The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on modules coordinates, like the organisation, name or version. If one of the coordinates contains "../" sequences - which are valid characters for Ivy coordinates in general- it is possible to break out of the configured "buildRoot" directory where other files can be overwritten. In order to exploit this vulnerability an attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have such "../" sequences. Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3207 advisory.

    The PackagerResolver of Apache Ivy is able to download onlineartifacts and to (re)package them in a format     defined by apackager.xml file. This repackaging is done by an Ant script, which isstored in a subdirectory     of the configured buildRoot directory. Thissubdirectory is calculated based on modules coordinates, like     theorganisation, name or version.

    If one of the coordinates contains ../ sequences - which are validcharacters for Ivy coordinates in     general- it is possible to break outof the configured buildRoot directory where other files can     beoverwritten.

    In order to exploit this vulnerability an attacker needs to haveaccess to a packager repository and add or     modify the coordinates inivy.xml files to have such ../ sequences.

    Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0. (CVE-2026-26032)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of apache-ivy installed on the remote host is prior to 2.3.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3993 advisory.

    The PackagerResolver of Apache Ivy is able to download onlineartifacts and to (re)package them in a format     defined by apackager.xml file. This repackaging is done by an Ant script, which isstored in a subdirectory     of the configured buildRoot directory. Thissubdirectory is calculated based on modules coordinates, like     theorganisation, name or version.

    If one of the coordinates contains ../ sequences - which are validcharacters for Ivy coordinates in     general- it is possible to break outof the configured buildRoot directory where other files can     beoverwritten.

    In order to exploit this vulnerability an attacker needs to haveaccess to a packager repository and add or     modify the coordinates inivy.xml files to have such ../ sequences.

    Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0. (CVE-2026-26032)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d0535bed52 advisory.


    IMPROVEMENT: ivy:retrieve and the 'post resolve tasks' now support the override child element. (IVY-1664)

    IMPROVEMENT: ivy:makepom will now add override elements of the ivy.xml to the dependencyManagement section     of the generated pom. (IVY-1663) (Thanks to Eric Milles)

    IMPROVEMENT: ivy:deliver and ivy:publish now writes inherited dependencies first to preserve resolve order     (IVY-1656) (Thanks to Eric Milles)

    IMPROVEMENT: ModuleRevisionId.encodeToString now returns a deterministic string that doesnt rely on a     implmentation of HashMap (Thanks to Arnout Engelen)

    FIX: improved Maven dependencyManagement matching for dependencies with a non-default type or classifier     (IVY-1654) (Thanks to Mark Kittisopikul)

    FIX: the ivy:retrieve task failed when the retrieve pattern contained some text in parentheses before the     first token, for instance: /jobs/lib (JDK 17)/[artifact].[ext] (IVY-1660)

    FIX: when the ivy:deliver task is configured to replace dynamic revisions, it now replaces these revisions     to the resolved revision before any conflict resolution was done, which was the original behavior before     Ivy 2.3.0. This way, the delivered ivy.xml can be used to have reproducible dependency resolution,     especially when multiple configurations are used. It also fixes issues where the dynamic revisions were     replaced by versions from other configurations. (IVY-1485, IVY-1661)

    FIX: the ivy:deliver task didnt replace dynamic revision from inherited dependencies. (IVY-1410)     (Thanks to Eric Milles)

    FIX: the ivy:install task didnt take the from resolver into account when resolving Maven parent modules     or source/javadoc artifacts. (Thanks to Colin Chambers)

    FIX: the ivy:checkdepsupdate task could suggest a lesser version as update. (IVY-1665) (Thanks to Eric     Milles)

    FIX: the ivy:makepom task no longer adds a dependency to the <dependencyManagement> section. (IVY-1667)     (Thanks to Eric Milles)

    FIX: the ivy:deliver task didnt include XML namespaces from a parent ivy module when merging the     descriptors. (IVY-1658) (Thanks to Eric Milles)

    FIX: the ivy:checkdepsupdate task no longer shows evicted versions. (IVY-1662) (Thanks to Eric Milles)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c02768c662 advisory.


