{"id":"CVE-2026-25534","summary":"Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames","details":"### Impact\nSpinnaker updated URL Validation logic on user input to provide sanitation on user inputted URLs for clouddriver.  However, they missed that Java URL objects do not correctly handle underscores on parsing.  This led to a bypass of the previous CVE (CVE-2025-61916) through the use of carefully crafted URLs.  Note, Spinnaker found this not just in that CVE, but in the existing URL validations in Orca fromUrl expression handling.  This CVE impacts BOTH artifacts as a result.   \n\n### Patches\nThis has been merged and will be available in versions 2025.4.1, 2025.3.1, 2025.2.4 and 2026.0.0.  \n\n### Workarounds\nYou can disable the various artifacts on this system to work around these limits.","aliases":["GHSA-8r8j-gfhg-fw38"],"modified":"2026-08-12T15:31:55.563897Z","published":"2026-03-17T17:27:41.345Z","related":["GHSA-8r8j-gfhg-fw38","GHSA-vrjc-q2fh-6x9h"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25534.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25534.json"},{"type":"ADVISORY","url":"https://github.com/spinnaker/spinnaker/security/advisories/GHSA-8r8j-gfhg-fw38"},{"type":"ADVISORY","url":"https://github.com/spinnaker/spinnaker/security/advisories/GHSA-vrjc-q2fh-6x9h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25534"},{"type":"FIX","url":"https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/spinnaker/spinnaker","events":[{"introduced":"0"},{"introduced":"ed0023ebff55956d438e0a2424c1c1c66e220f41"},{"introduced":"6465902a6651ea50fa821259c7bbe68475e49251"},{"fixed":"b26345757c52cbef2ab3a9b56513873b1caeca7c"},{"fixed":"c973386a8c523a53af4f04386134b7e37e2bbfc4"},{"fixed":"aa57ea001b59ca769dd0920aed64e51e8428ff1f"},{"fixed":"7c4737906239a958a468e843239c6785b03d0eda"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2025.2.4"},{"introduced":"2025.3.0"},{"fixed":"2025.3.1"},{"introduced":"2025.4.0"},{"fixed":"2025.4.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["deck-2025.3.1","rosco-2025.2.4","orca-2025.2.4","keel-2025.2.4","kayenta-2025.2.4","igor-2025.2.4","halyard-2025.2.4","gate-2025.2.4","front50-2025.2.4","fiat-2025.2.4","echo-2025.2.4","deck-2025.2.4","clouddriver-2025.2.4","bn-deck-kayenta-release-2025.2.x-4","orca-2025.3-2","kayenta-2025.3-2","halyard-2025.3-4","clouddriver-2025.3-3","bn-deck-kayenta-release-2025.3.x-6","orca-2025.2-9","kayenta-2025.2-9","halyard-2025.2-6","clouddriver-2025.2-5","bn-spinnaker-libraries-release-2025.2.x-16","bn-orca-release-2025.2.x-9","bn-kayenta-release-2025.2.x-9","bn-halyard-release-2025.2.x-6","bn-clouddriver-release-2025.2.x-5","rosco-2025.3.1","orca-2025.3.1","keel-2025.3.1","kayenta-2025.3.1","igor-2025.3.1","halyard-2025.3.1","halyard-2025.3-3","gate-2025.3.1","front50-2025.3.1","fiat-2025.3.1","echo-2025.3.1","clouddriver-2025.3.1","clouddriver-2025.3-2","orca-2025.4-3","kayenta-2025.4-3","halyard-2025.4-4","deck-2025.4.1","clouddriver-2025.4-3","halyard-2025.4-3","clouddriver-2025.4-2","halyard-2025.2-5","clouddriver-2025.2-4","deck-2025.3-3","deck-2025.4-4","deck-2025.2-2","bn-deck-release-2025.2.x-2","halyard-main-79","clouddriver-main-73","deck-2025.4.0-rc1","halyard-2025.4-2","clouddriver-2025.4.1","rosco-2025.3-1","orca-2025.3-1","keel-2025.3-1","kayenta-2025.3-1","igor-2025.3-1","halyard-2025.3-2","gate-2025.3-1","front50-2025.3-1","fiat-2025.3-1","echo-2025.3-1","orca-2025.2-8","kayenta-2025.2-8","gate-main-55","halyard-2025.3-1","halyard-2025.2-4","orca-main-81","kayenta-main-82","echo-main-46","orca-main-80","kayenta-main-81","rosco-main-40","orca-main-79","keel-main-39","kayenta-main-80","igor-main-44","halyard-main-78","gate-main-54","front50-main-42","fiat-main-38","echo-main-45","clouddriver-main-72","rosco-main-39","orca-main-78","keel-main-38","kayenta-main-79","igor-main-43","halyard-main-77","gate-main-53","front50-main-41","fiat-main-37","echo-main-44","rosco-main-38","rosco-2025.4.1","rosco-2025.4-2","orca-2025.4.1","orca-2025.4-2","keel-2025.4.1","keel-2025.4-1","kayenta-2025.4.1","kayenta-2025.4-2","igor-2025.4.1","igor-2025.4-1","halyard-2025.4.1","halyard-2025.4-1","gate-2025.4.1","gate-2025.4-1","front50-2025.4.1","front50-2025.4-1","fiat-2025.4.1","fiat-2025.4-1","echo-2025.4.1","echo-2025.4-1","clouddriver-2025.4-1","spinnaker-release-2025.3.0","rosco-2025.3.0","orca-2025.3.0","keel-2025.3.0","kayenta-2025.3.0","igor-2025.3.0","halyard-2025.3.0","gate-2025.3.0","front50-2025.3.0","fiat-2025.3.0","echo-2025.3.0","deck-kayenta-2025.3.0","deck-2025.3.0","clouddriver-2025.3.0","bn-spin-release-2025.3.x-3","spinnaker-release-2025.2.3","rosco-2025.2.3","orca-2025.2.3","orca-2025.2-7","keel-2025.2.3","kayenta-2025.2.3","kayenta-2025.2-7","igor-2025.2.3","halyard-2025.2.3","gate-2025.2.3","front50-2025.2.3","fiat-2025.2.3","echo-2025.2.3","deck-kayenta-2025.2.3","deck-2025.2.3","clouddriver-2025.2.3","bn-spinnaker-release-2025.2.x-3","halyard-main-76","halyard-main-75","halyard-main-74","rosco-main-37","orca-main-77","keel-main-37","kayenta-main-78","igor-main-42","halyard-main-73","gate-main-52","front50-main-40","fiat-main-36","echo-main-43","rosco-main-36","orca-main-76","keel-main-36","kayenta-main-77","igor-main-41","halyard-main-72","gate-main-51","front50-main-39","fiat-main-35","echo-main-42","orca-2025.4-1","kayenta-2025.4-1","orca-main-75","keel-main-35","kayenta-main-76","halyard-main-71","gate-main-50","front50-main-38","fiat-main-34","echo-main-41","orca-main-74","kayenta-main-75","spinnaker-release-2025.4.0","rosco-main-30","rosco-2025.4.0","rosco-2025.4-1","orca-main-68","orca-2025.4.0","orca-2025.4-0","keel-main-31","keel-2025.4.0","keel-2025.4-0","kayenta-main-69","kayenta-2025.4.0","kayenta-2025.4-0","igor-main-36","igor-2025.4.0","igor-2025.4-0","halyard-main-65","halyard-2025.4.0","halyard-2025.4-0","gate-main-46","gate-2025.4.0","gate-2025.4-0","front50-main-34","front50-2025.4.0","front50-2025.4-0","fiat-main-30","fiat-2025.4.0","fiat-2025.4-0","echo-main-37","echo-2025.4.0","echo-2025.4-0","deck-kayenta-2025.4.0","deck-kayenta-2025.4-0","deck-2025.4.0","deck-2025.4-0","clouddriver-main-60","clouddriver-2025.4.0","clouddriver-2025.4-0","bn-spin-release-2025.4.x-0","rosco-main-34","orca-main-73","keel-main-34","kayenta-main-74","igor-main-39","halyard-main-70","gate-main-49","front50-main-37","fiat-main-33","echo-main-40","halyard-main-69","orca-main-72","kayenta-main-73","halyard-main-68","orca-main-71","kayenta-main-72","rosco-main-33","orca-main-70","keel-main-33","kayenta-main-71","igor-main-38","halyard-main-67","gate-main-48","front50-main-36","fiat-main-32","echo-main-39","clouddriver-main-62","rosco-main-32","orca-main-69","keel-main-32","kayenta-main-70","igor-main-37","halyard-main-66","gate-main-47","front50-main-35","fiat-main-31","echo-main-38","clouddriver-main-61","rosco-main-31","echo-2025.2-1","bn-echo-release-2025.2.x-1","orca-2025.2-6","kayenta-2025.2-6","gate-2025.2-3","bn-gate-release-2025.2.x-3","orca-2025.2-5","kayenta-2025.2-5","halyard-2025.2-3","clouddriver-2025.2-3","orca-2025.2-4","kayenta-2025.2-4","halyard-2025.2-2","clouddriver-2025.2-2","orca-2025.2-3","kayenta-2025.2-3","halyard-2025.2-1","clouddriver-2025.2-1","orca-2025.2-2","kayenta-2025.2-2","orca-2025.2-1","kayenta-2025.2-1","spinnaker-release-2025.2.2","rosco-2025.2.2","orca-2025.2.2","keel-2025.2.2