{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"dev.dsf:dsf-bpe-process-api-v2","cve_ids":["CVE-2026-40942"],"ecosystem":"Maven","epss":0.00291,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-xmj9-7625-f634","id":"tcs_01M5N9JM1VZBTPSHJPCA0XZ1ZK","modified_at":"2026-09-10T03:50:44.976919214Z","published_at":"2026-04-15T19:19:50Z","references":["https://osv.dev/vulnerability/GHSA-xmj9-7625-f634","https://github.com/datasharingframework/dsf/security/advisories/GHSA-xmj9-7625-f634","https://nvd.nist.gov/vuln/detail/CVE-2026-40942","https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","https://github.com/datasharingframework/dsf/commit/d3ca59b4daccde16a006fedeccce28fd1f826908","https://github.com/datasharingframework/dsf"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-xmj9-7625-f634","url":"https://osv.dev/vulnerability/GHSA-xmj9-7625-f634"},{"source":"nvd","source_id":"CVE-2026-40942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40942"}],"summary":"Data Sharing Framework has an Inverted Time Comparison in OIDC JWKS and Token Cache"}