Skip to content
OpenAdvisories

Package · Debian

ognl

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 5.6
    CVE-2026-113730

    OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies

    OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Method, java.lang.reflect.C…

    orphan-oss ognl ognl ognl:ognl Debian Ubuntu Maven
  • High 8.8
    CVE-2025-53192

    Apache Commons OGNL: Expression Injection leading to RCE

    ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL. This issue affects Apache Commons OGNL: all versions. When using the API Ognl.getValue​, the OGNL engine parses and evaluates the pr…

    Apache Software Foundation Apache Commons OGNL ognl ognl Debian Ubuntu