PT-2026-6674 · Oatpp · Oatpp

Oneafter · Published 2026-02-06 · Updated 2026-02-06 · CVE-2026-1990

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions oatpp versions up to 1.3.1

Description A security issue has been identified in oatpp. The issue involves a null pointer dereference within the oatpp::data::type::ObjectWrapper::ObjectWrapper() function located in the src/oatpp/data/type/Type.hpp file. Local access is required for exploitation. The details of the issue have been publicly disclosed. The project was notified of the problem but has not yet responded.

Recommendations Versions prior to 1.3.1 should be used. As a temporary workaround, consider avoiding the use of the oatpp::data::type::ObjectWrapper::ObjectWrapper() function until a patch is available.

Exploit

Fix

NULL Pointer Dereference

Improper Resource Release

Weakness Enumeration

CWE-476

CWE-404

Related Identifiers

CVE-2026-1990

Affected Products

Oatpp

References · 11

• 🔥 https://github.com/oatpp/oatpp/issues/1080#issue-3806715350 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1990 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1990 · Vendor Advisory
• https://github.com/oatpp/oatpp/issues/1080 · Note
• https://vuldb.com/?id.344508 · Note
• https://t.me/cveNotify/151085 · Telegram Post
• https://github.com/oatpp/oatpp · Note
• https://vuldb.com/?ctiid.344508 · Note
• https://twitter.com/CVEnew/status/2019654610349117718 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2019715689272025441 · Twitter Post
• https://vuldb.com/?submit.743387 · Note