Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and would not cause a repository to be disabled. If a build encountered one of these exceptions, Gradle would continue to the next repository in the list and potentially resolve dependencies from a different repository. If a Gradle build used an unresolvable host name, Gradle would continue to work as long as all dependencies could be resolved from another repository. An unresolvable host name could be caused by allowing a repository's domain name registration to lapse or typo-ing the real domain name. This behavior could allow an attacker to register a service under the host name used by the build and serve malicious artifacts. The attack requires the repository to be listed before others in the build configuration. Gradle has introduced a change in behavior in Gradle 9.3.0 to stop searching other repositories when encountering these errors.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs.
    When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and
    would not cause a repository to be disabled. If a build encountered one of these exceptions, Gradle would
    continue to the next repository in the list and potentially resolve dependencies from a different
    repository. If a Gradle build used an unresolvable host name, Gradle would continue to work as long as all
    dependencies could be resolved from another repository. An unresolvable host name could be caused by
    allowing a repository's domain name registration to lapse or typo-ing the real domain name. This behavior
    could allow an attacker to register a service under the host name used by the build and serve malicious
    artifacts. The attack requires the repository to be listed before others in the build configuration.
    Gradle has introduced a change in behavior in Gradle 9.3.0 to stop searching other repositories when
    encountering these errors. (CVE-2026-22816)

  - Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs.
    When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and
    would not cause a repository to be disabled. If a build encountered one of these exceptions, Gradle would
    continue to the next repository in the list and potentially resolve dependencies from a different
    repository. An exception like NoHttpResponseException can indicate transient errors. If the errors persist
    after a maximum number of retries, Gradle would continue to the next repository. This behavior could allow
    an attacker to disrupt the service of a repository and leverage another repository to serve malicious
    artifacts. This attack requires the attacker to have control over a repository after the disrupted
    repository. Gradle has introduced a change in behavior in Gradle 9.3.0 to stop searching other
    repositories when encountering these errors. (CVE-2026-22865)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs.
    When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and     would not cause a repository to be disabled. If a build encountered one of these exceptions, Gradle would     continue to the next repository in the list and potentially resolve dependencies from a different     repository. If a Gradle build used an unresolvable host name, Gradle would continue to work as long as all     dependencies could be resolved from another repository. An unresolvable host name could be caused by     allowing a repository's domain name registration to lapse or typo-ing the real domain name. This behavior     could allow an attacker to register a service under the host name used by the build and serve malicious     artifacts. The attack requires the repository to be listed before others in the build configuration.
    Gradle has introduced a change in behavior in Gradle 9.3.0 to stop searching other repositories when     encountering these errors. (CVE-2026-22816)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
441026	Alpine: gradle: security update to 8.14.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
441026	Alpine: gradle: security update to 8.14.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
291294	Linux Distros Unpatched Vulnerability : CVE-2026-22816	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-22816

high

Tenable Plugins

high

high

high