","kayenta-2025.2.2","igor-2025.2.2","halyard-2025.2.2","gate-2025.2.2","gate-2025.2-2","front50-2025.2.2","fiat-2025.2.2","echo-2025.2.2","deck-kayenta-2025.2.2","deck-2025.2.2","clouddriver-2025.2.2","spinnaker-release-2025.2.1","rosco-2025.2.1","orca-2025.2.1","keel-2025.2.1","kayenta-2025.2.1","igor-2025.2.1","halyard-2025.2.1","gate-2025.2.1","gate-2025.2-1","front50-2025.2.1","fiat-2025.2.1","echo-2025.2.1","deck-kayenta-2025.2.1","deck-2025.2.1","clouddriver-2025.2.1","spinnaker-release-2025.2.0","rosco-main-22","rosco-2025.2.0","rosco-2025.2-0","orca-main-36","orca-2025.2.0","orca-2025.2-0","keel-main-23","keel-2025.2.0","keel-2025.2-0","kayenta-main-37","kayenta-2025.2.0","kayenta-2025.2-0","igor-main-27","igor-2025.2.0","igor-2025.2-0","halyard-main-45","halyard-2025.2.0","halyard-2025.2-0","gate-main-29","gate-2025.2.0","gate-2025.2-0","front50-main-23","front50-2025.2.0","front50-2025.2-0","fiat-main-22","fiat-2025.2.0","fiat-2025.2-0","echo-main-28","echo-2025.2.0","echo-2025.2-0","deck-kayenta-2025.2.0","deck-kayenta-2025.2-0","deck-2025.2.0","deck-2025.2-0","clouddriver-main-43","clouddriver-2025.2.0","clouddriver-2025.2-0","bn-spin-release-2025.2.x-0","bn-rosco-release-2025.2.x-0","bn-keel-release-2025.2.x-0","bn-igor-release-2025.2.x-0","bn-front50-release-2025.2.x-0","bn-fiat-release-2025.2.x-0","gate-main-28","halyard-main-44","clouddriver-main-42","halyard-main-43","clouddriver-main-41","halyard-main-42","clouddriver-main-40","halyard-main-41","clouddriver-main-39","halyard-main-40","clouddriver-main-38","halyard-main-39","halyard-main-38","clouddriver-main-37","rosco-main-21","orca-main-35","keel-main-22","kayenta-main-36","igor-main-26","halyard-main-37","gate-main-27","front50-main-22","fiat-main-21","echo-main-27","clouddriver-main-36","gate-main-26","rosco-main-20","orca-main-34","keel-main-21","kayenta-main-35","igor-main-25","halyard-main-36","gate-main-25","front50-main-21","fiat-main-20","echo-main-26","clouddriver-main-35","halyard-main-35","clouddriver-main-34","echo-main-25","halyard-main-34","halyard-main-33","clouddriver-main-33","orca-main-33","kayenta-main-34","rosco-2025.1.0","rosco-2025.1-0","orca-main-32","orca-2025.1.0","orca-2025.1-0","keel-2025.1.0","keel-2025.1-0","kayenta-main-33","kayenta-2025.1.0","kayenta-2025.1-0","igor-2025.1.0","igor-2025.1-0","halyard-2025.1.0","halyard-2025.1-0","gate-2025.1.0","gate-2025.1-0","front50-2025.1.0","front50-2025.1-0","fiat-2025.1.0","fiat-2025.1-0","echo-2025.1.0","echo-2025.1-0","deck-kayenta-2025.1.0","deck-kayenta-2025.1-0","deck-2025.1.0","deck-2025.1-0","clouddriver-2025.1.0","clouddriver-2025.1-0","bn-spin-release-2025.1.x-0","bn-deck-release-2025.1.x-0","bn-deck-kayenta-release-2025.1.x-0","rosco-main-19","orca-main-31","keel-main-20","kayenta-main-32","igor-main-24","halyard-main-32","gate-main-24","front50-main-20","fiat-main-19","echo-main-24","clouddriver-main-32","rosco-main-18","orca-main-30","keel-main-19","kayenta-main-31","igor-main-23","halyard-main-31","gate-main-23","front50-main-19","fiat-main-18","echo-main-23","clouddriver-main-31","gate-main-22","kayenta-main-30","halyard-main-30","clouddriver-main-30","orca-main-28","kayenta-main-29","halyard-main-29","clouddriver-main-29","keel-main-18","halyard-main-28","clouddriver-main-28","halyard-main-27","clouddriver-main-27","rosco-main-17","orca-main-27","keel-main-17","kayenta-main-28","igor-main-22","halyard-main-26","gate-main-21","front50-main-18","fiat-main-17","echo-main-22","clouddriver-main-26","orca-main-26","kayenta-main-27","halyard-main-25","clouddriver-main-25","orca-main-25","kayenta-main-26","orca-main-24","kayenta-main-25","echo-main-21","orca-main-23","