CVE-2026-40942
- Source
- https://cve.org/CVERecord?id=CVE-2026-40942
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40942.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-40942
- Aliases
- Published
- 2026-04-21T21:09:44.537Z
- Modified
- 2026-07-15T15:53:40.385559Z
- Severity
-
- 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- DSF: Inverted Time Comparison in OIDC JWKS and Token Cache
- Details
-
The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. The OIDC token cache for the FHIR client connections used an inverted time comparison (isBefore instead of isAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired. This vulnerability is fixed in 2.1.0.
- Database specific
{ "cwe_ids": [ "CWE-670" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40942.json", "cna_assigner": "GitHub_M" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40942.json
- https://github.com/datasharingframework/dsf/security/advisories/GHSA-xmj9-7625-f634
- https://nvd.nist.gov/vuln/detail/CVE-2026-40942
- https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef
- https://github.com/datasharingframework/dsf/commit/d3ca59b4daccde16a006fedeccce28fd1f826908
Affected packages
Git / github.com/datasharingframework/dsf
Database specific
vanir_signatures_modified
"2026-07-15T15:53:40Z"
vanir_signatures
[
{
"signature_type": "Line",
"target": {
"file": "dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/auth/DsfOpenIdLoginService.java"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-05e693ba",
"signature_version": "v1",
"digest": {
"line_hashes": [
"15568848578052994891429983013012251376",
"43159017572274552714755172207459353163",
"269178039507918343337586965745267559124",
"319372185822665214366295475367771573133",
"43241233356432250636359869808301954374",
"119186917048813680169370639929902825357",
"62965861604109236527167068483677437112",
"38563699726889113450555607803388759487",
"187690798981999844543093377096338380650",
"186573594167232885317210859332473823177",
"203521895707097567638506170861765026300",
"40715596247243532356271389363889594155",
"179326421917097929783787137891522430331",
"60716131381620679439955124683777784989",
"83923278370468985389378890818889465329",
"197274117933264281433404370761614852235",
"3434690827652148165398257650163650893",
"240021198362606694441206557823760847647",
"140326788696311854021101447038668233356",
"242526978429542541654030571914318134613",
"213506837224235478568506420187315196237",
"295576366731679647086010018511752453234"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "dsf-common/dsf-common-oidc/src/test/java/dev/dsf/common/oidc/JwksTest.java"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-0713d963",
"signature_version": "v1",
"digest": {
"line_hashes": [
"273847697527872029590377879008996033639",
"174233230544383623345949099706241518588",
"236190796031340185150225781452498448231",
"87007281969190608769983146267672819030",
"272976641737575018738264163168862332444",
"339506121077393912595238848362188755298",
"205963882551840992448112829200753075168",
"167889051907145159947153898625682508851",
"116208612723762138937018089271749303885",
"210745551569549694231187646846664950485",
"314406726805378212360087299085189608732",
"133779206795028512109835708860495986585",
"124802786350483773095799030584057696165",
"284862078982213950353494642382451606446",
"316975167570256202082783029220459951475",
"219806781450409619565067739577449430112",
"101507885581505111869269518706442598530",
"70216443357201417391975401338314597734",
"50501235614528612655699154190041239932",
"220826145480749802464491464064398239917",
"267601877696182350241468815642322172681",
"257140742654090928830009978243678948206",
"149980895757357477491724344589483384021",
"264699565953311885911128318902909269937",
"102482014334052641116438577555484958496",
"254083983981919250510779727503217274839",
"292654378924375817779616191410338799045",
"92413991063154353200119168523310502670"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/Jwks.java",
"function": "toEcdsaAlgorithm"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-0cccd655",
"signature_version": "v1",
"digest": {
"function_hash": "269544564271300008458992242859623858860",
"length": 370.0
}
},
{
"signature_type": "Function",
"target": {
"file": "dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/config/AbstractJettyConfig.java",
"function": "baseOidcClient"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-19ebfcf0",
"signature_version": "v1",
"digest": {
"function_hash": "305487121917248760570450265857387274401",
"length": 579.0
}
},
{
"signature_type": "Function",
"target": {
"file": "dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/BaseOidcClientWithCache.java",
"function": "getJwks"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-2cc30a9e",
"signature_version": "v1",
