Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

ognl:ognl

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.3MavenAmendedPublished

    OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies

    CVE-2026-113730 · GHSA-crwc-vw2r-qr6m

    Affected
    • Maven ognl:ognl < 3.4.13
    Fixed in
    3.4.13· Vendor fix available
    Issue
    OGNL's optional *stricter invocation* mode maintains a block list that prevents expressions from directly calling methods on dangerous classes such as `Runtime`, `ProcessBuilder`, and `ClassLoader`. The block list filters on the declaring class of the method OGNL invokes. Because `java.lang.reflect.Method` (and `Constructor`/`Field`) are not on the list, an expression can use reflection as a proxy — `someMethod.invoke(target, args)` — to reach a blocked method. The real call (e.g. `ProcessBuilder.start()`) then executes inside the JDK reflection machinery and never passes back through OGNL's `invokeMethod`, so the block list never sees it. Proof of concept Under the default OGNL context (public-only access, stricter invocation enabled), the following expression creates a file even though a direct `new ProcessBuilder(...).start()` is blocked: ``` (#pb=new java.lang.ProcessBuilder({"/usr/bin/touch","rce-proof.txt"}),…

    Recommended action: Upgrade to 3.4.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →
  2. Medium, CVSS 5.3MavenPublished

    Denial of service in Apache Struts

    CVE-2016-3093 · GHSA-383p-xqxx-rrmp

    Affected
    • Maven ognl:ognl < 3.0.12
    Fixed in
    3.0.12· Vendor fix available
    Issue
    Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.

    Recommended action: Upgrade to 3.0.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →