Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly

{
  "id": "d13407316576fd4c5faf635c10ee43d782d5794f399eeffcafedc3cb99ca9f23",
  "url": "https://osv.dev/vulnerability/CLEANSTART-2026-UN16903",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly",
    "summary": "Security vulnerability affects the apache-nifi package. The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly.",
    "evidence": "osv:CLEANSTART-2026-UN16903",
    "products": [
      {
        "name": {
          "value": "apache-nifi",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.5.0-r1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "critical",
    "structured": {
      "id": "CLEANSTART-2026-UN16903",
      "aliases": [
        "CLEANSTART-2026-UN16903"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "2.5.0-r1"
                }
              ]
            }
          ],
          "package": {
            "name": "apache-nifi",
            "purl": "pkg:apk/cleanstart/apache-nifi",
            "ecosystem": "CleanStart"
          },
          "database_specific": {
            "source": "https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-UN16903.json"
          }
        }
      ],
      "modified": "2026-10-08T16:47:20.264775365Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-33117"
      ],
      "references": [
        "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-UN16903.json",
        "https://osv.dev/vulnerability/CVE-2026-33117",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-33117"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2026-33117",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 102378,
  "published_at": "2026-10-01T00:35:27.237+00:00"
}