{"action":"Upgrade ognl:ognl to 3.4.13 or later.","affected":[{"fixed":"3.4.13","introduced":"0"}],"component":"ognl:ognl","cve_ids":["CVE-2026-113730"],"ecosystem":"Maven","epss":0.00394,"exploited":false,"fixed_versions":["3.4.13"],"ghsa_id":"GHSA-crwc-vw2r-qr6m","id":"tcs_01M5N8T8ZQJ3MZWJ9T7QZK0VS3","modified_at":"2026-10-21T16:45:04.303510159Z","published_at":"2026-10-21T16:31:04Z","references":["https://osv.dev/vulnerability/GHSA-crwc-vw2r-qr6m","https://github.com/orphan-oss/ognl/security/advisories/GHSA-crwc-vw2r-qr6m","https://nvd.nist.gov/vuln/detail/CVE-2026-113730","https://github.com/orphan-oss/ognl/commit/16396fa4b560221294c2ab9ca04b76b161115e7d","https://github.com/orphan-oss/ognl/commit/f4c17f794754d516ea799c36ed8524d1b7fb98e2","https://github.com/orphan-oss/ognl","https://github.com/orphan-oss/ognl/releases/tag/OGNL_3_4_13"],"severity":{"label":"medium","score":5.6},"sources":[{"source":"osv","source_id":"GHSA-crwc-vw2r-qr6m","url":"https://osv.dev/vulnerability/GHSA-crwc-vw2r-qr6m"}],"summary":"OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies"}