{"id":"RHLW-2026-cc6f4a613453615e","summary":"Lightwell Security Advisory: esapi 2.3.0.0-rhlw-00005","details":"Red Hat Lightwell has released org.owasp.esapi:esapi 2.3.0.0-rhlw-00005 with a backported security fix.\n\nCVE-2025-5878: ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special element\n\nThis patched artifact is a drop-in replacement for org.owasp.esapi:esapi 2.3.0.0 from Maven Central.","modified":"2026-10-22T00:08:27.063048673Z","published":"2026-09-15T20:54:25Z","upstream":["CVE-2025-5878"],"references":[{"type":"WEB","url":"https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin13.pdf"},{"type":"WEB","url":"https://github.com/uglory-gll/javasec/blob/main/ESAPI.md"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5878.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5878"},{"type":"FIX","url":"https://github.com/ESAPI/esapi-java-legacy/commit/e2322914304d9b1c52523ff24be495b7832f6a56"},{"type":"FIX","url":"https://github.com/ESAPI/esapi-java-legacy/commit/f75ac2c2647a81d2cfbdc9c899f8719c240ed512"},{"type":"FIX","url":"https://github.com/ESAPI/esapi-java-legacy/releases/tag/esapi-2.7.0.0"}],"affected":[{"package":{"name":"org.owasp.esapi:esapi","ecosystem":"Red Hat Lightwell:Maven","purl":"pkg:maven/org.owasp.esapi/esapi"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0.0-rhlw-00005"}]}],"versions":["2.0.1","2.0GA","2.0_rc10","2.0_rc11","2.0_rc9","2.1.0","2.1.0.1","2.2.0.0","2.2.0.0-RC2","2.2.0.0-RC3","2.2.1.0","2.2.1.0-RC1","2.2.1.1","2.2.2.0","2.2.3.0","2.2.3.1","2.3.0.0"],"database_specific":{"lightwell":{"backport_base_version":"2.3.0.0","remediated_version":"2.3.0.0-rhlw-00005","repository_url":"https://packages.redhat.com/lightwell/java/remediated/"},"source":"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-cc6f4a613453615e.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}],"credits":[{"name":"Red Hat Lightwell","type":"REMEDIATION_DEVELOPER"}]}