GHSA-97jf-46m3-8953

    Dashboard / Vulnerabilities / GHSA-97jf-46m3-8953

    GHSA-97jf-46m3-8953

    Published: 12 May 2026Last Modified: 10 Sept 2026

    Summary: Security feature bypass vulnerability in Azure Key Vault Keys library for Java

    Details: The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.

    References: https://nvd.nist.gov/vuln/detail/CVE-2026-33117, https://github.com/Azure/azure-sdk-for-java/pull/48476, https://github.com/Azure/azure-sdk-for-java/commit/1b5c5c79d85a5c9a9cfd07f6cdff6fd0f50eccf9, https://github.com/Azure/azure-sdk-for-java, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117

    Affected packages

    Package

    Name: com.azure:azure-security-keyvault-keys

    Purl: pkg:maven/com.azure/azure-security-keyvault-keys

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -4.10.6

    Affected versions

    4.0.0
    4.0.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-97jf-46m3-8953 | CVE-DB