CVE-2026-22865

The record

Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and would not cause a repository to be disabled. If a build encountered one of these exceptions, Gradle would continue to the next repository in the list and potentially resolve dependencies from a different repository. An exception like NoHttpResponseException can indicate transient errors. If the errors persist after a maximum number of retries, Gradle would continue to the next repository. This behavior could allow an attacker to disrupt the service of a repository and leverage another repository to serve malicious artifacts. This attack requires the attacker to have control over a repository after the disrupted repository. Gradle has introduced a change in behavior in Gradle 9.3.0 to stop searching other repositories when encountering these errors.

Affected packages

Related vulnerabilities

• CVE-2026-22816 Gradle is a build automation tool, and its native-platform tool provides Java bindings… Also affects gradle
• CVE-2025-4949 Eclipse JGit XML External Entity (XXE) Vulnerability Also affects gradle-8
• CVE-2024-30172 An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. Also affects gradle-8
• CVE-2024-30171 An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Also affects gradle-8
• CVE-2024-29857 An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java)… Also affects gradle-8
• CVE-2024-34447 An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java… Also affects gradle-8
• CVE-2024-26308 Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons… Also affects gradle-8
• CVE-2024-25710 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons… Also affects gradle-8