CVE-2026-55772

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55772
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55772.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55772
Aliases
Published
2026-07-13T18:44:47.577Z
Modified
2026-07-23T08:25:16.662048Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
CedarJava has a type confusion vulnerability
Details

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI boundary. CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (__entity and __extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference. This issue requires the integrating service to build a CedarMap where the an actor controls the keys, and a policy must reference that value in a when/unless clause. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-843"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55772.json"
}
References

Affected packages

Git / github.com/cedar-policy/cedar-java

Affected ranges

Type
GIT
Repo
https://github.com/cedar-policy/cedar-java
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9aad59076b0d887cf100cb374a9526a069b69ae4
Fixed
4aaefcec11560cdedd6e975773c14c1b799ae2d6
Fixed
6dd91c6c273a9bd55d927280d71e13fec9ccaf33
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.3.6"
        },
        {
            "introduced": "3.1.2"
        },
        {
            "fixed": "3.4.1"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.9.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v2.*
v2.3.3
v3.*
v3.2.0
v3.2.4
v3.3.0
v3.4.0
v4.*
v4.2.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55772.json"
vanir_signatures 
[
    {
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "function": "putAll",
            "file": "CedarJava/src/main/java/com/cedarpolicy/value/CedarMap.java"
        },
        "id": "CVE-2026-55772-08ba4545",
        "digest": {
            "function_hash": "327048920903005842958234820150902070415",
            "length": 61.0
        },
        "deprecated": false,
        "source": "https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4"
    },
    {
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "CedarJava/src/main/java/com/cedarpolicy/value/PrimString.java"
        },
        "id": "CVE-2026-55772-222c4622",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "243667161905065760944844123520959975433",
                "96168933787930321025870251253997749999",
                "172125391400570524916881429052974539977"
            ]
        },
        "deprecated": false,
        "source": "https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4"
    },
    {
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "function": "toCedarExpr",
            "file": "CedarJava/src/main/java/com/cedarpolicy/value/PrimString.java"
        },
        "id": "CVE-2026-55772-3001f6c1",
        "digest": {
            "function_hash": "51859290183657171490516512443651307904",
            "length": 51.0
        },
        "deprecated": false,
        "source": "https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4"
    },
    {
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "function": "toCedarExpr",
            "file": "CedarJava/src/main/java/com/cedarpolicy/value/CedarMap.java"
        },
        "id": "CVE-2026-55772-37187fe2",
        "digest": {
            "function_hash": "308642754128649439991931764923403552312",
            "length": 215.0
        },
        "deprecated": false,
        "source": "https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4"
    },
    {
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "function": "serialize",
            "file": "CedarJava/src/main/java/com/cedarpolicy/serializer/ValueCedarSerializer.java"
        },
        "id": "CVE-2026-55772-3c280c53",
        "digest": {
            "function_hash": "62858109805503904017122267880979576511",
            "length": 1921.0
        },
        "deprecated": false,
        "source": "https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4"
    },
    {
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "function": "CedarMap",
            "file": "CedarJava/src/main/java/com/cedarpolicy/value/CedarMap.java"
        },
        "id": "CVE-2026-55772-3f6c64bb",
        "digest": {
            "function_hash": "111011011842433270854423126650773139846",
            "length": 69.0
        },
        "deprecated": false,
        "source": "https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4"
    },
    {
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "CedarJava/src/main/java/com/cedarpolicy/value/CedarMap.java"
        },
        "id": "CVE-2026-55772-5872973b",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "103030993888185932997632776400234697913",
                "47183856613135364532003511227358693765",
                "51922012883446185014035213860104335624",
                "146040928124044907750508132186535787983",
                "73066325357702450447291450827513783211",
                "149440180663028187750496759602590139320",
                "110219816685492252901834456230293323004",
                "72058756116103568276665631242610517099",
                "290923203825187035198851765622973356351",
                "311083266000522211783495446593466340081",
                "253131561201919543895071334718108588742",
                "66161866562734769894876201094633531652",
                "165743800591843351444347053096403648937",
                "119294679416558209991008684726557419481",
                "321821627279993721743655072298279630234",
                "182030038468228517666878260860425169606",
                "79006384390469138415336195000204729595",
                "223756644134795793606264829266612106198"
            ]
        },
        "deprecated": false,
        "source": "https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4"
    },
    {
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "function": "put",
            "file": "CedarJava/src/main/java/com/cedarpolicy/value/CedarMap.java"
        },
        "id": "CVE-2026-55772-d73c48ce",
        "digest": {
            "function_hash": "322249416741170729726922059779259964332",
            "length": 284.0
        },
        "deprecated": false,
        "source": "https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4"
    },
    {
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "CedarJava/src/main/java/com/cedarpolicy/serializer/ValueCedarSerializer.java"
        },
        "id": "CVE-2026-55772-ff8d13c0",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "120293057369215088283564849508655532202",
                "318857257331541576035179544772552424443",
                "332046677919700560269517789097197033654",
                "327671726817749460872449368278484687363"
            ]
        },
        "deprecated": false,
        "source": "https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4"
    }
]
vanir_signatures_modified 
"2026-07-23T08:25:16Z"