Intel

CVE-2026-41041

apache-gravitino: Improper Handling of URL Encoding (Hex Encoding) (CVE-2026-41041)

criticalEPSS 0.6%

Affected

  • pypi/apache-gravitino 1.0.0..*
  • pypi/apache-gravitino 1.0.1..*
  • pypi/apache-gravitino 1.0.1rc1..*
  • pypi/apache-gravitino 1.0.1rc2..*
  • pypi/apache-gravitino 1.1.0..*
  • pypi/apache-gravitino 1.1.0rc0..*
  • pypi/apache-gravitino 1.1.0rc1..*
  • pypi/apache-gravitino 1.1.0rc2..*
  • pypi/apache-gravitino 1.1.0rc3..*
  • pypi/apache-gravitino 1.1.0rc4..*
  • pypi/apache-gravitino 1.1.1..*
  • pypi/apache-gravitino 1.1.1rc1..*
  • pypi/apache-gravitino 1.1.1rc3..*
  • pypi/apache-gravitino 1.1.1rc4..*
  • pypi/apache-gravitino 1.2.0..*
  • pypi/apache-gravitino 1.2.0.dev0..*
  • pypi/apache-gravitino 1.2.0rc1..*
  • pypi/apache-gravitino 1.2.0rc10..*
  • pypi/apache-gravitino 1.2.0rc11..*
  • pypi/apache-gravitino 1.2.0rc2..*
  • pypi/apache-gravitino 1.2.0rc4..*
  • pypi/apache-gravitino 1.2.0rc5..*
  • pypi/apache-gravitino 1.2.0rc6..*
  • pypi/apache-gravitino 1.2.0rc7..*
  • pypi/apache-gravitino 1.2.0rc8..*
  • pypi/apache-gravitino 1.2.0rc9..*
  • pypi/apache-gravitino 1.2.1rc1..*
  • pypi/apache-gravitino 1.2.1rc2..*

Description

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.

Source: OSV (Open Source Vulnerabilities)NVD (NIST)cvelistv5

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

pypiapache-gravitino
1.0.01.0.11.0.1rc11.0.1rc21.1.01.1.0rc01.1.0rc11.1.0rc21.1.0rc31.1.0rc41.1.11.1.1rc11.1.1rc31.1.1rc41.2.01.2.0.dev01.2.0rc11.2.0rc101.2.0rc111.2.0rc21.2.0rc41.2.0rc51.2.0rc61.2.0rc71.2.0rc81.2.0rc91.2.1rc11.2.1rc2

Metrics

XIEM Effective CVSS
9.1
Source: nvd-v3
EPSS percentile
47.0 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
critical
Priority score
85.22
Exploit maturity
no public PoC known
CVSS v3
9.1
EPSS score
0.6 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-07-13 10:16 UTC
CWE
CWE-177

Weakness classes (CWE)

  • CWE-177Variant

    Improper Handling of URL Encoding (Hex Encoding)

    The product does not properly handle when all or part of an input has been URL encoded.

    cwe.mitre.org →

References & sources

Linked advisories