PT-2026-3331 · Gradle · Gradle

Highcobexer + 1 · Published 2026-01-16 · Updated 2026-01-22 · CVE-2026-22865

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Gradle versions prior to 9.3.0

Description Gradle, a build automation tool, has an issue where dependency resolution in versions before 9.3.0 does not treat certain exceptions as fatal errors. This allows Gradle to continue to subsequent repositories if an error occurs, potentially resolving dependencies from a malicious source after a legitimate repository is disrupted. Specifically, exceptions like NoHttpResponseException are not immediately fatal, and Gradle proceeds to the next repository after retries. This behavior could allow an attacker controlling a repository to serve malicious artifacts if a primary repository is unavailable. The issue is resolved by stopping the search for other repositories when encountering these errors.

Recommendations Update to Gradle version 9.3.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-829

CWE-494

Related Identifiers

BIT-GRADLE-2026-22865

CVE-2026-22865

GHSA-MQWM-5M85-GMCV

Affected Products

Gradle

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22865.json · Exploit
• https://github.com/gradle/gradle/security/advisories/GHSA-mqwm-5m85-gmcv · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22865 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22865 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-22865 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22865 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22865 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-22865 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22865 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gradle-2026-22865 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-22865 · Vendor Advisory
• https://docs.bell-sw.com/security/cves/CVE-2026-22865 · Note
• https://twitter.com/CVEnew/status/2012303172279353711 · Twitter Post