{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"dev.dsf:dsf-common-jetty","cve_ids":["CVE-2026-40939"],"ecosystem":"Maven","epss":0.00154,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-gj7p-595x-qwf5","id":"tcs_01M5N8YDNQJ3676AZCNS21V1DQ","modified_at":"2026-05-05T16:06:56.520145Z","published_at":"2026-04-15T19:19:43Z","references":["https://osv.dev/vulnerability/GHSA-gj7p-595x-qwf5","https://github.com/datasharingframework/dsf/security/advisories/GHSA-gj7p-595x-qwf5","https://nvd.nist.gov/vuln/detail/CVE-2026-40939","https://github.com/datasharingframework/dsf/commit/7d25feafb83d66cb59985ac88568b67d937b1937","https://github.com/datasharingframework/dsf/commit/f4ecb002f7d12642f92da6b79371ed367d0140e7","https://dsf.dev/operations/v2.1.0/bpe/oidc.html","https://dsf.dev/operations/v2.1.0/fhir/oidc.html","https://github.com/datasharingframework/dsf"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-gj7p-595x-qwf5","url":"https://osv.dev/vulnerability/GHSA-gj7p-595x-qwf5"},{"source":"nvd","source_id":"CVE-2026-40939","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40939"}],"summary":"Data Sharing Framework is Missing Session Timeout for OIDC Sessions"}