{"id":"CVE-2026-55521","summary":"Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API","details":"Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read packet and event index metadata without ObjectPrivilegeType.ReadPacket, alter COP-1 link state without SystemPrivilege.ControlLinks, and manipulate simulation time. These operations can disclose telemetry metadata, disrupt telecommand handling, and affect system integrity and availability. This issue is fixed in versions 5.12.8 and 5.13.2.","aliases":["GHSA-962x-ccwf-8x6p"],"modified":"2026-09-10T08:13:51.629265Z","published":"2026-08-28T17:08:16.725Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55521.json"},"references":[{"type":"WEB","url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"},{"type":"WEB","url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55521.json"},{"type":"ADVISORY","url":"https://github.com/yamcs/yamcs/security/advisories/GHSA-962x-ccwf-8x6p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55521"},{"type":"FIX","url":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950"},{"type":"FIX","url":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/yamcs/yamcs","events":[{"introduced":"0"},{"introduced":"8bf5af6fe227bbf8ead15e60644b7ddbf345d623"},{"fixed":"144335f15d7730d7fc833122c8c8a6f1906fea9f"},{"fixed":"50d73a44d136f0dd2828fa11f69f1fe1fc5583f7"},{"fixed":"405139afa6094dfaf63ac17f32df1f808846c950"},{"fixed":"493563679f838b86f3cdc5da9451d4a050ff6bd9"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"5.12.8"},{"introduced":"5.13.0"},{"fixed":"5.13.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["yamcs-5.13.1","yamcs-5.13.0","yamcs-5.12.7","yamcs-5.12.6","yamcs-5.12.5","yamcs-5.12.4","yamcs-5.12.3","yamcs-5.12.2","yamcs-5.12.1","yamcs-5.12.0","yamcs-5.11.7","yamcs-5.9.8","yamcs-5.11.6","yamcs-5.11.5","yamcs-5.11.4","yamcs-5.10.9","yamcs-5.11.3","yamcs-5.11.2","yamcs-5.11.1","yamcs-5.11.0","yamcs-5.10.8","yamcs-5.10.7","yamcs-5.10.6","yamcs-5.10.5","yamcs-5.10.4","yamcs-5.10.3","yamcs-5.10.2","yamcs-5.10.1","yamcs-5.10.0","yamcs-5.9.7","yamcs-5.9.6","yamcs-5.9.5","yamcs-5.9.4","yamcs-5.9.3","yamcs-5.9.2","yamcs-5.9.1","yamcs-5.9.0","yamcs-5.8.8","yamcs-5.8.7","yamcs-5.8.6","yamcs-5.8.5","yamcs-5.8.4","yamcs-5.8.3","yamcs-5.8.2","yamcs-5.8.0","yamcs-5.8.1","yamcs-5.7.10","yamcs-5.7.9","yamcs-5.7.8","yamcs-5.7.7","yamcs-5.7.6","yamcs-5.7.5","yamcs-5.7.4","yamcs-5.7.3","yamcs-5.7.2","yamcs-5.7.1","yamcs-5.7.0","yamcs-5.6.2","yamcs-5.5.7","yamcs-5.6.1","yamcs-5.6.0","yamcs-5.5.6","before-removing-cfdp-half-implemented-features","yamcs-5.5.5","yamcs-5.5.4","yamcs-5.5.3","yamcs-5.5.2","yamcs-5.5.1","yamcs-5.5.0","yamcs-5.3.5","yamcs-5.4.3","yamcs-5.4.2","yamcs-5.4.1","yamcs-5.4.0","yamcs-5.2.0","yamcs-5.3.4","yamcs-5.3.3","yamcs-5.3.2","yamcs-5.3.1","yamcs-5.3.0","yamcs-5.1.3","yamcs-5.1.2","yamcs-5.1.1","yamcs-5.1.0","yamcs-5.0.1","yamcs-5.0.0","yamcs-4.10.9","yamcs-4.10.8","yamcs-4.10.7","yamcs-4.10.6","yamcs-4.10.5","yamcs-4.10.4","yamcs-4.10.3","yamcs-4.10.2","yamcs-4.10.1","yamcs-4.10.0","yamcs-4.9.5","yamcs-4.9.4","yamcs-4.9.3","yamcs-4.9.2","yamcs-4.9.1","yamcs-4.9.0","yamcs-4.8.1","yamcs-4.8.0","yamcs-4.7.3","yamcs-4.7.2","yamcs-4.7.1","yamcs-4.7","yamcs-4.4.2","yamcs-4.4.1","yamcs-4.4.0","yamcs-4.3.1","yamcs-4.3.0","yamcs-4.2.2","yamcs-4.2.1","yamcs-4.2.0","yamcs-4.1.2","yamcs-4.1.1","yamcs-4.0.1","yamcs-3.4.0","yamcs-3.3.0","yamcs-3.2.2","yamcs-3.2.1","yamcs-3.2.0","yamcs-3.1.2","yamcs-3.1.1","yamcs-3.1.0","yamcs-3.0.0","yamcs-0.30.0","v0.29.4","v0.29.3-20160608","v0.29.3","v0.29.1","v0.29.1-20160127","v0.29.1-20160119","v0.29.1-20151214","v0.29.0","v0.28.0","v0.28.0-20150903","v0.28.0-20150902-2","v0.28.0-20150902","v0.28.0-20150901","v0.28.0-20150828","v0.28.0-20150827","v0.28.0-20150826","v0.28.0-20150825","v0.28.0-20150824","v0.28.0-20150820","v0.28.0-20150817","v0.28.0-20150811","v0.26.1","v0.26.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55521.json","vanir_signatures_modified":"2026-09-10T08:13:51Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"256678232341584145832657375145726982562","length":374},"id":"CVE-2026-55521-0007923a","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/Cop1Api.java","function":"subscribeStatus"}},{"id":"CVE-2026-55521-006829ba","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/Cop1Api.java","function":"updateConfig"},"deprecated":false,"digest":{"function_hash":"318013355225756505785849639316361035221","length":419}},{"target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/TimeApi.java"},"deprecated":false,"digest":{"line_hashes":["217494707426018236633796011042047657178","263110481382822294163888331808418542114","145766403916561866010307277298571723022","289760243371545337020851388097740128967","233834851457567867314611680