"digest": {
"function_hash": "42835899269875704591123452575690868843",
"length": 122.0
}
},
{
"signature_type": "Line",
"target": {
"file": "dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/config/AbstractJettyConfig.java"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-474b0447",
"signature_version": "v1",
"digest": {
"line_hashes": [
"333148744811694858349774189492033557904",
"268341932966300194453604725301097745253",
"307906164747368637184153615915649492094",
"66165236401896768315577558863051811632",
"91432464406612966728098772307696579618",
"99712127604643822756010155036421295687",
"183844472983899076103243660002642667386",
"178535935044257550160224239472309161668",
"111841727471929898239849813893976778521",
"99176738170149682275278789671646907256",
"11411559198146165848917718123426585635",
"258436804150374241867369851500833160165",
"339243390642360616097522642542541886002",
"146305125201995731872955998902736801584",
"287486597562380535836083048830101074488",
"254118428216406260872581626877657258380",
"189889298203746964346111955809768545321",
"116484648289259667242044494192994718732",
"43061754937112951923412209650125481557",
"320956679592046105050594899469404869260",
"260876243659621131576606791682107662565",
"31281968098380524628652678749619592761"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/config/AbstractJettyConfig.java",
"function": "oidcProviderClientTimeoutConnect"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-514a9ccb",
"signature_version": "v1",
"digest": {
"function_hash": "243056218280266436269758914950621305231",
"length": 61.0
}
},
{
"signature_type": "Function",
"target": {
"file": "dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/Jwks.java",
"function": "toRsaAlgorithm"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-616c7fd9",
"signature_version": "v1",
"digest": {
"function_hash": "188753325443308831186934973015713059338",
"length": 367.0
}
},
{
"signature_type": "Function",
"target": {
"file": "dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/config/AbstractJettyConfig.java",
"function": "oidcProviderClientTimeoutRead"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-6ad9bcfe",
"signature_version": "v1",
"digest": {
"function_hash": "243056218280266436269758914950621305231",
"length": 61.0
}
},
{
"signature_type": "Function",
"target": {
"file": "dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/auth/DsfOpenIdLoginService.java",
"function": "DsfOpenIdLoginService"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-6e271795",
"signature_version": "v1",
"digest": {
"function_hash": "129426151254647273901259682851530375936",
"length": 114.0
}
},
{
"signature_type": "Function",
"target": {
"file": "dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/BaseOidcClientWithCache.java",
"function": "getConfiguration"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-752aa528",
"signature_version": "v1",
"digest": {
"function_hash": "14425153368676086807068873698678772603",
"length": 112.0
}
},
{
"signature_type": "Function",
"target": {
"file": "dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/JwtVerifierImpl.java",
"function": "verifyBearerToken"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-76f3473e",
"signature_version": "v1",
"digest": {
"function_hash": "258373810382009443934128993717116388851",
"length": 578.0
}
},
{
"signature_type": "Line",
"target": {
"file": "dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/JwtVerifierImpl.java"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-7c261a85",
"signature_version": "v1",
"digest": {
"line_hashes": [
"131454095259758857264512343298941144885",
"108617182526472699759798335603947169708",
"102570644205834998261250556883698751801",
"326948339199145679728629150421048096013",
"202095943440167113173723275400613627141",
"36552857933893094667143411685465852428",
"237537661534317861219137762863368183687",
"193549001139398214820403189830164716277",
"5049383620856976608388217093493071763",
"23193355412366731940007718242098410782",
"19886625087442163110488880805879387138",
"257584570505667617006696443572166983700",
"286921850425293736375070006280898834870",
"326948339199145679728629150421048096013",
"103957401969311390215740634975738671237",
"291563161152747307001157050951681431173",
"46616004157871171436510237003914503294",
"114493504031879222422835863772635041165",
"96302037565074933794422264943813112327",
"220993698795766857382012225602887256247",
"24829897893069070814350953400940803842",
"19886625087442163110488880805879387138",
"13442695039811083286880294789267233828"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/Jwks.java",
"function": "toEcPublicKey"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-84fbff2c",
"signature_version": "v1",
"digest": {
"function_hash": "43505672358120312570075749668239778650",