kayenta-main-24","orca-main-22","kayenta-main-23","orca-main-21","kayenta-main-22","orca-main-20","kayenta-main-21","halyard-main-24","clouddriver-main-24","rosco-main-16","orca-main-19","keel-main-16","kayenta-main-20","igor-main-21","halyard-main-23","gate-main-20","front50-main-17","fiat-main-16","echo-main-20","clouddriver-main-23","orca-main-18","kayenta-main-19","echo-main-19","rosco-main-15","orca-main-17","keel-main-15","kayenta-main-18","igor-main-20","halyard-main-22","gate-main-19","front50-main-16","fiat-main-15","echo-main-18","clouddriver-main-22","rosco-main-14","orca-main-16","keel-main-14","kayenta-main-17","igor-main-19","halyard-main-21","gate-main-18","front50-main-15","fiat-main-14","echo-main-17","clouddriver-main-21","orca-main-15","keel-main-13","kayenta-main-16","igor-main-18","halyard-main-20","gate-main-17","front50-main-14","fiat-main-13","echo-main-16","clouddriver-main-20","halyard-main-19","clouddriver-main-19","igor-main-17","gate-main-16","echo-main-15","halyard-main-18","clouddriver-main-18","rosco-main-12","orca-main-14","keel-main-12","kayenta-main-15","igor-main-16","halyard-main-17","gate-main-15","front50-main-13","fiat-main-12","echo-main-14","clouddriver-main-17","rosco-main-11","orca-main-13","keel-main-11","kayenta-main-14","igor-main-15","halyard-main-16","gate-main-14","front50-main-12","fiat-main-11","echo-main-13","clouddriver-main-16","rosco-main-10","orca-main-12","keel-main-10","kayenta-main-13","igor-main-14","halyard-main-15","gate-main-13","front50-main-11","fiat-main-10","echo-main-12","clouddriver-main-15","halyard-main-14","front50-main-10","gate-main-12","gate-main-11","orca-main-11","kayenta-main-12","gate-main-10","halyard-main-13","clouddriver-main-14","rosco-main-9","orca-main-10","keel-main-9","kayenta-main-11","igor-main-13","halyard-main-12","gate-main-9","front50-main-9","fiat-main-9","echo-main-11","clouddriver-main-13","igor-main-12","rosco-main-8","orca-main-9","keel-main-8","kayenta-main-10","igor-main-11","halyard-main-11","gate-main-8","front50-main-8","fiat-main-8","echo-main-10","clouddriver-main-12","igor-main-10","halyard-main-10","clouddriver-main-11","kayenta-main-9","clouddriver-main-10","rosco-main-6","orca-main-7","keel-main-6","kayenta-main-7","igor-main-8","halyard-main-8","gate-main-6","front50-main-6","fiat-main-6","echo-main-8","clouddriver-main-9","orca-main-6","kayenta-main-6","rosco-main-5","orca-main-5","keel-main-5","kayenta-main-5","halyard-main-7","gate-main-5","front50-main-5","fiat-main-5","echo-main-7","clouddriver-main-8","igor-main-6","halyard-main-6","clouddriver-main-7","rosco-main-4","orca-main-4","keel-main-4","kayenta-main-4","igor-main-5","halyard-main-5","gate-main-4","front50-main-4","fiat-main-4","echo-main-6","clouddriver-main-6","igor-main-4","halyard-main-4","echo-main-5","deck-main-2","deck-kayenta-main-2","bn-deck-kayenta-main-2","rosco-2025.0-0","orca-2025.0-0","keel-2025.0-0","kayenta-2025.0-0","igor-2025.0-0","halyard-2025.0-0","gate-2025.0-0","front50-2025.0-0","fiat-2025.0-0","echo-main-4","echo-2025.0-0","clouddriver-2025.0-0","bn-spin-release-2025.0.x-0","bn-deck-release-2025.0.x-0","bn-deck-kayenta-release-2025.0.x-0","rosco-main-3","orca-main-3","keel-main-3","kayenta-main-3","igor-main-3","halyard-main-3","gate-main-3","front50-main-3","fiat-main-3","echo-main-3","clouddriver-main-5","rosco-main-2","orca-main-2","keel-main-2","kayenta-main-2","igor-main-2","halyard-main-2","gate-main-2","front50-main-2","fiat-main-2","echo-main-2","clouddriver-main-4","spinnaker-release-2024.0.0","rosco-main-1","orca-main-1","keel-main-1","kayenta-main-1","igor-main-1","halyard-main-1","gate-main-1","front50-main