RHLW-2026-ecc1d237bc4cba0c

See a problem?
Please try reporting it to the source first.
Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-ecc1d237bc4cba0c.json
Import Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-ecc1d237bc4cba0c.json
JSON Data
https://api.osv.dev/v1/vulns/RHLW-2026-ecc1d237bc4cba0c
Upstream
Published
2026-09-30T12:38:29Z
Modified
2026-10-27T04:00:18Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Lightwell Security Advisory: ognl 3.0.8.rhlw-00002
Details

Red Hat Lightwell has released ognl:ognl 3.0.8.rhlw-00002 with a backported security fix.

CVE-2016-3093: Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.

This patched artifact is a drop-in replacement for ognl:ognl 3.0.8 from Maven Central.

References
Credits
    • Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / ognl:ognl

Package

Name
ognl:ognl
Purl
pkg:maven/ognl/ognl

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0.8.rhlw-00002

Affected versions

2.*
2.1.4
2.2.2
2.3.2
2.4.1
2.5.1
2.6.3
2.6.5
2.6.7
2.6.9
2.7
2.7.1
2.7.2
2.7.3
3.*
3.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.6.1
3.0.6.2
3.0.7
3.0.8

Database specific

lightwell 
{
    "backport_base_version":  "3.0.8",
    "remediated_version":  "3.0.8.rhlw-00002",
    "repository_url":  "https://packages.redhat.com/lightwell/java/remediated/"
}
source 
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-ecc1d237bc4cba0c.json"