Maven/org.hyperledger.fabric-sdk-java:fabric-sdk-java CVE-2026-41586: critical 9.8, EPSS 0.53%
fabric-sdk-java has ObjectInputStream.readObject() without ObjectInputFilter, which allows Java deserialization RCE
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0.0 | - | 2.2.26 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-prf8-cf2x-rhx7
- nvd: CVE-2026-41586
- https://github.com/hyperledger/fabric/security/advisories/GHSA-prf8-cf2x-rhx7
- https://github.com/hyperledger/fabric-sdk-java
- https://hyperledger.github.io/fabric-gateway
CVE-2026-41586 · published · modified · JSON