-1","fiat-main-1","echo-main-1","clouddriver-main-3","clouddriver-main-2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25534.json","vanir_signatures_modified":"2026-08-12T15:31:55Z","vanir_signatures":[{"deprecated":false,"digest":{"length":363,"function_hash":"150000891644897917589758918942026879241"},"id":"CVE-2026-25534-0cb575a5","signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda","target":{"file":"clouddriver/clouddriver-artifacts/src/test/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictionsTest.java","function":"verifyThatIpRangesBlockAccess"}},{"deprecated":false,"digest":{"function_hash":"62728337072184961979807547076966941801","length":350},"id":"CVE-2026-25534-0de82edb","signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda","target":{"file":"clouddriver/clouddriver-artifacts/src/test/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictionsTest.java","function":"testWHenNoAllowedRegexButWhiteListIsSet"}},{"signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda","target":{"file":"clouddriver/clouddriver-artifacts/src/test/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictionsTest.java","function":"allowAHostIfResolvesInIpList"},"deprecated":false,"digest":{"function_hash":"148117950495653084537437975733072452102","length":390},"id":"CVE-2026-25534-1fbb63f6","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda","target":{"file":"clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/config/BaseHttpArtifactCredentials.java"},"deprecated":false,"digest":{"line_hashes":["68017213901324006372472003709142178195","294646007134776579919495978106618091942","286614064473529631734477251779141408653","240363853142786854724824018500461142"],"threshold":0.9},"id":"CVE-2026-25534-2f2870d5"},{"deprecated":false,"digest":{"length":2040,"function_hash":"66775298645943787940487104172835387541"},"id":"CVE-2026-25534-326dfe53","signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda","target":{"file":"clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictions.java","function":"validateURI"}},{"target":{"file":"clouddriver/clouddriver-artifacts/src/test/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictionsTest.java","function":"blockDefaultRestrictedDomains"},"deprecated":false,"digest":{"function_hash":"219515358055823127232615466224739619300","length":748},"id":"CVE-2026-25534-3553a17c","signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda"},{"source":"https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda","target":{"file":"clouddriver/clouddriver-artifacts/src/test/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictionsTest.java","function":"allowIpsWhenVerbatimIpsIsFalse"},"deprecated":false,"digest":{"function_hash":"309855457075593471270302000603304578519","length":243},"id":"CVE-2026-25534-37c6c9af","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["100260697823184954394146227062255489216","305384718771817446645177810178908363716","228679767035091877073078593402281767434","246636070325753499701755588874115108086","105545636603326139079686482396844805717","141365321120533504763946764771579088672","167935554924714873479880397641795478492","305714602265198170429037905376477840903","45827300528256660651518115506729584616","178237240115586540989765839313215668850","164860518742667522584066231323819483772","226190230277650932974227492665216167051","328442769025294579533042524968940185463","167935554924714873479880397641795478492","305714602265198170429037905376477840903","45827300528256660651518115506729584616","178237240115586540989765839313215668850","164860518742667522584066231323819483772","59742387362289915393201498416467620643","242252