CVE-2019-11404

5.9 mediumEPSS 1.1%

arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by an MITM attack.

Severity

CVSS 3.0

5.9 medium

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
CWE: CWE-311
Published: 2019-04-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

arrow-kt:arrow

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-rcj2-vvjx-87pm	Maven	io.arrow-kt:arrow-ank-gradle	<0.9.0	0.9.0

References

https://github.com/arrow-kt/ank/issues/35
https://github.com/arrow-kt/ank/pull/36
https://github.com/arrow-kt/arrow/commit/74198dab522393487d5344f194dc21208ab71ae8
https://github.com/arrow-kt/arrow/issues/1310
https://github.com/arrow-kt/arrow/releases/tag/0.9.0

Check your stack JSON