147634074866","300174103175179773775120182209022626883","103744893726023735322536235537419969241","315894182789701287267004558303408199468"],"threshold":0.9},"id":"CVE-2026-55521-08b79424","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950"},{"deprecated":false,"digest":{"function_hash":"239178683437952215383722662135328279418","length":666},"id":"CVE-2026-55521-0c1de60a","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/TimeApi.java","function":"setTime"}},{"target":{"file":"yamcs-core/src/main/java/org/yamcs/http/Context.java"},"deprecated":false,"digest":{"line_hashes":["326093146620628309184190926553579700560","203860683504522853158383103718360771141","225526618612943823468228301306086888750","317781330969650242438068620320872681250","307232766062078003792177685490068780358","222861890478148822772017465025058666497","155711642720986298984696951556404387382","268150217208565677499249371377930812924","326771635554379346645551524079217373442","208448000095911818943606758631359129806"],"threshold":0.9},"id":"CVE-2026-55521-14d16aff","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950"},{"digest":{"function_hash":"308943714927784274657041514356413997840","length":296},"id":"CVE-2026-55521-18fc4795","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/Cop1Api.java","function":"getStatus"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java"},"deprecated":false,"digest":{"line_hashes":["85958434038394528563344181650085846055","158688987495574600323983875701328941985","231154301970174706731944481270664339671","266916745956061533764258265263965249586","4158945476381044541135329930880875511","128606490670870139801504635562174178659","122314503174181283139610666311650620844","255616743236829478582752198241067261106","70545488931943364996014161293399773499","316852400895588511461235885774227015617","41040666088516687239297435767786572","209738508689678996408570884575321652585","289087166255870566863970651956636752454","211553914850075321171515604986237830248","105982174251518548446855850823543408224","9574138007486971819904185198175274912","134880637985031729349858063329718701727","165672902091525188512439215678169236312","183296555881439676700634001369297059292","237850039027289617047137407815168481149","27305099913936272426183450645447668910","279704822287365247400265699052876462573","208198054982911470477343629909180503565","167687983878510914233679818972023604948","27305099913936272426183450645447668910","117629709073873444354951322091384473723","173814211017416400240785821231462284736","99810023118725845327736451903821188542","27305099913936272426183450645447668910","260750181592891685411261301607888064355","161587881931363656739823561919743720359","81018129689286493679163161410319267785","149668971415869473377957683089570434536","297938414632415765568596869263561124165","11324826133482020053362256213301333907","315322485022635965768889897148235283126","123112276637563841323654167370473148497","59315627957748269820646429499728180994","42381455404471613856738748809768233586","200834467580205334341255552514712944904","247226742142209987540391568233995274700","237369909477411231567893228857660761391","45871515360904755954133223822380413042","16362803322123880461254121728825267090","303771871894690685459801723923825845059","105433891933277150531553132803580846245","15349156642457275583590104412837602410","177022236350506037620625974205310461391","303771871894690685459801723923825845059","174933053680022805488129281276639801551","15349156642457275583590104412837602410","177022236350506037620625974205310461391","303771871894690685459801723923825845059","288626791686530136462877684416609219934","253668867661639469663649726301499827571","273486289013706732150711998999800815232","188670550323041711915762328922068145115","15349156642457275583590104412837602410","177022236350506037620625974205310461391","303771871894690685459801723923825845059","53904743619302297311463399674259597828","135098545061939154493749306976457624767","190408632317642074256805027439105924973","279215675402807240436581750786814318513","70700014474972803401684881395264638811","10368908708918451169578365331002300758","299619517986706759739063838378712981284","242276464009932715109645715607874036958","50478759486994688757723562188314026029","37518676027863974855043063664101029437","267897333538597424719552976394783602597","334601523006607937437192161264988317779","130764277406805706539334953767854689033","13983862055543413452527385765211206842","43471605694494100482105301340991326582","165901723412265960078445649483063704314","126423098565169137071969984704425606361","4178387756353938201853900167240375766","111161521982082790973171276204377608150","234958193966964393138705595476516897246","179878996549674727367483478863868667220","61315585864312034549802872639564743024","20051706071915709279321410215807271565","159981007243839654926984806203853381270","211057381480928379446070494174276435276","269332665513608441141475458700448233815"],"threshold":0.9},"id":"CVE-2026-55521-1c782137","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"188981790689749400345352726949034726992","length":495},"id":"CVE-2026-55521-24b213c0","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"streamParameterIndex"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/Cop1Api.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["63183362450710022005258745665448631507","209291491018917633817671723125645369754","13959006469034614180939487799963533876","216295696563936250051371010904975778296","291927346179389058918819081750616455348","250444945123798412961252604256848165426","121516625930332653691489712890769394720","65775979566651764642798056237876809368","277743364856898200025969547403190073138","158804863649661880873077065940023169145","310057419436588784489321080480657997409","142650574560020884958353728399181811196","62022463999550772670676341686664098699","91774078921412191917658016667742846809","259082065530633763034820120959627298968","124762954697657362048964778543546874469","337019569598140141738852631843639013849","59040551946583474403724177299485928984","266116503762527527505472641821457245138","156402282813391561991752468557726299133","57219982514404875151363638443765666046","66127260336318957974268506289989535604","234677131590912823549051040457173050735","307035182295942644181200695778419644012","291384074859931167218753910289525774404","216044656177781993580264323995221296913","164130990044415507651151895046061515578","105811578591122612324787166303459980486","156601440129839791158887918477594841457","305773086910964270023592971275980315184","109693023165910472941312705948359993831","277941787798807096523258886073136096808","159233747170607152693997601102101875281","116424268372977386219490401444628378383","9846944602895686473288838386415007334","171794249795405356618495629914312829847"]},"id":"CVE-2026-55521-24f512ce"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/Cop1Api.java","function":"getConfig"},"deprecated":false,"digest":{"function_hash":"308943714927784274657041514356413997840","length":296},"id":"CVE-2026-55521-27329512"},{"digest":{"function_hash":"239178683437952215383722662135328279418","length":666},"id":"CVE-2026-55521-29621337","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/TimeApi.java","function":"setTime"},"deprecated":false},{"id":"CVE-2026-55521-30a299c9","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"processData"},"deprecated":false,"digest":{"function_hash":"3895295993623418271920920573324075393","length":758}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/Cop1Api.java","function":"initialize"},"deprecated":false,"digest":{"function_hash":"318299502737245097228455943056804484543","length":966},"id":"CVE-2026-55521-30c28160"},{"signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java"},"deprecated":false,"digest":{"line_hashes":["85958434038394528563344181650085846055","158688987495574600323983875701328941985","231154301970174706731944481270664339671","266916745956061533764258265263965249586","4158945476381044541135329930880875511","128606490670870139801504635562174178659","122314503174181283139610666311650620844","255616743236829478582752198241067261106","70545488931943364996014161293399773499","316852400895588511461235885774227015617","41040666088516687239297435767786572","209738508689678996408570884575321652585","289087166255870566863970651956636752454","211553914850075321171515604986237830248","105982174251518548446855850823543408224","9574138007486971819904185198175274912","134880637985031729349858063329718701727","165672902091525188512439215678169236312","183296555881439676700634001369297059292","237850039027289617047137407815168481149","27305099913936272426183450645447668910","279704822287365247400265699052876462573","208198054982911470477343629909180503565","167687983878510914233679818972023604948","27305099913936272426183450645447668910","117629709073873444354951322091384473723","173814211017416400240785821231462284736","99810023118725845327736451903821188542","27305099913936272426183450645447668910","260750181592891685411261301607888064355","161587881931363656739823561919743720359","81018129689286493679163161410319267785","149668971415869473377957683089570434536","297938414632415765568596869263561124165","11324826133482020053362256213301333907","315322485022635965768889897148235283126","123112276637563841323654167370473148497","59315627957748269820646429499728180994","42381455404471613856738748809768233586","200834467580205334341255552