Catalogue CVE

CVE-2026-13503

A vulnerability was detected in antlr ANTLR4 up to…

A vulnerability was detected in antlr ANTLR4 up to 4.13.2. Affected by this issue is the function getImportedVocabFile of the file tool/src/org/antlr/v4/parse/TokenVocabParser.java of the component tokenVocab Grammar Option Handler. The manipulation results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Gravité: Medium · CVSS 5.5CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Jun 28, 2026, 3:15:07 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.77% · Oct 27, 2026

Projects and upstream resources

[antlr4][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	antlr4	Not reported	AffectedDistribution reports no fix	[CVE-2026-13503]
Debiantrixie	antlr4	`4.9.2-3`	Unknown	[CVE-2026-13503]
Debiansid	antlr4	Not reported	AffectedDistribution reports no fix	[CVE-2026-13503]
Debiansid	antlr4	`4.9.2-3`	Unknown	[CVE-2026-13503]
Debianforky	antlr4	Not reported	AffectedDistribution reports no fix	[CVE-2026-13503]
Debianforky	antlr4	`4.9.2-3`	Unknown	[CVE-2026-13503]
Debianbookworm	antlr4	Not reported	AffectedDistribution reports no fix	[CVE-2026-13503]
Debianbookworm	antlr4	`4.7.2-5`	Unknown	[CVE-2026-13503]
UnknownRelease not reported	antlr4	Not reported	UnknownSource applicability is not established	Provider not reported

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	antlr4	Not reported	UnknownSource applicability is not established	Provider not reported
Debianbookworm	antlr4	Not reported	AffectedDistribution reports no fix	[CVE-2026-13503]
Debianbookworm	antlr4	`4.7.2-5`	Unknown	[CVE-2026-13503]
Debianforky	antlr4	Not reported	AffectedDistribution reports no fix	[CVE-2026-13503]
Debianforky	antlr4	`4.9.2-3`	Unknown	[CVE-2026-13503]
Debiansid	antlr4	Not reported	AffectedDistribution reports no fix	[CVE-2026-13503]
Debiansid	antlr4	`4.9.2-3`	Unknown	[CVE-2026-13503]
Debiantrixie	antlr4	Not reported	AffectedDistribution reports no fix	[CVE-2026-13503]
Debiantrixie	antlr4	`4.9.2-3`	Unknown	[CVE-2026-13503]

Original provider fields

{
  "package_releases": [
    {
      "name": "antlr4",
      "status": "unknown",
      "release": "sid",
      "version": "4.9.2-3"
    },
    {
      "name": "antlr4",
      "status": "unknown",
      "release": "forky",
      "version": "4.9.2-3"
    },
    {
      "name": "antlr4",
      "status": "unknown",
      "release": "trixie",
      "version": "4.9.2-3"
    },
    {
      "name": "antlr4",
      "status": "unknown",
      "release": "bookworm",
      "version": "4.7.2-5"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "antlr4",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "antlr4",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "antlr4",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "antlr4",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "antlr4",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

L’association des paquets est en cours.

[Debian 12 (Bookworm)]

[antlr4]Inconnu
Détails (2)
- 4.7.2-5 · all · bookworm
  Affectée
  nvd · antlr4 · debian · bookworm; nvd · antlr4 · debian · 12
- 4.7.2-5 · all · bookworm
  Affectée
  nvd · antlr4 · debian · bookworm; nvd · antlr4 · debian · 12
[antlr4-doc]Inconnu
Paquet source: [antlr4]
Détails (2)
- 4.7.2-5 · all · bookworm
  Affectée
  nvd · antlr4 · debian · bookworm; nvd · antlr4 · debian · 12
- 4.7.2-5 · all · bookworm
  Affectée
  nvd · antlr4 · debian · bookworm; nvd · antlr4 · debian · 12
[antlr4-maven-plugin]Inconnu
Paquet source: [antlr4]
Détails (2)
- 4.7.2-5 · all · bookworm
  Affectée
  nvd · antlr4 · debian · bookworm; nvd · antlr4 · debian · 12
- 4.7.2-5 · all · bookworm
  Affectée
  nvd · antlr4 · debian · bookworm; nvd · antlr4 · debian · 12
[libantlr4-runtime-java]Inconnu
Paquet source: [antlr4]
Détails (2)
- 4.7.2-5 · all · bookworm
  Affectée
  nvd · antlr4 · debian · bookworm; nvd · antlr4 · debian · 12
- 4.7.2-5 · all · bookworm
  Affectée
  nvd · antlr4 · debian · bookworm; nvd · antlr4 · debian · 12

[Debian 13 (Trixie)]

[antlr4]Inconnu
Détails (2)
- 4.9.2-3 · all · trixie
  Affectée
  nvd · antlr4 · debian · 13
- 4.9.2-3 · all · trixie
  Affectée
  nvd · antlr4 · debian · 13
[antlr4-doc]Inconnu
Paquet source: [antlr4]
Détails (2)
- 4.9.2-3 · all · trixie
  Affectée
  nvd · antlr4 · debian · 13
- 4.9.2-3 · all · trixie
  Affectée
  nvd · antlr4 · debian · 13
[antlr4-maven-plugin]Inconnu
Paquet source: [antlr4]
Détails (2)
- 4.9.2-3 · all · trixie
  Affectée
  nvd · antlr4 · debian · 13
- 4.9.2-3 · all · trixie
  Affectée
  nvd · antlr4 · debian · 13
[libantlr4-runtime-java]Inconnu
Paquet source: [antlr4]
Détails (2)
- 4.9.2-3 · all · trixie
  Affectée
  nvd · antlr4 · debian · 13
- 4.9.2-3 · all · trixie
  Affectée
  nvd · antlr4 · debian · 13

Observé: Oct 23, 2026, 9:45:22 PM UTC

Références

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]