Test Database Builder for Java 4.0.2, released 2026-07-28

July 28, 2026 ยท View on GitHub

Code name: Fixed vulnerabilities CVE-2026-60586, CVE-2026-60623, CVE-2026-60624, CVE-2026-61082, CVE-2026-9563, CVE-2026-54291

Summary

This release fixes the following 6 vulnerabilities:

CVE-2026-60586 (CWE-200) in dependency com.mysql:mysql-connector-j:jar:9.7.0:compile

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

References

CVE-2026-60623 (CWE-668) in dependency com.mysql:mysql-connector-j:jar:9.7.0:compile

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).

References

CVE-2026-60624 (CWE-400) in dependency com.mysql:mysql-connector-j:jar:9.7.0:compile

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).

References

CVE-2026-61082 (CWE-200) in dependency com.mysql:mysql-connector-j:jar:9.7.0:compile

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).

References

CVE-2026-9563 (CWE-400) in dependency org.eclipse.parsson:parsson:jar:1.1.7:compile

In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memory by processing very large documents, including large arrays, objects, strings, numbers, whitespace, or nested structures, resulting in a denial of service. Eclipse Parsson 1.1.8 introduces a configurable maximum parsing limit with a default limit of 15 million parser-consumed characters.

References

CVE-2026-54291, GHSA-J92G-9F8W-J867 (CWE-636, CWE-757) in dependency org.postgresql:postgresql:jar:unknown:compile

PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms

References

Security

  • #163: Fixed vulnerability CVE-2026-60586 in dependency com.mysql:mysql-connector-j:jar:9.7.0:compile
  • #164: Fixed vulnerability CVE-2026-60623 in dependency com.mysql:mysql-connector-j:jar:9.7.0:compile
  • #165: Fixed vulnerability CVE-2026-60624 in dependency com.mysql:mysql-connector-j:jar:9.7.0:compile
  • #166: Fixed vulnerability CVE-2026-61082 in dependency com.mysql:mysql-connector-j:jar:9.7.0:compile
  • #160: Fixed vulnerability CVE-2026-9563 in dependency org.eclipse.parsson:parsson:jar:1.1.7:compile
  • #161: Fixed vulnerability CVE-2026-54291, GHSA-J92G-9F8W-J867 in dependency org.postgresql:postgresql:jar:unknown:compile

Dependency Updates

Test Dependency Updates

  • Updated com.exasol:exasol-testcontainers:7.3.0 to 8.0.1
  • Updated org.postgresql:postgresql:42.7.11 to 42.7.12

Plugin Dependency Updates

  • Updated com.exasol:error-code-crawler-maven-plugin:2.0.7 to 2.1.0
  • Updated com.exasol:project-keeper-maven-plugin:5.6.2 to 5.7.4
  • Removed com.exasol:quality-summarizer-maven-plugin:0.2.1
  • Updated org.apache.maven.plugins:maven-enforcer-plugin:3.6.2 to 3.6.3
  • Updated org.apache.maven.plugins:maven-failsafe-plugin:3.5.5 to 3.5.6
  • Updated org.apache.maven.plugins:maven-site-plugin:3.21.0 to 3.22.0
  • Updated org.apache.maven.plugins:maven-surefire-plugin:3.5.5 to 3.5.6
  • Added org.codehaus.mojo:build-helper-maven-plugin:3.6.1
  • Updated org.jacoco:jacoco-maven-plugin:0.8.14 to 0.8.15
  • Updated org.sonarsource.scanner.maven:sonar-maven-plugin:5.5.0.6356 to 5.7.0.6970
  • Updated org.sonatype.central:central-publishing-maven-plugin:0.10.0 to 0.11.0
  • Added org.spdx:spdx-maven-plugin:1.0.4