PT-2026-3330 · Gradle · Gradle

Ljacomet · Publicado 2026-01-16 · Atualizado 2026-01-22 · CVE-2026-22816

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Gradle versions prior to 9.3.0

Description Gradle’s native-platform tool, which provides Java bindings for native APIs, does not treat certain exceptions as fatal errors when resolving dependencies in versions before 9.3.0. This allows Gradle to continue to the next repository, potentially resolving dependencies from a different source. Specifically, an unresolvable host name does not halt the process, allowing an attacker to register a service under the build’s host name and serve malicious artifacts if the malicious repository is listed before others in the build configuration.

Recommendations Update to Gradle version 9.3.0 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-494

CWE-829

Identificadores relacionados

BIT-GRADLE-2026-22816

CVE-2026-22816

GHSA-W78C-W6VF-RW82

Produtos afetados

Gradle

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22816.json · Exploit
• https://github.com/gradle/gradle/security/advisories/GHSA-w78c-w6vf-rw82 · Aviso do Fabricante
• https://github.com/gradle/gradle/commit/e5707d0d8fce3d768c9c489004700d78eab1773a · Correção
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22816 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-22816 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22816 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-22816 · Aviso do Fabricante
• https://docs.bell-sw.com/security/cves/CVE-2026-22816 · Nota
• https://osv.dev/vulnerability/CVE-2026-22816 · Aviso do Fabricante
• https://osv.dev/vulnerability/BELL-CVE-2026-22816 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-gradle-2026-22816 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2012303173478924639 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2026-22816 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-22816 · Nota de Segurança