2025.2.1
halyard-2025.2.2
halyard-2025.2.3
halyard-2025.2.4
halyard-2025.3-1
halyard-2025.3-2
halyard-2025.3-3
halyard-2025.3-4
halyard-2025.3.0
halyard-2025.3.1
halyard-2025.4-0
halyard-2025.4-1
halyard-2025.4-2
halyard-2025.4-3
halyard-2025.4-4
halyard-2025.4.0
halyard-2025.4.1
igor-2025.*
igor-2025.0-0
igor-2025.1-0
igor-2025.1.0
igor-2025.2-0
igor-2025.2.0
igor-2025.2.1
igor-2025.2.2
igor-2025.2.3
igor-2025.2.4
igor-2025.3-1
igor-2025.3.0
igor-2025.3.1
igor-2025.4-0
igor-2025.4-1
igor-2025.4.0
igor-2025.4.1
kayenta-2025.*
kayenta-2025.0-0
kayenta-2025.1-0
kayenta-2025.1.0
kayenta-2025.2-0
kayenta-2025.2-1
kayenta-2025.2-2
kayenta-2025.2-3
kayenta-2025.2-4
kayenta-2025.2-5
kayenta-2025.2-6
kayenta-2025.2-7
kayenta-2025.2-8
kayenta-2025.2-9
kayenta-2025.2.0
kayenta-2025.2.1
kayenta-2025.2.2
kayenta-2025.2.3
kayenta-2025.2.4
kayenta-2025.3-1
kayenta-2025.3-2
kayenta-2025.3.0
kayenta-2025.3.1
kayenta-2025.4-0
kayenta-2025.4-1
kayenta-2025.4-2
kayenta-2025.4-3
kayenta-2025.4.0
kayenta-2025.4.1
keel-2025.*
keel-2025.0-0
keel-2025.1-0
keel-2025.1.0
keel-2025.2-0
keel-2025.2.0
keel-2025.2.1
keel-2025.2.2
keel-2025.2.3
keel-2025.2.4
keel-2025.3-1
keel-2025.3.0
keel-2025.3.1
keel-2025.4-0
keel-2025.4-1
keel-2025.4.0
keel-2025.4.1
orca-2025.*
orca-2025.0-0
orca-2025.1-0
orca-2025.1.0
orca-2025.2-0
orca-2025.2-1
orca-2025.2-2
orca-2025.2-3
orca-2025.2-4
orca-2025.2-5
orca-2025.2-6
orca-2025.2-7
orca-2025.2-8
orca-2025.2-9
orca-2025.2.0
orca-2025.2.1
orca-2025.2.2
orca-2025.2.3
orca-2025.2.4
orca-2025.3-1
orca-2025.3-2
orca-2025.3.0
orca-2025.3.1
orca-2025.4-0
orca-2025.4-1
orca-2025.4-2
orca-2025.4-3
orca-2025.4.0
orca-2025.4.1
rosco-2025.*
rosco-2025.0-0
rosco-2025.1-0
rosco-2025.1.0
rosco-2025.2-0
rosco-2025.2.0
rosco-2025.2.1
rosco-2025.2.2
rosco-2025.2.3
rosco-2025.2.4
rosco-2025.3-1
rosco-2025.3.0
rosco-2025.3.1
rosco-2025.4-1
rosco-2025.4-2
rosco-2025.4.0
rosco-2025.4.1
spinnaker-release-2024.*
spinnaker-release-2024.0.0
spinnaker-release-2025.*
spinnaker-release-2025.2.0
spinnaker-release-2025.2.1
spinnaker-release-2025.2.2
spinnaker-release-2025.2.3
spinnaker-release-2025.3.0
spinnaker-release-2025.4.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25534.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "150000891644897917589758918942026879241",
"length": 363
},
"id": "CVE-2026-25534-0cb575a5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda",
"target": {
"file": "clouddriver/clouddriver-artifacts/src/test/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictionsTest.java",
"function": "verifyThatIpRangesBlockAccess"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "62728337072184961979807547076966941801",
"length": 350
},
"id": "CVE-2026-25534-0de82edb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda",
"target": {
"file": "clouddriver/clouddriver-artifacts/src/test/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictionsTest.java",
"function": "testWHenNoAllowedRegexButWhiteListIsSet"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "148117950495653084537437975733072452102",
"length": 390
},
"id": "CVE-2026-25534-1fbb63f6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda",
"target": {
"file": "clouddriver/clouddriver-artifacts/src/test/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictionsTest.java",
"function": "allowAHostIfResolvesInIpList"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"68017213901324006372472003709142178195",
"294646007134776579919495978106618091942",
"286614064473529631734477251779141408653",
"240363853142786854724824018500461142"
],
"threshold": 0.9
},
"id": "CVE-2026-25534-2f2870d5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda",
"target": {
"file": "clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/config/BaseHttpArtifactCredentials.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "66775298645943787940487104172835387541",
"length": 2040
},
"id": "CVE-2026-25534-326dfe53",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda",
"target": {
"file": "clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictions.java",
"function": "validateURI"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "219515358055823127232615466224739619300",
"length": 748
},
"id": "CVE-2026-25534-3553a17c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda",
"target": {
"file": "clouddriver/clouddriver-artifacts/src/test/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictionsTest.java",
