JDBC Driver for SQL Server has improper input validation issueGHSA-m494-w24q-6f7w
HIGHFix: microsoft/mssql-jdbc#2798GHSA-m494-w24q-6f7w is a high-severity (CVSS 8.1) Improper Input Validation vulnerability in com.microsoft.sqlserver:mssql-jdbc. A fix is available for com.microsoft.sqlserver:mssql-jdbc — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-m494-w24q-6f7w.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
com.microsoft.sqlserver:mssql-jdbc☕com.microsoft.sqlserver:mssql-jdbc☕com.microsoft.sqlserver:mssql-jdbc☕com.microsoft.sqlserver:mssql-jdbc☕com.microsoft.sqlserver:mssql-jdbc☕com.microsoft.sqlserver:mssql-jdbc☕com.microsoft.sqlserver:mssql-jdbcReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | com.microsoft.sqlserver:mssql-jdbc | ≥ 8.3.0.jre11-preview&&< 10.2.4.jre11 | 10.2.4.jre11com.microsoft.sqlserver:mssql-jdbc:10.2.4.jre11 |
| ☕Maven | com.microsoft.sqlserver:mssql-jdbc | ≥ 11.2.0.jre11&&< 11.2.4.jre11 | 11.2.4.jre11com.microsoft.sqlserver:mssql-jdbc:11.2.4.jre11 |
| ☕Maven | com.microsoft.sqlserver:mssql-jdbc | ≥ 12.2.0.jre11&&< 12.2.1.jre11 | 12.2.1.jre11com.microsoft.sqlserver:mssql-jdbc:12.2.1.jre11 |
| ☕Maven | com.microsoft.sqlserver:mssql-jdbc | ≥ 12.6.0.jre11&&< 12.6.5.jre11 | 12.6.5.jre11com.microsoft.sqlserver:mssql-jdbc:12.6.5.jre11 |
| ☕Maven | com.microsoft.sqlserver:mssql-jdbc | ≥ 12.8.0.jre11&&< 12.8.2.jre11 | 12.8.2.jre11com.microsoft.sqlserver:mssql-jdbc:12.8.2.jre11 |
| ☕Maven | com.microsoft.sqlserver:mssql-jdbc | ≥ 12.10.0.jre11&&< 12.10.2.jre11 | 12.10.2.jre11com.microsoft.sqlserver:mssql-jdbc:12.10.2.jre11 |
Affected Products
jdbc driver for sql servermicrosoftDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for com.microsoft.sqlserver:mssql-jdbc, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update com.microsoft.sqlserver:mssql-jdbc to 10.2.4.jre11 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-m494-w24q-6f7w is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is GHSA-m494-w24q-6f7w in your dependencies?
Find it across Maven, including transitive dependencies.