Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕
☕ Maven
Not in CISA KEV
HIGH severity

CedarJava has type confusion vulnerabilityGHSA-93g4-m6xv-cmvr

HIGH

GHSA-93g4-m6xv-cmvr is a high-severity (CVSS 8.8) CWE-843 vulnerability in com.cedarpolicy:cedar-java. A fix is available for com.cedarpolicy:cedar-java — see the affected versions and patch details below.

Also known asCVE-2026-55772
Published
Updated
Affected
3 pkgs
Patched
3 / 3
Exploits
None indexed
Exploitation data as of Oct 24, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • A successful exploit gives an attacker total control of the affected component, not partial access.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-93g4-m6xv-cmvr.

EPSS Exploitation Probability

via FIRST.org ↗
0.5%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs40th percentile — riskier than 40% of all scored CVEsHighest risk
0.00%0.33%0.65%0.98%0.3%0.5%0.5%0.5%Aug 26Oct 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-93g4-m6xv-cmvr by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 395,249 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

3 pkgs affected
☕com.cedarpolicy:cedar-java☕com.cedarpolicy:cedar-java☕com.cedarpolicy:cedar-java

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Summary

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, improper input handling could allow type confusion across the Java-Rust FFI boundary.

Impact

Record-to-Entity type confusion across the Java-Rust FFI boundary

CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (__entity and __extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference.

This issue requires the integrating service to build a CedarMap where the an actor controls the keys, and a policy must reference that value in a when/unless clause.

Impacted versions:

< 4.9

Patches

Addressed in CedarJava version 2.3.6, 3.4.1, and 4.9 and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds

Enable schema-based request validation to catch type mismatches. Validate that user-controlled data does not contain reserved keys (__entity or __extn) before building CedarMap objects.

References

If you have any questions or comments about this advisory, we ask that you contact us directly via email to [email protected]. Please do not create a public GitHub issue.

Affected Packages

3 total 3 fixed
EcosystemPackageVulnerable rangeFix
☕Mavencom.cedarpolicy:cedar-javaall versions2.3.6com.cedarpolicy:cedar-java:2.3.6
☕Mavencom.cedarpolicy:cedar-java≥ 3.1.2&&< 3.4.13.4.1com.cedarpolicy:cedar-java:3.4.1
☕Mavencom.cedarpolicy:cedar-java≥ 4.0.0&&< 4.9.04.9.0com.cedarpolicy:cedar-java:4.9.0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for com.cedarpolicy:cedar-java, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update com.cedarpolicy:cedar-java to 2.3.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-93g4-m6xv-cmvr is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Summary CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, improper input handling could allow type confusion across the Java-Rust FFI boundary. ### Impact **Record-to-Entity type confusion across the Java-Rust FFI boundary** CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (`__entity` and `__extn`) for entity references and extension values. When serializing a `CedarMap`, there is no validatio
O3 Security · Impact-Aware SCA

Is GHSA-93g4-m6xv-cmvr in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
CedarJava has type confusion vulnerability (High 8.8)