debian/ognl vulnerabilities

Latest debian/ognl CVEs

Newest publication first

1. CVE-2026-113730 OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies

   Published 2026-10-20

   Medium·CVSS 5.6 EPSS 0.39%

   OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Method, java.lang.reflect.Constructor, or java.l...

2. CVE-2025-53192 Apache Commons OGNL: Expression Injection leading to RCE

   Published 2025-08-18

   High·CVSS 8.8 EPSS 0.62%

   ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL. This issue affects Apache Commons OGNL: all versions. When using the API Ognl.getValue​, the OGNL engine parses and evaluates the provided expression wit...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.