GHSA-rx38-p542-v527

Facts

Severity

High · CVSS score 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected versions (altcha-lib)

>=2.0.0 <2.3.2As entered by the maintainer. Not reviewed.

Fixed in (altcha-lib)

2.3.2

Affected versions (altcha)

2.0.0As entered by the maintainer. Not reviewed.

Fixed in (altcha)

2.0.1

Package name (org.altcha/altcha)

org.altcha/altchaAs entered. Doesn’t look like a valid Maven package name, so scanners can’t match it. How to fix it

Affected versions (org.altcha/altcha)

>=2.0.0 <2.0.3As entered by the maintainer. Not reviewed.

Fixed in (org.altcha/altcha)

2.0.3

Affected versions (altcha)

<0.2.0As entered by the maintainer. Not reviewed.

Fixed in (altcha)

0.2.0

Affected versions (altcha)

>=2.0.0 <2.0.1As entered by the maintainer. Not reviewed.

Fixed in (altcha)

2.0.1

Affected versions (altcha_lib)

<0.3.1As entered by the maintainer. Not reviewed.

Fixed in (altcha_lib)

0.3.1

Affected versions (altcha)

>=2.0.0 <2.1.0As entered by the maintainer. Not reviewed.

Fixed in (altcha)

2.1.0

CVE

CVE-2026-119795 · reserved, record not publishedThe ID is public but empty: looking it up returns nothing. The CVE Program expects publication within 72 hours.

GitHub Advisory Database

Not reviewed

OSV.dev

Not present

Other CVEs pointing here

None found in the CVE List

Timeline

1. 2026-07-30 06:20 UTC

   Published by the maintainers

   Cites CVE-2026-119795

2. 2026-11-03 14:35 UTC

   Change recorded

   cites CVE-2026-119795 (was none)

3. 2026-10-28 07:18 UTC

   First seen by Limbowatch

   CVE still reserved · not reviewed · not in OSV

4. Waiting

   CVE record published

5. Waiting

   Reviewed by GitHub

6. Waiting

   In OSV; scanners can see it

Machine-readable record: feed/GHSA-rx38-p542-v527.json