"length": 922.0
}
},
{
"signature_type": "Line",
"target": {
"file": "dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/BaseOidcClientWithCache.java"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-855528c3",
"signature_version": "v1",
"digest": {
"line_hashes": [
"25590341219750107018012854813949293209",
"293305896017090633247526424034581907345",
"131398227730165696843900774943919802444",
"137515965865777805250947172735408769842",
"82667946570039877071505646057536667933",
"58500201270406060991037144103324688164",
"178205026392251379874116136340656053904",
"232764799432302181813351073911548746097",
"157189259020381828505272754596988660146",
"17847038971409292417426261145654516683",
"173780937677262440081389507373463872798",
"193544397796566805665144173057991604562",
"139164874785018838655586675538623302521",
"209980485335905573980318926582757251078",
"69922937827076475504990936043271784585",
"123609889497091903425890723901173599632",
"228407354623848609264580821110113596708",
"177574009793047201813007564298967295973",
"143690168451758076152333777789353218768",
"146532535030365270251763815345207405622",
"263466385801201483282431646332847654282",
"32784522808108266758776225681463761829",
"113802150879542737856742648345810925844",
"2206187097887444822011345870609379927",
"28962255081716106392044578299886592512",
"139068914493774734508749305269137084494",
"249418504584197375795824811855662100398",
"34141513637404549615573965800611705143",
"275652355744457188002916005169486836796",
"305592421478124200523156088563567749302",
"126489716227095196048837854439761430595",
"74424989723216589729208896279545247404",
"14709488867249551216742991330230159844",
"223229763712917265640429145803528130688",
"275140996287704234279019588723080521355",
"106154708011402359840238265600141217854"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/Jwks.java",
"function": "toRsaPublicKey"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-8e3cf7d1",
"signature_version": "v1",
"digest": {
"function_hash": "216234956438159974427994195348320934680",
"length": 459.0
}
},
{
"signature_type": "Function",
"target": {
"file": "dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/BaseOidcClientWithCache.java",
"function": "getOrSet"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-915f399b",
"signature_version": "v1",
"digest": {
"function_hash": "144358380249501260963747875813868249072",
"length": 245.0
}
},
{
"signature_type": "Function",
"target": {
"file": "dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/Jwks.java",
"function": "toAlgorithm"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-9ab32d69",
"signature_version": "v1",
"digest": {
"function_hash": "318861258138654671492361474763866254415",
"length": 224.0
}
},
{
"signature_type": "Line",
"target": {
"file": "dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/Jwks.java"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-a22842e2",
"signature_version": "v1",
"digest": {
"line_hashes": [
"160682523899115658207840472752274385908",
"101393176527487548177588553009465361756",
"279624775213303607433957235400200405630",
"181132969223289428863332659074765886005",
"310567919020435291962969873526265593876",
"74115263256007076634805985659843368198",
"195994878474433770130459664063033392005",
"167892977448287646290756462276760492286",
"1859398004198039087540088092437282029",
"299597574193431435648471629814140952242",
"59937095874216510213090255845715962342",
"41048008673527057925116465357925118621",
"333978443571711300653148509718057435545",
"16815033579170564839969580145201281077",
"210466001665605854508182148302275750907",
"72239824749113581042098226598997363748",
"202602170658841954835624010137092596722",
"268965078604146725858004960424941468591",
"92154391749221315654526124832653692441",
"161488582803140306990982035322114986614",
"200221933299551321637871832317616809794",
"52469659346200867543109506318714337818",
"4795466054453322138657511854943937525",
"282011501526619558031831972415833847078",
"23305941888139963829220269006512934175",
"131873902559592237915899339986556058106",
"107260441903075111427361804762923446184",
"125513238995689963193458732613735449748",
"181190111245051728078618490947323401076",
"2363120655349415237717466003703243156",
"100542002266177140230930016951538005627",
"117377197584465238996414432872712930136",
"45615673256594824330974000326404614855",
"288282002181868390430952504366594850936",
"221421780918615576418151644265749790930",
"323748894476784917736095611560493225495",
"150318164901063451239684901948859699152",
"246159210433933694155620748047392482058",
"287487877318838730326538526449054193202",
"150242196835136392216264129116679351315",
"324349948422874812874185465987670850964",
"239133191855841541554591365484048134084",
"147670719850897000091280564846005118218",
"302752077883934335933495859372332387193",