934063006574723463959567013478687","262828276328677581211236222365079781510","117591768566568049973021107074153512423","87358221841251372506165968471540439695","160042155623744186592735709663298422782","163277977584081315561290986690495321701","90971153183388845630366946933667462365","331464317958807901832403438967821684141","282231639286964375650343134574415324500","67762260224883846046555059964585172582","48929167656739692344179446142856868042","163106991325888816444075486617668012484","180450794575609337250914045465288995226","219169817581641698710297444613496570815","173088368078716497494459189827306432958","11504266732919502062412002595982270827","109165567939569633500733788225501765599","224087672048737495990874821217155215794","98288574790649910476776071106907082145","137057675921531941416654739390443347914","215575408974107365650130407906164817595","254731769590765795853398409531625162995","171523300042595666220326998639119494186","169329565284052640101278196359603755379","326509961135550218051555877159372500188","250179354068104382618033131140713427762","330137500507934706419764242805955964865","191181876514932574104314727418180828360","126954691095810731259166802492990253645","207526980804612151367092040471039163463","74248935912744136787462982931538503558","121947679649113365572435070629854576758","274476467422212716578074423649470825693","302728217860796276856037188729192336678","324542935403804335296217865157633055311","253261639621048060301573826639352721491","36349664265561471856687603406402781045"]},"id":"CVE-2026-25534-409ef1fe","signature_type":"Line","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda","target":{"file":"clouddriver/clouddriver-artifacts/src/test/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictionsTest.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda","target":{"file":"clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/config/BaseHttpArtifactCredentials.java","function":"parseUrl"},"deprecated":false,"digest":{"function_hash":"72386920695518486958926931446860896431","length":379},"id":"CVE-2026-25534-577406e9"},{"digest":{"line_hashes":["177336424904870422785598051068251037059","158779719107818137410251903812754202681","239601841638143627263152149990421540687","254510803377626493467755948421002123800","176182123182714028499412326340020624730","49947797888364388707369560062114168021","161959298490566292225770114137931193982","198443783190863733507868469993052894791","130104718210430920591935479199395778888","252069810326938709594182772565840159377","331906413988089563276028572441052113566","98549955987050945285040547448521309514","139198609232637803007103169158156981390","302967748261016692766055857411137700884","72167390943004449349090927905793668075","4301461011363862673460448250242955426","308518521370812998932044937098972495771","246574063406452126050359504615332986838","216582880448937514601857917271262735864","204530952105532819772867140959755470919","300722863782118550138443480050676080494","153032747715602201097563440254925442994","284183701585937100236371406524489182319","337456160877898232224469627764301084751","226522585949933473587514900210425391523"],"threshold":0.9},"id":"CVE-2026-25534-7d9b3a49","signature_type":"Line","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda","target":{"file":"orca/orca-core/src/main/java/com/netflix/spinnaker/orca/config/UserConfiguredUrlRestrictions.