io.github.jopenlibs:vault-java-driver vulnerabilities

CVEs whose affected-version data names the io.github.jopenlibs:vault-java-driver package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

2 CVEsRSS

CVE-2026-109408High· 7.4

yesterday

vault-java-driver: SslConfig silently disables requested TLS verification

vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an Ssl…

▾ Twilightjopenlibs · io.github.jopenlibs:vault-java-driverEPSS 0.18%via CVEORG

CVE-2026-112072Medium· 6.5

yesterday

vault-java-driver: stored deeply nested JSON kills every thread that reads it

vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch (Exception) h…

▾ Sunlitjopenlibs · io.github.jopenlibs:vault-java-driverEPSS 0.33%via CVEORG