    IMPROVEMENT: ivy:retrieve and the 'post resolve tasks' now support the override child element. (IVY-1664)

    IMPROVEMENT: ivy:makepom will now add override elements of the ivy.xml to the dependencyManagement section     of the generated pom. (IVY-1663) (Thanks to Eric Milles)

    IMPROVEMENT: ivy:deliver and ivy:publish now writes inherited dependencies first to preserve resolve order     (IVY-1656) (Thanks to Eric Milles)

    IMPROVEMENT: ModuleRevisionId.encodeToString now returns a deterministic string that doesnt rely on a     implmentation of HashMap (Thanks to Arnout Engelen)

    FIX: improved Maven dependencyManagement matching for dependencies with a non-default type or classifier     (IVY-1654) (Thanks to Mark Kittisopikul)

    FIX: the ivy:retrieve task failed when the retrieve pattern contained some text in parentheses before the     first token, for instance: /jobs/lib (JDK 17)/[artifact].[ext] (IVY-1660)

    FIX: when the ivy:deliver task is configured to replace dynamic revisions, it now replaces these revisions     to the resolved revision before any conflict resolution was done, which was the original behavior before     Ivy 2.3.0. This way, the delivered ivy.xml can be used to have reproducible dependency resolution,     especially when multiple configurations are used. It also fixes issues where the dynamic revisions were     replaced by versions from other configurations. (IVY-1485, IVY-1661)

    FIX: the ivy:deliver task didnt replace dynamic revision from inherited dependencies. (IVY-1410)     (Thanks to Eric Milles)

    FIX: the ivy:install task didnt take the from resolver into account when resolving Maven parent modules     or source/javadoc artifacts. (Thanks to Colin Chambers)

    FIX: the ivy:checkdepsupdate task could suggest a lesser version as update. (IVY-1665) (Thanks to Eric     Milles)

    FIX: the ivy:makepom task no longer adds a dependency to the <dependencyManagement> section. (IVY-1667)     (Thanks to Eric Milles)

    FIX: the ivy:deliver task didnt include XML namespaces from a parent ivy module when merging the     descriptors. (IVY-1658) (Thanks to Eric Milles)

    FIX: the ivy:checkdepsupdate task no longer shows evicted versions. (IVY-1662) (Thanks to Eric Milles)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22858-1 advisory.

    This update for apache-ivy fixes the following issue:

    - CVE-2026-26032: directory traversal sequences in module coordinates can allow overwriting arbitrary     files outside       the configured buildRoot directory (bsc#1271727).

    Changes for apache-ivy:

    - Upgrade to 2.6.0:

     - the ivy:retrieve task failed when the retrieve pattern      contained some text in parentheses before the first token, for      instance: /jobs/lib (JDK 17)/[artifact].[ext] (IVY-1660)      + when the ivy:deliver task is configured to replace dynamic      revisions, it now replaces these revisions to the resolved      revision before any conflict resolution was done, which was      the original behavior before Ivy 2.3.0. This way, the      delivered ivy.xml can be used to have reproducible dependency      resolution, especially when multiple configurations are used.
     It also fixes issues where the dynamic revisions were replaced      by versions from other configurations. (IVY-1485, IVY-1661)      + the ivy:deliver task didn't replace dynamic revision from      inherited dependencies. (IVY-1410)      + the ivy:install task didn't take the from resolver into      account when resolving Maven parent modules or      source/javadoc artifacts.
     + the ivy:checkdepsupdate task could suggest a lesser version as      update. (IVY-1665)      + the ivy:makepom task no longer adds a dependency to the      dependencyManagement section. (IVY-1667)      + the ivy:deliver task didn't include XML namespaces from a      parent ivy module when merging the descriptors. (IVY-1658)      + the ivy:checkdepsupdate task no longer shows evicted versions.
     (IVY-1662)
     * Improvements      + use Apache Commons Compress for pack200 handling to avoid      issues on Java 14 and later. If pack200 is needed, make sure      to add Apache Commons Compress to your classpath. (IVY-1652)      + ivy:retrieve and the 'post resolve tasks' now support the      override child element. (IVY-1664)      + ivy:makepom will now add override elements of the ivy.xml to      the dependencyManagement section of the generated pom.
     (IVY-1663)      + ivy:deliver and ivy:publish now writes inherited dependencies      first to preserve resolve order (IVY-1656)      + ModuleRevisionId.encodeToString now returns a deterministic      string that doesn't rely on a implmentation of HashMap
     * New feature      + added a new nearest conflict manager, which handles conflicts      in the same way that Maven does. (IVY-813)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21424-1 advisory.