514712944904","247226742142209987540391568233995274700","237369909477411231567893228857660761391","45871515360904755954133223822380413042","16362803322123880461254121728825267090","303771871894690685459801723923825845059","105433891933277150531553132803580846245","15349156642457275583590104412837602410","177022236350506037620625974205310461391","303771871894690685459801723923825845059","174933053680022805488129281276639801551","15349156642457275583590104412837602410","177022236350506037620625974205310461391","303771871894690685459801723923825845059","288626791686530136462877684416609219934","253668867661639469663649726301499827571","273486289013706732150711998999800815232","188670550323041711915762328922068145115","15349156642457275583590104412837602410","177022236350506037620625974205310461391","303771871894690685459801723923825845059","53904743619302297311463399674259597828","135098545061939154493749306976457624767","190408632317642074256805027439105924973","279215675402807240436581750786814318513","70700014474972803401684881395264638811","10368908708918451169578365331002300758","299619517986706759739063838378712981284","242276464009932715109645715607874036958","50478759486994688757723562188314026029","37518676027863974855043063664101029437","267897333538597424719552976394783602597","334601523006607937437192161264988317779","130764277406805706539334953767854689033","13983862055543413452527385765211206842","43471605694494100482105301340991326582","165901723412265960078445649483063704314","126423098565169137071969984704425606361","4178387756353938201853900167240375766","111161521982082790973171276204377608150","234958193966964393138705595476516897246","179878996549674727367483478863868667220","61315585864312034549802872639564743024","20051706071915709279321410215807271565","159981007243839654926984806203853381270","211057381480928379446070494174276435276","269332665513608441141475458700448233815"],"threshold":0.9},"id":"CVE-2026-55521-3928b948","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"function":"streamPacketIndex","file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java"},"deprecated":false,"digest":{"length":662,"function_hash":"121518047440771252564524590279849705312"},"id":"CVE-2026-55521-3eda6d29"},{"deprecated":false,"digest":{"function_hash":"137307464599462396814067446221502932793","length":927},"id":"CVE-2026-55521-476924d8","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"listParameterIndex"}},{"target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"streamCompletenessIndex"},"deprecated":false,"digest":{"function_hash":"161428813668326256118078380729433782216","length":628},"id":"CVE-2026-55521-490504ad","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950"},{"digest":{"function_hash":"308943714927784274657041514356413997840","length":296},"id":"CVE-2026-55521-4a06d2bc","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"function":"getStatus","file":"yamcs-core/src/main/java/org/yamcs/http/api/Cop1Api.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/Cop1Api.java","function":"disable"},"deprecated":false,"digest":{"function_hash":"119230410581877566012476551612436721917","length":267},"id":"CVE-2026-55521-4f1ea76d"},{"deprecated":false,"digest":{"function_hash":"188981790689749400345352726949034726992","length":495},"id":"CVE-2026-55521-50a14fed","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"streamParameterIndex"}},{"digest":{"function_hash":"124915266874984090515751207278161896791","length":806},"id":"CVE-2026-55521-53bb00bc","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"listCompletenessIndex"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"138344606961977839575967576283609384188","length":924},"id":"CVE-2026-55521-548583a3","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"listPacketIndex"}},{"deprecated":false,"digest":{"function_hash":"188981790689749400345352726949034726992","length":495},"id":"CVE-2026-55521-5530d612","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"streamEventIndex"}},{"deprecated":false,"digest":{"function_hash":"3895295993623418271920920573324075393","length":758},"id":"CVE-2026-55521-58f8119a","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"processData"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"streamArchiveRecords"},"deprecated":false,"digest":{"function_hash":"142118826247659386981112482663991173957","length":480},"id":"CVE-2026-55521-5cf75850"},{"id":"CVE-2026-55521-6be53934","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/TimeApi.java"},"deprecated":false,"digest":{"line_hashes":["217494707426018236633796011042047657178","263110481382822294163888331808418542114","145766403916561866010307277298571723022","289760243371545337020851388097740128967","233