"326226549581446966318176395009918281435",
"286064206620853613897991486053265144893",
"332899145051963763610862661459387163779",
"25736290172404974190630061008520444214",
"14953389811394424680309209342223473684",
"182273674985936618793092611871378865874",
"287143071781745610363415628019733667812",
"56623542026336830447317115085392210813",
"207798684611150004100454731866838305081",
"299472434299813019617537189345894428391",
"255010711427693055264632658720998536387",
"132568249850367635022116321452529875344",
"252814668733445524045975207555345874170",
"87708657704896509412351799720403068100",
"175255892076558326118464915885573071738"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/BaseOidcClientWithCache.java",
"function": "BaseOidcClientWithCache"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-a24ab6c3",
"signature_version": "v1",
"digest": {
"function_hash": "336566084769378629583412291952624904128",
"length": 87.0
}
},
{
"signature_type": "Function",
"target": {
"file": "dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/auth/DsfOpenIdLoginService.java",
"function": "login"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-ad573881",
"signature_version": "v1",
"digest": {
"function_hash": "125618843681554142517622163432996550233",
"length": 441.0
}
},
{
"signature_type": "Line",
"target": {
"file": "dsf-bpe/dsf-bpe-server/src/main/java/dev/dsf/bpe/client/oidc/OidcClientWithCache.java"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-addff741",
"signature_version": "v1",
"digest": {
"line_hashes": [
"3622605943292791725074610860518931287",
"222094587727060358370839318537644905283",
"166932660026477436220196946507838283819",
"40343384325823932899405897226083639185",
"101050812012279205513376312873626406971",
"141541894357981044572319866058479379853",
"81028889702117917585972638037764614006",
"183177946579178628853177306955106815262",
"337913179777600434519899449300115785329",
"52772741914156365311679580152134213834",
"279350670604489873445927030722430707102",
"65414636468268560710896183752728240970",
"107037846612905438260474431381195943346",
"219814098287114801136989488337221317017",
"9071511947880439279450630909843344461",
"321759882655220498980213519097206279099",
"195400708882464073831754471684722417822",
"110049240402989120552062508638155398158",
"271419005161436326968673754394598033026",
"27829893898019936470131875995934112287",
"66485126744932853228478707779226249719",
"332173732307791524351960641727781726467",
"266884394911079379731024953154532285837",
"31112741330224706353241215183523782209",
"260166040367829907007507377108308034950",
"187580043915881055042934055647830451546",
"180037162913910745570292921582413350525",
"83972455095728762057173570056759421628"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "dsf-common/dsf-common-oidc/src/test/java/dev/dsf/common/oidc/JwksTest.java",
"function": "testDecodeJwks"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-ae36f4d1",
"signature_version": "v1",
"digest": {
"function_hash": "58479888561879259464777863865123414927",
"length": 1015.0
}
},
{
"signature_type": "Line",
"target": {
"file": "dsf-bpe/dsf-bpe-server/src/main/java/dev/dsf/bpe/client/oidc/OidcClientJersey.java"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-b3698655",
"signature_version": "v1",
"digest": {
"line_hashes": [
"51478542357719129166591557117196874183",
"332500555294929071937173014262631693432",
"319204786648862896313870834782776420678",
"83782952613277963788234783580268433360",
"14587644061513922823844018035687722255",
"32982452083835476439874302154488956304",
"339917528411722132346418333773248023706",
"195550020266526916029224213653267686217",
"309941629325684980397627036363632704255",
"191736777480790452859937267395713219689",
"273336188276821196124189995441007189773",
"43421343702651715511083339401955845836",
"278791004976980384961812598281840299435",
"282135850895955449329431105090192295467",
"200432714594593056507361679240848644432",
"332646055368383785955402195931840834860",
"23153910722609021488079532887424559288"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/JwtVerifierImpl.java",
"function": "verifyBackchannelLogout"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-d8554ade",
"signature_version": "v1",
"digest": {
"function_hash": "8730890164913953833835947263830226869",
"length": 614.0
}
},
{
"signature_type": "Function",
"target": {
"file": "dsf-bpe/dsf-bpe-server/src/main/java/dev/dsf/bpe/client/oidc/OidcClientJersey.java",
"function": "verifyAndDecodeAccessToken"
},
"deprecated": false,
"source": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
"id": "CVE-2026-40942-da398eff",
"signature_version": "v1",
"digest": {
"function_hash": "243644730393010463717944192067547327392",
"length": 1826.0
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40942.json"