{"id":"CGA-wcfh-m3wp-858x","modified":"2026-07-17T19:24:41.523829644Z","published":"2026-01-26T20:04:00Z","upstream":["CVE-2020-26217","GHSA-mw36-7c6c-q4q2"],"references":[{"type":"ADVISORY","url":"https://www.debian.org/security/2020/dsa-4811"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpujan2022.html"},{"type":"ADVISORY","url":"https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00001.html"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20210409-0004/"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"type":"REPORT","url":"https://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9%40%3Ccommits.camel.apache.org%3E"},{"type":"REPORT","url":"https://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c%40%3Cissues.activemq.apache.org%3E"},{"type":"REPORT","url":"https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e%40%3Cissues.activemq.apache.org%3E"},{"type":"REPORT","url":"https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3%40%3Cissues.activemq.apache.org%3E"},{"type":"FIX","url":"https://www.oracle.com//security-alerts/cpujul2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuApr2021.html"},{"type":"FIX","url":"https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a"},{"type":"EVIDENCE","url":"https://x-stream.github.io/CVE-2020-26217.html"}],"affected":[{"package":{"name":"hadoop-fips-3.4.2","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/hadoop-fips-3.4.2?arch=x86_64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"components":[{"component_version":"1.4.9","component_type":"java-archive","component_location":"/usr/share/m2/repository/com/thoughtworks/xstream/xstream/1.4.9/xstream-1.4.9.jar","component_purl":"pkg:maven/xstream@1.4.9","latest_event_status":"detection","latest_event_timestamp":"2026-01-26T20:04:00Z","architecture":"x86_64","component_name":"xstream"}]},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wcfh-m3wp-858x.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}