What is GHSA-hf86-8x8v-h7vc?

GHSA-hf86-8x8v-h7vc is a security advisory published by GitHub Security Advisories with Medium severity. Apache EventMesh Vulnerable to Server-Side Request Forgery in WebhookUtil.java

Which CVE IDs does GHSA-hf86-8x8v-h7vc cover?

GHSA-hf86-8x8v-h7vc covers the following CVE IDs: CVE-2024-39954. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hf86-8x8v-h7vc?

GHSA-hf86-8x8v-h7vc has a CVSS v3 base score of 6.3, published by GitHub Security Advisories.

Which products are affected by GHSA-hf86-8x8v-h7vc?

GHSA-hf86-8x8v-h7vc affects 1 product, including: maven/org.apache.eventmesh:eventmesh-runtime:\u003e= 1.6.0-release, \u003c= 1.11.0-release.

GHSA-hf86-8x8v-h7vcMediumCVSS 6.3

Apache EventMesh Vulnerable to Server-Side Request Forgery in WebhookUtil.java

Vendor

GitHub Security Advisories

Published

August 20, 2025

Last Modified

August 20, 2025

🔗 CVE IDs covered (1)

CVE-2024-39954 →

📋 Description

Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch, which fixes this issue.

🎯 Affected products1

maven/org.apache.eventmesh:eventmesh-runtime:>= 1.6.0-release, <= 1.11.0-release

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2024-39954
https://lists.apache.org/thread/v6c96zygqx8xc2k3n2d59mgnm5txhkon
https://github.com/advisories/GHSA-hf86-8x8v-h7vc