    This update for apache-ivy fixes the following issue:

    - CVE-2026-26032: directory traversal sequences in module coordinates can allow overwriting arbitrary     files outside       the configured buildRoot directory (bsc#1271727).

    Changes for apache-ivy:

    - Upgrade to 2.6.0:

     - the ivy:retrieve task failed when the retrieve pattern      contained some text in parentheses before the first token, for      instance: /jobs/lib (JDK 17)/[artifact].[ext] (IVY-1660)      + when the ivy:deliver task is configured to replace dynamic      revisions, it now replaces these revisions to the resolved      revision before any conflict resolution was done, which was      the original behavior before Ivy 2.3.0. This way, the      delivered ivy.xml can be used to have reproducible dependency      resolution, especially when multiple configurations are used.
     It also fixes issues where the dynamic revisions were replaced      by versions from other configurations. (IVY-1485, IVY-1661)      + the ivy:deliver task didn't replace dynamic revision from      inherited dependencies. (IVY-1410)      + the ivy:install task didn't take the from resolver into      account when resolving Maven parent modules or      source/javadoc artifacts.
     + the ivy:checkdepsupdate task could suggest a lesser version as      update. (IVY-1665)      + the ivy:makepom task no longer adds a dependency to the      dependencyManagement section. (IVY-1667)      + the ivy:deliver task didn't include XML namespaces from a      parent ivy module when merging the descriptors. (IVY-1658)      + the ivy:checkdepsupdate task no longer shows evicted versions.
     (IVY-1662)
     * Improvements      + use Apache Commons Compress for pack200 handling to avoid      issues on Java 14 and later. If pack200 is needed, make sure      to add Apache Commons Compress to your classpath. (IVY-1652)      + ivy:retrieve and the 'post resolve tasks' now support the      override child element. (IVY-1664)      + ivy:makepom will now add override elements of the ivy.xml to      the dependencyManagement section of the generated pom.
     (IVY-1663)      + ivy:deliver and ivy:publish now writes inherited dependencies      first to preserve resolve order (IVY-1656)      + ModuleRevisionId.encodeToString now returns a deterministic      string that doesn't rely on a implmentation of HashMap
     * New feature      + added a new nearest conflict manager, which handles conflicts      in the same way that Maven does. (IVY-813)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3225-1 advisory.

    This update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni fixes the following issue

    Security issues fixed:

    - CVE-2026-26032: improper pathname limitation in `PackagerResolver` allows for arbitrary files writes     outside of the       configured `buildRoot` directory (bsc#1271727).

    Other updates and bugfixes:

    - Update `apache-commons-compress` to 1.28.0.
    - Update `apache-ivy` to 2.6.0.
    - Include `brotli-java` and update to 1.2.0.
    - Include `zstd-jni` and update to v1.5.7.11.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a     format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a     subdirectory of the configured buildRoot directory. This subdirectory is calculated based on modules     coordinates, like the organisation, name or version. If one of the coordinates contains ../ sequences -     which are valid characters for Ivy coordinates in general- it is possible to break out of the configured     buildRoot directory where other files can be overwritten. In order to exploit this vulnerability an     attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files     to have such ../ sequences. Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.
    (CVE-2026-26032)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365294	Amazon Linux 2023 : apache-ivy, apache-ivy-javadoc (ALAS2023-2026-3207)	Nessus	Amazon Linux Local Security Checks	Local	medium
365192	Amazon Linux 2 : apache-ivy (ALAS-2026-3993)	Nessus	Amazon Linux Local Security Checks	Local	medium
341826	Fedora 43 : apache-ivy (2026-d0535bed52)	Nessus	Fedora Local Security Checks	Local	medium
341825	Fedora 44 : apache-ivy (2026-c02768c662)	Nessus	Fedora Local Security Checks	Local	medium
330292	SUSE SLES16 Security Update : apache-ivy (SUSE-SU-2026:22858-1)	Nessus	SuSE Local Security Checks	Local	medium
329716	openSUSE 16 Security Update : apache-ivy (openSUSE-SU-2026:21424-1)	Nessus	SuSE Local Security Checks	Local	medium
329502	SUSE SLED15 / SLES15 Security Update : apache-commons-compress, apache-ivy, brotli-java, zstd-jni (SUSE-SU-2026:3225-1)	Nessus	SuSE Local Security Checks	Local	medium
327359	Linux Distros Unpatched Vulnerability : CVE-2026-26032	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-26032

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium