Skip to content
Fencer Vulns
medium 6.6

CVE-2023-26053 json

Gradle usage of long IDs for PGP keys opens potential for collision attacks

published 2023-03-02 3 y ago modified 2026-09-08 2 mo ago also BIT-gradle-2023-26053 , EUVD-2023-29930 , GHSA-c724-3xg7-g3hf

cvss
6.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits
0
none known

Summary

Gradle is a build tool with a focus on build automation and support for multi-language development. This is a collision attack on long IDs (64bits) for PGP keys. Users of dependency verification in Gradle are vulnerable if they use long IDs for PGP keys in a `trusted-key` or `pgp` element in their dependency verification metadata file. The fix is to fail dependency verification if anything but a fingerprint is used in a trust element in dependency verification metadata. The problem is fixed in Gradle 8.0 and above. The problem is also patched in Gradle 6.9.4 and 7.6.1. As a workaround, use only full fingerprint IDs for `trusted-key` or `pgp` element in the metadata is a protection against this issue.

Patch / fix

  • bitnami gradle 6.9.4, 7.6.1
  • gradle gradle 6.9.4, 7.6.1
  • gradle Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 7.6.1-r0

alpine advisories ALPINE-CVE-2023-26053

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-26053 updated cvss 6.6

gradle: usage of long IDs for PGP keys is unsafe and is subject to collision attacks

  • Red Hat JBoss Enterprise Application Platform 6 gradle gradle
    affected: workaround, no fix planned “Using only full fingerprint IDs for the trusted key or pgp element in the metadata is a protection against this issue.”
  • Red Hat JBoss Enterprise Application Platform 7 gradle gradle
    not affected: vulnerable code not present “Using only full fingerprint IDs for the trusted key or pgp element in the metadata is a protection against this issue.”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction

0.99% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami gradle
>=6.2.0, <6.9.4
>=7.0.0, <7.6.1
6.9.4
7.6.1

Affected products

  • gradle gradle

Classification

Weakness
  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.