CVEvulnerability

CVE-2026-33117

9.1 CRITICAL Published 2026-05-12 Modified 2026-10-26 Official page ↗
Status
Modified
Published
2026-05-12
Last modified
2026-10-26
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-287, CWE-347

Description

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.

Affected configurations

• microsoft azure sdk for java (< 4.10.6)

Related

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-347 Improper Verification of Cryptographic Signature weakness

References