"function": "blockDefaultRestrictedDomains"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "309855457075593471270302000603304578519",
"length": 243
},
"id": "CVE-2026-25534-37c6c9af",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda",
"target": {
"file": "clouddriver/clouddriver-artifacts/src/test/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictionsTest.java",
"function": "allowIpsWhenVerbatimIpsIsFalse"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"100260697823184954394146227062255489216",
"305384718771817446645177810178908363716",
"228679767035091877073078593402281767434",
"246636070325753499701755588874115108086",
"105545636603326139079686482396844805717",
"141365321120533504763946764771579088672",
"167935554924714873479880397641795478492",
"305714602265198170429037905376477840903",
"45827300528256660651518115506729584616",
"178237240115586540989765839313215668850",
"164860518742667522584066231323819483772",
"226190230277650932974227492665216167051",
"328442769025294579533042524968940185463",
"167935554924714873479880397641795478492",
"305714602265198170429037905376477840903",
"45827300528256660651518115506729584616",
"178237240115586540989765839313215668850",
"164860518742667522584066231323819483772",
"59742387362289915393201498416467620643",
"242252934063006574723463959567013478687",
"262828276328677581211236222365079781510",
"117591768566568049973021107074153512423",
"87358221841251372506165968471540439695",
"160042155623744186592735709663298422782",
"163277977584081315561290986690495321701",
"90971153183388845630366946933667462365",
"331464317958807901832403438967821684141",
"282231639286964375650343134574415324500",
"67762260224883846046555059964585172582",
"48929167656739692344179446142856868042",
"163106991325888816444075486617668012484",
"180450794575609337250914045465288995226",
"219169817581641698710297444613496570815",
"173088368078716497494459189827306432958",
"11504266732919502062412002595982270827",
"109165567939569633500733788225501765599",
"224087672048737495990874821217155215794",
"98288574790649910476776071106907082145",
"137057675921531941416654739390443347914",
"215575408974107365650130407906164817595",
"254731769590765795853398409531625162995",
"171523300042595666220326998639119494186",
"169329565284052640101278196359603755379",
"326509961135550218051555877159372500188",
"250179354068104382618033131140713427762",
"330137500507934706419764242805955964865",
"191181876514932574104314727418180828360",
"126954691095810731259166802492990253645",
"207526980804612151367092040471039163463",
"74248935912744136787462982931538503558",
"121947679649113365572435070629854576758",
"274476467422212716578074423649470825693",
"302728217860796276856037188729192336678",
"324542935403804335296217865157633055311",
"253261639621048060301573826639352721491",
"36349664265561471856687603406402781045"
],
"threshold": 0.9
},
"id": "CVE-2026-25534-409ef1fe",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda",
"target": {
"file": "clouddriver/clouddriver-artifacts/src/test/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictionsTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "72386920695518486958926931446860896431",
"length": 379
},
"id": "CVE-2026-25534-577406e9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda",
"target": {
"file": "clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/config/BaseHttpArtifactCredentials.java",
"function": "parseUrl"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"177336424904870422785598051068251037059",
"158779719107818137410251903812754202681",
"239601841638143627263152149990421540687",
"254510803377626493467755948421002123800",
"176182123182714028499412326340020624730",
"49947797888364388707369560062114168021",
"161959298490566292225770114137931193982",
"198443783190863733507868469993052894791",
"130104718210430920591935479199395778888",
"252069810326938709594182772565840159377",
"331906413988089563276028572441052113566",
"98549955987050945285040547448521309514",
"139198609232637803007103169158156981390",
"302967748261016692766055857411137700884",
"72167390943004449349090927905793668075",
"4301461011363862673460448250242955426",
"308518521370812998932044937098972495771",
"246574063406452126050359504615332986838",
"216582880448937514601857917271262735864",
"204530952105532819772867140959755470919",