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"115212364326458723573752784234222964518","length":332},"id":"CVE-2026-25534-872f348e","signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda","target":{"function":"whiteListBlockEverythingElse","file":"clouddriver/clouddriver-artifacts/src/test/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictionsTest.java"}},{"deprecated":false,"digest":{"function_hash":"40616509189786148345835570122042840822","length":701},"id":"CVE-2026-25534-a150071a","signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda","target":{"file":"orca/orca-webhook/src/test/java/com/netflix/spinnaker/orca/webhook/service/WebhookServiceTest.java","function":"testAllowedRequestsEnabledTrueEmptyList"}},{"source":"https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda","target":{"file":"orca/orca-core/src/main/java/com/netflix/spinnaker/orca/config/UserConfiguredUrlRestrictions.java","function":"validateURI"},"deprecated":false,"digest":{"function_hash":"52196731729070405276620803374519782013","length":1743},"id":"CVE-2026-25534-bbb97ddc","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["107979023594343282281441406064351936796","252851546062109250033208986861630268719","233864363831881017138350398199728035750","89827098545719558868260964848886672804"]},"id":"CVE-2026-25534-c0ab5ef3","signature_type":"Line","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda","target":{"file":"orca/orca-webhook/src/test/java/com/netflix/spinnaker/orca/webhook/service/WebhookServiceTest.java"}},{"deprecated":false,"digest":{"function_hash":"294038700505827888609970456508682583407","length":330},"id":"CVE-2026-25534-ca063deb","signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda","target":{"file":"clouddriver/clouddriver-artifacts/src/test/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictionsTest.java","function":"blockVerbatimIpsWhenNoIpListSet"}},{"id":"CVE-2026-25534-d9bb36c4","signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda","target":{"file":"clouddriver/clouddriver-artifacts/src/test/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictionsTest.java","function":"blockIPRangesWhenResolved"},"deprecated":false,"digest":{"length":365,"function_hash":"4476119264004347952691299398860116259"}},{"id":"CVE-2026-25534-e2d10844","signature_type":"Line","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda","target":{"file":"clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictions.java"},"deprecated":false,"digest":{"line_hashes":["83451369729222138557619201624284463542","192399555383656982252344817811869313995","81782605671379599111062832649490136234","120783209613628269747741701517558745698","283685365528076572536273324301159277973","17780600188492479307069994295450445716","123243241025169855813053447650420850413","81349041736076297000612965899149519343","1829216867288174227715322565806729199","192214241487961044290057527326145850711","82162086494996905676713242887107297878","35360557724068323066348637174988707296","331906413988089563276028572441052113566","98549955987050945285040547448521309514","139198609232637803007103169158156981390","302967748261016692766055857411137700884","269240046452669955449195591663288096841","107192235173507727862946469267661931649","122386660261858170151572089145960157507","148283159293067777324028973883235715309","216582880448937514601857917271262735864","204530952105532819772867140959755470919","300722863782118550138443480050676080494","153032747715602201097563440254925442994","284183701585937100236371406524489182319","337456160877898232224469627764301084751","226522585949933473587514900210425391523","192820184092030641591259806526932067094","272522960556081095470986908111007400762","99396215138024259750933490858395247663","13755904606809976705114386580007263359","87524008008314803376393476245772202017"],"threshold":0.9}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L"}]}