[
https://issues.apache.org/jira/browse/SLING-13385?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Rishabh Daim closed SLING-13385.
--------------------------------
> JCR DavEx: update embedded Jackrabbit for CVE-2026-92414
> --------------------------------------------------------
>
> Key: SLING-13385
> URL: https://issues.apache.org/jira/browse/SLING-13385
> Project: Sling
> Issue Type: Bug
> Affects Versions: JCR Davex 1.3.14
> Reporter: Rishabh Daim
> Priority: Critical
> Fix For: JCR Davex 1.3.16
>
>
> JCR DavEx 1.3.14 embeds Jackrabbit JCR server 2.22.4, affected by
> [CVE-2026-92414|https://github.com/advisories/GHSA-3mf8-5fj8-p748]
> (cached-session reuse across users).
> Update the embedded Jackrabbit dependency to a secure compatible release
> (currently 2.22.5) and release a corrected DavEx bundle. Verify the packaged
> classes and cross-user session isolation.
> Confirmed by published POM/JAR inspection; runtime reproduction has not been
> performed.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
