Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/io.spinnaker.orca/orca-core@main-167
Typemaven
Namespaceio.spinnaker.orca
Nameorca-core
Versionmain-167
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version2025.2.4
Latest_non_vulnerable_version2025.4.1
Affected_by_vulnerabilities
0
url VCID-xmsu-5rm5-3fcx
vulnerability_id VCID-xmsu-5rm5-3fcx
summary 
### Impact
Spinnaker updated URL Validation logic on user input to provide sanitation on user inputted URLs for clouddriver.  However, they missed that Java URL objects do not correctly handle underscores on parsing.  This led to a bypass of the previous CVE (CVE-2025-61916) through the use of carefully crafted URLs.  Note, Spinnaker found this not just in that CVE, but in the existing URL validations in Orca fromUrl expression handling.  This CVE impacts BOTH artifacts as a result.   

### Patches
This has been merged and will be available in versions 2025.4.1, 2025.3.1, 2025.2.4 and 2026.0.0.  

### Workarounds
You can disable the various artifacts on this system to work around these limits.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-25534
reference_id
reference_type
scores
0
value 0.00062
scoring_system epss
scoring_elements 0.19491
published_at 2026-06-11T12:55:00Z
1
value 0.00062
scoring_system epss
scoring_elements 0.1966
published_at 2026-06-14T12:55:00Z
2
value 0.00062
scoring_system epss
scoring_elements 0.19686
published_at 2026-06-13T12:55:00Z
3
value 0.00062
scoring_system epss
scoring_elements 0.19665
published_at 2026-06-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-25534
1
reference_url https://github.com/spinnaker/spinnaker
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spinnaker/spinnaker
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-25534
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-25534
3
reference_url https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda
reference_id 7c4737906239a958a468e843239c6785b03d0eda
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
1
value CRITICAL
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-17T17:48:58Z/
url https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda
4
reference_url https://github.com/advisories/GHSA-8r8j-gfhg-fw38
reference_id GHSA-8r8j-gfhg-fw38
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-8r8j-gfhg-fw38
5
reference_url https://github.com/spinnaker/spinnaker/security/advisories/GHSA-8r8j-gfhg-fw38
reference_id GHSA-8r8j-gfhg-fw38
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
1
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-17T17:48:58Z/
url https://github.com/spinnaker/spinnaker/security/advisories/GHSA-8r8j-gfhg-fw38
6
reference_url https://github.com/spinnaker/spinnaker/security/advisories/GHSA-vrjc-q2fh-6x9h
reference_id GHSA-vrjc-q2fh-6x9h
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
1
value CRITICAL
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-17T17:48:58Z/
url https://github.com/spinnaker/spinnaker/security/advisories/GHSA-vrjc-q2fh-6x9h
fixed_packages
0
url pkg:maven/io.spinnaker.orca/orca-core@2025.2.4
purl pkg:maven/io.spinnaker.orca/orca-core@2025.2.4
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/io.spinnaker.orca/orca-core@2025.2.4
1
url pkg:maven/io.spinnaker.orca/orca-core@2025.3.1
purl pkg:maven/io.spinnaker.orca/orca-core@2025.3.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/io.spinnaker.orca/orca-core@2025.3.1
2
url pkg:maven/io.spinnaker.orca/orca-core@2025.4.1
purl pkg:maven/io.spinnaker.orca/orca-core@2025.4.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/io.spinnaker.orca/orca-core@2025.4.1
aliases CVE-2026-25534, GHSA-8r8j-gfhg-fw38
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-xmsu-5rm5-3fcx
Fixing_vulnerabilities
Risk_score4.5
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/io.spinnaker.orca/orca-core@main-167