{"id":"RHLW-2026-9bd677f780e42d38","summary":"Lightwell Security Advisory: classgraph 4.8.36.rhlw-00001","details":"Red Hat Lightwell has released io.github.classgraph:classgraph 4.8.36.rhlw-00001 with a backported security fix.\n\nCVE-2021-47621: ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.\n\nThis patched artifact is a drop-in replacement for io.github.classgraph:classgraph 4.8.36 from Maven Central.","modified":"2026-10-22T00:08:35.979325370Z","published":"2026-10-08T19:45:33Z","upstream":["CVE-2021-47621","GHSA-v2xm-76pq-phcf"],"references":[{"type":"WEB","url":"https://github.com/classgraph/classgraph/releases/tag/classgraph-4.8.112"},{"type":"FIX","url":"https://github.com/classgraph/classgraph/commit/681362ad6b0b9d9abaffb2e07099ce54d7a41fa3"},{"type":"FIX","url":"https://github.com/classgraph/classgraph/pull/539"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47621"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-v2xm-76pq-phcf"}],"affected":[{"package":{"name":"io.github.classgraph:classgraph","ecosystem":"Red Hat Lightwell:Maven","purl":"pkg:maven/io.github.classgraph/classgraph"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.36.rhlw-00001"}]}],"versions":["4.0.0","4.0.0-beta-11","4.0.0-beta-12","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.1.0","4.1.1","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.2.0","4.2.1","4.2.10","4.2.11","4.2.12","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9","4.3.0","4.3.1","4.4.0","4.4.1","4.4.10","4.4.11","4.4.12","4.4.2","4.4.3","4.4.4","4.4.5","4.4.6","4.4.7","4.4.8","4.4.9","4.6.0","4.6.1","4.6.10","4.6.11","4.6.12","4.6.13","4.6.14","4.6.15","4.6.16","4.6.17","4.6.18","4.6.19","4.6.2","4.6.20","4.6.21","4.6.22","4.6.23","4.6.24","4.6.25","4.6.26","4.6.27","4.6.28","4.6.29","4.6.3","4.6.30","4.6.31","4.6.32","4.6.4","4.6.5","4.6.6","4.6.7","4.6.8","4.6.9","4.8.0","4.8.1","4.8.10","4.8.11","4.8.12","4.8.13","4.8.14","4.8.15","4.8.16","4.8.17","4.8.19","4.8.2","4.8.20","4.8.21","4.8.22","4.8.23","4.8.24","4.8.25","4.8.26","4.8.27","4.8.28","4.8.29","4.8.3","4.8.30","4.8.31","4.8.32","4.8.33","4.8.34","4.8.35","4.8.36","4.8.4","4.8.5","4.8.6","4.8.7","4.8.8","4.8.9"],"database_specific":{"lightwell":{"remediated_version":"4.8.36.rhlw-00001","repository_url":"https://packages.redhat.com/lightwell/java/remediated/","backport_base_version":"4.8.36"},"source":"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-9bd677f780e42d38.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"credits":[{"name":"Red Hat Lightwell","type":"REMEDIATION_DEVELOPER"}]}