"300722863782118550138443480050676080494",
"153032747715602201097563440254925442994",
"284183701585937100236371406524489182319",
"337456160877898232224469627764301084751",
"226522585949933473587514900210425391523"
],
"threshold": 0.9
},
"id": "CVE-2026-25534-7d9b3a49",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda",
"target": {
"file": "orca/orca-core/src/main/java/com/netflix/spinnaker/orca/config/UserConfiguredUrlRestrictions.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "115212364326458723573752784234222964518",
"length": 332
},
"id": "CVE-2026-25534-872f348e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda",
"target": {
"file": "clouddriver/clouddriver-artifacts/src/test/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictionsTest.java",
"function": "whiteListBlockEverythingElse"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "40616509189786148345835570122042840822",
"length": 701
},
"id": "CVE-2026-25534-a150071a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda",
"target": {
"file": "orca/orca-webhook/src/test/java/com/netflix/spinnaker/orca/webhook/service/WebhookServiceTest.java",
"function": "testAllowedRequestsEnabledTrueEmptyList"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "52196731729070405276620803374519782013",
"length": 1743
},
"id": "CVE-2026-25534-bbb97ddc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda",
"target": {
"file": "orca/orca-core/src/main/java/com/netflix/spinnaker/orca/config/UserConfiguredUrlRestrictions.java",
"function": "validateURI"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"107979023594343282281441406064351936796",
"252851546062109250033208986861630268719",
"233864363831881017138350398199728035750",
"89827098545719558868260964848886672804"
],
"threshold": 0.9
},
"id": "CVE-2026-25534-c0ab5ef3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda",
"target": {
"file": "orca/orca-webhook/src/test/java/com/netflix/spinnaker/orca/webhook/service/WebhookServiceTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "294038700505827888609970456508682583407",
"length": 330
},
"id": "CVE-2026-25534-ca063deb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda",
"target": {
"file": "clouddriver/clouddriver-artifacts/src/test/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictionsTest.java",
"function": "blockVerbatimIpsWhenNoIpListSet"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "4476119264004347952691299398860116259",
"length": 365
},
"id": "CVE-2026-25534-d9bb36c4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda",
"target": {
"file": "clouddriver/clouddriver-artifacts/src/test/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictionsTest.java",
"function": "blockIPRangesWhenResolved"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"83451369729222138557619201624284463542",
"192399555383656982252344817811869313995",
"81782605671379599111062832649490136234",
"120783209613628269747741701517558745698",
"283685365528076572536273324301159277973",
"17780600188492479307069994295450445716",
"123243241025169855813053447650420850413",
"81349041736076297000612965899149519343",
"1829216867288174227715322565806729199",
"192214241487961044290057527326145850711",
"82162086494996905676713242887107297878",
"35360557724068323066348637174988707296",
"331906413988089563276028572441052113566",
"98549955987050945285040547448521309514",
"139198609232637803007103169158156981390",
"302967748261016692766055857411137700884",
"269240046452669955449195591663288096841",
"107192235173507727862946469267661931649",
"122386660261858170151572089145960157507",
"148283159293067777324028973883235715309",
"216582880448937514601857917271262735864",
"204530952105532819772867140959755470919",
"300722863782118550138443480050676080494",
"153032747715602201097563440254925442994",
"284183701585937100236371406524489182319",
"337456160877898232224469627764301084751",
"226522585949933473587514900210425391523",
"192820184092030641591259806526932067094",
"272522960556081095470986908111007400762",
"99396215138024259750933490858395247663",
"13755904606809976705114386580007263359",
"87524008008314803376393476245772202017"
],
"threshold": 0.9
},
"id": "CVE-2026-25534-e2d10844",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda",
"target": {
"file": "clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictions.java"
}
}
]
vanir_signatures_modified
"2026-08-12T15:31:55Z"