CVE-2026-40942

{
  "id": "CVE-2026-40942",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-21T22:16:19.700",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. The OIDC token cache for the FHIR client connections used an inverted time comparison (isBefore instead of isAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired. This vulnerability is fixed in 2.1.0."
    },
    {
      "lang": "es",
      "value": "El Data Sharing Framework (DSF) implementa un motor de procesos distribuido basado en los estándares BPMN 2.0 y FHIR R4. Antes de la versión 2.1.0, las cachés de OIDC JWKS y del Documento de Metadatos utilizaban una comparación de tiempo invertida (isBefore en lugar de isAfter), lo que provocaba que la caché nunca devolviera valores almacenados en caché. Cada solicitud entrante activaba una nueva recuperación HTTP del Documento de Metadatos de OIDC y las claves JWKS del proveedor de OIDC. La caché de tokens de OIDC para las conexiones de cliente FHIR utilizaba una comparación de tiempo invertida (isBefore en lugar de isAfter), lo que provocaba que la caché nunca se invalidara. Cada solicitud entrante devolvía el mismo token de OIDC incluso si estaba caducado. Esta vulnerabilidad está corregida en la versión 2.1.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "datasharingframework",
          "product": "dsf",
          "versions": [
            {
              "version": "< 2.1.0",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "dev.dsf",
          "product": "dsf-bpe-process-api-v2",
          "versions": [
            {
              "version": "< 2.1.0",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "dev.dsf",
          "product": "dsf-bpe-server",
          "versions": [
            {
              "version": "< 2.1.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-22T17:52:51.070590Z",
          "id": "CVE-2026-40942",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-670"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/datasharingframework/dsf/commit/d3ca59b4daccde16a006fedeccce28fd1f826908",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/datasharingframework/dsf/security/advisories/GHSA-xmj9-7625-f634",
      "source": "[email protected]"
    }
  ]
}