PT-2026-3330 · Gradle · Gradle

Ljacomet · Published 2026-01-16 · Updated 2026-01-22 · CVE-2026-22816

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Gradle versions prior to 9.3.0

Description Gradle’s native-platform tool, which provides Java bindings for native APIs, does not treat certain exceptions as fatal errors when resolving dependencies in versions before 9.3.0. This allows Gradle to continue to the next repository, potentially resolving dependencies from a different source. Specifically, an unresolvable host name does not halt the process, allowing an attacker to register a service under the build’s host name and serve malicious artifacts if the malicious repository is listed before others in the build configuration.

Recommendations Update to Gradle version 9.3.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-494

CWE-829

Related Identifiers

BIT-GRADLE-2026-22816

CVE-2026-22816

GHSA-W78C-W6VF-RW82

Affected Products

Gradle

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22816.json · Exploit
• https://github.com/gradle/gradle/security/advisories/GHSA-w78c-w6vf-rw82 · Vendor Advisory
• https://github.com/gradle/gradle/commit/e5707d0d8fce3d768c9c489004700d78eab1773a · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22816 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-22816 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22816 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-22816 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22816 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-22816 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gradle-2026-22816 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22816 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22816 · Security Note
• https://docs.bell-sw.com/security/cves/CVE-2026-22816 · Note
• https://twitter.com/CVEnew/status/2012303173478924639 · Twitter Post