Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
The Maven package com.facebook.presto:presto-jdbc, versions up to and including 0.283, is vulnerable to server-side request forgery. A malicious or attacker-controlled Presto server can return a nextUri pointing at an internal address, and the JDBC client will request it, which can expose internal responses or allow local port scanning. No fix is listed, so the source offers no patched version; limiting connections to trusted Presto servers is the practical mitigation.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.6 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 31 Oct 2026, 15:13 UTC First seen by agentprime
- 31 Oct 2026, 15:13 UTC Confirmed by OSV