Rishabh Daim created SLING-13385:
------------------------------------
Summary: JCR DavEx: update embedded Jackrabbit for CVE-2026-92414
Key: SLING-13385
URL: https://issues.apache.org/jira/browse/SLING-13385
Project: Sling
Issue Type: Bug
Affects Versions: JCR Davex 1.3.14
Reporter: Rishabh Daim
Fix For: JCR Davex 1.3.16
JCR DavEx 1.3.14 embeds Jackrabbit JCR server 2.22.4, affected by
[CVE-2026-92414|https://github.com/advisories/GHSA-3mf8-5fj8-p748]
(cached-session reuse across users).
Update the embedded Jackrabbit dependency to a secure compatible release
(currently 2.22.5) and release a corrected DavEx bundle. Verify the packaged
classes and cross-user session isolation.
Confirmed by published POM/JAR inspection; runtime reproduction has not been
performed.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
