{"action":"Upgrade org.apache.hugegraph:hg-pd-core to 1.7.0 or later.","affected":[{"fixed":"1.7.0","introduced":"0"}],"component":"org.apache.hugegraph:hg-pd-core","cve_ids":["CVE-2025-26866"],"ecosystem":"Maven","epss":0.01044,"exploited":false,"fixed_versions":["1.7.0"],"ghsa_id":"GHSA-q37j-3367-fwv7","id":"tcs_01M5N98G21973KKS1RGAJYB6CE","modified_at":"2025-12-12T17:11:15.090338Z","published_at":"2025-12-12T12:30:25Z","references":["https://osv.dev/vulnerability/GHSA-q37j-3367-fwv7","https://nvd.nist.gov/vuln/detail/CVE-2025-26866","https://github.com/apache/incubator-hugegraph/pull/2735","https://github.com/apache/incubator-hugegraph","https://lists.apache.org/thread/ko8jkwbjbb99m45pg4sgo5xsm8gx9nsq","http://www.openwall.com/lists/oss-security/2025/12/09/1"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-q37j-3367-fwv7","url":"https://osv.dev/vulnerability/GHSA-q37j-3367-fwv7"}],"summary":"Apache HugeGraph-Server: RAFT and deserialization vulnerability"}