Catalogue CVE
CVE-2026-33117
The Java Key Vault Keys library in the Azure SDK for…
The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.
- Gravité
- Critical · CVSS 9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.48% · Oct 27, 2026
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| UnknownRelease not reported | azure_sdk_for_java | 4.10.6 | UnknownSource applicability is not established | Provider not reported |
Provider details and historical evidence
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| UnknownRelease not reported | azure_sdk_for_java | 4.10.6 | UnknownSource applicability is not established | Provider not reported |
Original provider fields
{
"package_releases": [],
"fixed_versions": [],
"distribution_packages": [
{
"name": "azure_sdk_for_java",
"fixed_version": "4.10.6",
"applicability_unknown": true
},
{
"name": "azure_sdk_for_java",
"ranges": [
{
"fixed": "4.10.6",
"introduced": "",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33117",
"fixed_version": "4.10.6",
"provider_source": "nvd",
"provider_record_id": "NVD-CVE-2026-33117",
"provider_updated_at": "2026-10-26T18:10:00.173"
}
]
}OpenFactory catalog packages
L’association des paquets est en cours.
Observé: