GHSA-fh32-35w2-rxcc · Severity: medium · Ecosystem: maven — Use of Password Hash With Insufficient Computational Effort in Apache Derby
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
Conclusion & alert: CVE-2009-4269 is rated Low Risk (34.3/100): CVSS Low severity, with medium exploitation likelihood (EPSS 1.48%). Core evidence: EPSS rose +1.23% over the last day, indicating growing attacker interest. Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.25% | 1.48% | +1.23% |
| 2 | 2026-06-13 | 0.78% | 0.25% | -0.53% |
| 3 | 2025-07-02 | — | 0.78% | — |
Full EPSS history (11 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 2.1 | 2.0 | LOW |
|
3.9 | 2.9 | [email protected] |
GHSA-fh32-35w2-rxcc · Severity: medium · Ecosystem: maven — Use of Password Hash With Insufficient Computational Effort in Apache Derby
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
unimportant | CVE-2009-4269 unimportant priority: Debian including 1 source packages (derby), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2009-4269 |
ubuntu
|
medium | CVE-2009-4269 medium priority: Ubuntu including 1 source packages (sun-javadb), 30 status rows across 30 suites (artful, bionic, cosmic, dapper, disco, eoan, focal, groovy, hardy, hirsute, impish, jammy, jaunty, karmic, lucid, maverick, natty, oneiric, precise, quantal, raring, saucy, trusty, upstream, utopic, vivid, wily, xenial, yakkety, zesty): ignored 16, DNE 13, released 1. | https://ubuntu.com/security/CVE-2009-4269 |
: Per https://issues.apache.org/jira/browse/DERBY-4483, the reported version affected is 10.5.3.0. Unable to determine if affected versions exist between 10.5.3.0 and 10.6.1.0