{"id":"CVE-2026-113730","summary":"OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies","details":"OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Method, java.lang.reflect.Constructor, or java.lang.reflect.Field. An attacker-controlled expression can invoke one of these reflection objects as a proxy for a method on a blocked class, causing the real operation to execute inside JDK reflection without passing through the stricter-invocation check again. Exploitation requires an application to evaluate untrusted OGNL expressions, use the default or an equivalently permissive MemberAccess that permits reflection, and rely on stricter invocation as a sandbox. Applications using a restrictive MemberAccess, including Apache Struts with SecurityMemberAccess, are not affected by this bypass. This issue is fixed in 3.4.13.","aliases":["GHSA-crwc-vw2r-qr6m"],"modified":"2026-10-21T10:59:10.274842715Z","published":"2026-10-20T21:24:24.093Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-693"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113730.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113730.json"},{"type":"FIX","url":"https://github.com/orphan-oss/ognl/commit/16396fa4b560221294c2ab9ca04b76b161115e7d"},{"type":"FIX","url":"https://github.com/orphan-oss/ognl/commit/f4c17f794754d516ea799c36ed8524d1b7fb98e2"},{"type":"WEB","url":"https://github.com/orphan-oss/ognl/releases/tag/OGNL_3_4_13"},{"type":"ADVISORY","url":"https://github.com/orphan-oss/ognl/security/advisories/GHSA-crwc-vw2r-qr6m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113730"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/orphan-oss/ognl","events":[{"introduced":"0"},{"fixed":"d92c7d3153e9ee51953b1c88df0b292e1a7f23e9"},{"fixed":"16396fa4b560221294c2ab9ca04b76b161115e7d"},{"fixed":"f4c17f794754d516ea799c36ed8524d1b7fb98e2"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"3.4.13"}]},{"range":[{"fixed":"16396fa4b560221294c2ab9ca04b76b161115e7d"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"f4c17f794754d516ea799c36ed8524d1b7fb98e2"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"OGNL_3_4_13","range":[{"fixed":"d92c7d3153e9ee51953b1c88df0b292e1a7f23e9"}]}]}}],"versions":["OGNL_3_4_12","OGNL_3_4_11","v3.5.0-BETA4","v3.5.0-BETA3","OGNL_3_4_10","v3.5.0-BETA2","OGNL_3_4_9","v3.5.0-BETA1","OGNL_3_4_8","OGNL_3_4_6","OGNL_3_4_5","OGNL_3_4_4","OGNL_3_4_3","OGNL_3_4_2","OGNL_3_4_1","OGNL_3_4_0","OGNL_3_3_3","OGNL_3_3_2","OGNL_3_3_1","OGNL_3_3_0","OGNL_3_2_21","OGNL_3_2_20","OGNL_3_2_19","OGNL_3_2_18","OGNL_3_2_17","OGNL_3_2_16","OGNL_3_2_15","OGNL_3_2_14","OGNL_3_2_13","OGNL_3_2_12","OGNL_3_2_11","OGNL_3_2_10","OGNL_3_2_9","OGNL_3_2_8","OGNL_3_2_7","OGNL_3_2_6","OGNL_3_2_5","OGNL_3_2_4","OGNL_3_2_3","OGNL_3_1_14","OGNL_3_2_2","OGNL_3_2_1","OGNL_3_2","OGNL_3_1_13","OGNL_3_1_12","OGNL_3_1_11","OGNL_3_1_10","OGNL_3_1_9","OGNL_3_1_8","OGNL_3_1_7","OGNL_3_1_6","OGNL_3_1_5","OGNL_3_1_4","OGNL_3_1_3","OGNL_3_0_6","OGNL_3_1_2","OGNL_3_1_1","OGNL_3_0_12","OGNL_3_1","OGNL_3_0_11","OGNL_3_0_10","OGNL_3_0_9","OGNL_3_0_8","OGNL_3_0_7","OGNL_3_0_5","OGNL_3_0_4","OGNL_3_0_3","3.0.1","3.0"],"database_specific":{"vanir_signatures_modified":"2026-10-21T10:59:10Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113730.json","vanir_signatures":[{"target":{"file":"ognl/src/main/java/ognl/OgnlRuntime.java","function":"invokeMethod"},"deprecated":false,"digest":{"function_hash":"334233751160444342862515372962702511043","length":1978},"id":"CVE-2026-113730-6b1456d6","signature_type":"Function","signature_version":"v1","source":"https://github.com/orphan-oss/ognl/commit/16396fa4b560221294c2ab9ca04b76b161115e7d"},{"source":"https://github.com/orphan-oss/ognl/commit/f4c17f794754d516ea799c36ed8524d1b7fb98e2","target":{"file":"src/main/java/ognl/OgnlRuntime.java","function":"invokeMethod"},"deprecated":false,"digest":{"length":2908,"function_hash":"255098191853421534153501879208143402173"},"id":"CVE-2026-113730-8c2daa1d","signature_type":"Function","signature_version":"v1"},{"target":{"file":"ognl/src/main/java/ognl/OgnlRuntime.java"},"deprecated":false,"digest":{"line_hashes":["95515084170794385912493604941306622782","290902060387007093802232342938252108168","73624621775664156231362232939708856594","156021304283618269892127477664395080945"],"threshold":0.9},"id":"CVE-2026-113730-ce367fca","signature_type":"Line","signature_version":"v1","source":"https://github.com/orphan-oss/ognl/commit/16396fa4b560221294c2ab9ca04b76b161115e7d"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/orphan-oss/ognl/commit/f4c17f794754d516ea799c36ed8524d1b7fb98e2","target":{"file":"src/main/java/ognl/OgnlRuntime.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["95515084170794385912493604941306622782","142716134767813479774632542273095477928","60682005161673294066198102051547031111","331647046328749616830387743273730171473"]},"id":"CVE-2026-113730-fed6e55c"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}]}