834851457567867314611680147634074866","300174103175179773775120182209022626883","103744893726023735322536235537419969241","315894182789701287267004558303408199468"],"threshold":0.9}},{"source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"handleOneIndexResult"},"deprecated":false,"digest":{"length":1813,"function_hash":"68259023245178401897339405652017890832"},"id":"CVE-2026-55521-726a13e5","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/Cop1Api.java","function":"subscribeStatus"},"deprecated":false,"digest":{"function_hash":"256678232341584145832657375145726982562","length":374},"id":"CVE-2026-55521-72b84e7f"},{"digest":{"length":66,"function_hash":"148224259806278187661889906734805829443"},"id":"CVE-2026-55521-79fe097e","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"processData"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"188981790689749400345352726949034726992","length":495},"id":"CVE-2026-55521-7a85a815","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"streamCommandIndex"}},{"deprecated":false,"digest":{"function_hash":"68259023245178401897339405652017890832","length":1813},"id":"CVE-2026-55521-7b488c13","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"handleOneIndexResult"}},{"signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/security/User.java"},"deprecated":false,"digest":{"line_hashes":["32477719591852936801088451470681477751","46355426744148928508997197895930845744","20458405424424707327790458986793246673"],"threshold":0.9},"id":"CVE-2026-55521-7f3c467b","signature_type":"Line"},{"id":"CVE-2026-55521-811307bf","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/Cop1Api.java","function":"getConfig"},"deprecated":false,"digest":{"function_hash":"308943714927784274657041514356413997840","length":296}},{"deprecated":false,"digest":{"function_hash":"188981790689749400345352726949034726992","length":495},"id":"CVE-2026-55521-841dd74f","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"streamCommandIndex"}},{"id":"CVE-2026-55521-88e7d871","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"listParameterIndex"},"deprecated":false,"digest":{"function_hash":"137307464599462396814067446221502932793","length":927}},{"signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/Cop1Api.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["63183362450710022005258745665448631507","209291491018917633817671723125645369754","13959006469034614180939487799963533876","203385577816429615114031063599180441069","291927346179389058918819081750616455348","112804414112742800493388388260447547222","91911357188206928400063598557953120571","116373790226156299889732464630925562476","277743364856898200025969547403190073138","85448618101755469866355976809242270898","270334414749580296202790093706376992687","46947399710522290332576185489518300305","62022463999550772670676341686664098699","80089051845586317650715677711888724801","94959149074811480533188964879162226750","102781279357872290001652858921510048253","337019569598140141738852631843639013849","70975172429694796768826526601701599951","43288930340828328360592160380172315393","251428346393202165253946399283017684940","57219982514404875151363638443765666046","150602734357791430910495999655057076464","307678811063642327136573089117246085859","196586834019017216351310924144180472547","291384074859931167218753910289525774404","61209047637093327010876785365696037161","22005250828860822036574879484686578692","170919981343126593217808530697346404802","156601440129839791158887918477594841457","253515293243649134558995610874307860298","39319034656582566797714983771019284484","23205591797129132923109630875443825663","67771293691399776738221805709594703039","182547613451050845206773356426787665717","87378553734946621853494363943106370537","297746970169917073732116119015380774264","137744332335666152479961229418887087393"]},"id":"CVE-2026-55521-8e3a7ff4","signature_type":"Line"},{"digest":{"function_hash":"119230410581877566012476551612436721917","length":267},"id":"CVE-2026-55521-939b020b","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/Cop1Api.java","function":"disable"},"deprecated":false},{"target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"listCommandHistoryIndex"},"deprecated":false,"digest":{"function_hash":"138344606961977839575967576283609384188","length":924},"id":"CVE-2026-55521-9b71be02","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9"},{"digest":{"function_hash":"130506273712182713189806462108648010841","length":297},"id":"CVE-2026-55521-a619d88c","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/Cop1Api.java","function":"resume"},"deprecated":false},{"target":{"file":"yamcs-core/src/main/java/org/yamcs/security/SystemPrivilege.