CVE-2009-4269
apache derby: no CVSS score yet. EPSS 1.4% chance of exploitation in the next 30 days. Fixed in org.apache.derby:derby 10.6.1.0.
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
- CWE
- CWE-310
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:derby
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fh32-35w2-rxcc | Maven | org.apache.derby:derby | <10.6.1.0 | 10.6.1.0 |