Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
SonarQube can be tricked into reading malformed JSON
published 6 days ago
Summary
The SonarQube server processes JSON data using a component called UTF8DataInputJsonParser. A specially crafted JSON file can cause the parser to behave unexpectedly, potentially leading to service disruption or data exposure. Apply the latest SonarQube update or patch provided by the vendor to protect your system.
What to do
- Update cleanstart sonarqube to version 26.9.0.129388-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | sonarqube |
< 26.9.0.129388-r0 Fix: upgrade to 26.9.0.129388-r0
|
Original advisory text
UTF8DataInputJsonParser
Security vulnerability affects the sonarqube package. UTF8DataInputJsonParser.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published30 Oct 2026
Updated30 Oct 2026
First seen30 Oct 2026
Sources
CLEANSTART-2026-OS16605 · OSV
Track software like this
Free during beta