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["65232768616532693510571963992574542221","37407756089138095415827928790290141691","31766575364474218709386539601402612889"]},"id":"CVE-2026-55521-a8b1818e","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9"},{"source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"function":"resume","file":"yamcs-core/src/main/java/org/yamcs/http/api/Cop1Api.java"},"deprecated":false,"digest":{"function_hash":"130506273712182713189806462108648010841","length":297},"id":"CVE-2026-55521-be33ea2a","signature_type":"Function","signature_version":"v1"},{"target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/Cop1Api.java","function":"updateConfig"},"deprecated":false,"digest":{"length":419,"function_hash":"318013355225756505785849639316361035221"},"id":"CVE-2026-55521-c924231f","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9"},{"source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/Context.java"},"deprecated":false,"digest":{"line_hashes":["326093146620628309184190926553579700560","203860683504522853158383103718360771141","225526618612943823468228301306086888750","317781330969650242438068620320872681250","307232766062078003792177685490068780358","222861890478148822772017465025058666497","155711642720986298984696951556404387382","268150217208565677499249371377930812924","326771635554379346645551524079217373442","208448000095911818943606758631359129806"],"threshold":0.9},"id":"CVE-2026-55521-cac3fef2","signature_type":"Line","signature_version":"v1"},{"target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"listCompletenessIndex"},"deprecated":false,"digest":{"function_hash":"124915266874984090515751207278161896791","length":806},"id":"CVE-2026-55521-cdd61cf3","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950"},{"signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"listEventIndex"},"deprecated":false,"digest":{"function_hash":"297127285500686730263138255714544253541","length":928},"id":"CVE-2026-55521-cfdabfa0","signature_type":"Function"},{"digest":{"function_hash":"138344606961977839575967576283609384188","length":924},"id":"CVE-2026-55521-d394986c","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"listPacketIndex"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"142118826247659386981112482663991173957","length":480},"id":"CVE-2026-55521-d64ce236","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"streamArchiveRecords"}},{"signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/Cop1Api.java","function":"initialize"},"deprecated":false,"digest":{"function_hash":"318299502737245097228455943056804484543","length":966},"id":"CVE-2026-55521-d922d737","signature_type":"Function"},{"source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"streamPacketIndex"},"deprecated":false,"digest":{"function_hash":"121518047440771252564524590279849705312","length":662},"id":"CVE-2026-55521-dec13ae0","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-55521-e9ce4864","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/security/SystemPrivilege.java"},"deprecated":false,"digest":{"line_hashes":["65232768616532693510571963992574542221","37407756089138095415827928790290141691","31766575364474218709386539601402612889"],"threshold":0.9}},{"source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"processData"},"deprecated":false,"digest":{"function_hash":"148224259806278187661889906734805829443","length":66},"id":"CVE-2026-55521-eb179bb5","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9","target":{"function":"streamCompletenessIndex","file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java"},"deprecated":false,"digest":{"function_hash":"161428813668326256118078380729433782216","length":628},"id":"CVE-2026-55521-eb780b9b","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"streamEventIndex"},"deprecated":false,"digest":{"function_hash":"188981790689749400345352726949034726992","length":495},"id":"CVE-2026-55521-ebaff858"},{"source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"listEventIndex"},"deprecated":false,"digest":{"function_hash":"297127285500686730263138255714544253541","length":928},"id":"CVE-2026-55521-ed06ee48","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/IndexesApi.java","function":"listCommandHistoryIndex"},"deprecated":false,"digest":{"function_hash":"138344606961977839575967576283609384188","length":924},"id":"CVE-2026-55521-f88acc8c"},{"digest":{"line_hashes":["32477719591852936801088451470681477751","46355426744148928508997197895930845744","20458405424424707327790458986793246673"],"threshold":0.9},"id":"CVE-2026-55521-fbd17ad8","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950","target":{"file":"yamcs-core/src/main/java/org/yamcs/security/User.java"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}