Which versions of Java are affected by CVE-2026-4200?

A critical server-side request forgery vulnerability in glowxq-oj online judge platform allows unauthenticated remote attackers to manipulate server network requests, potentially enabling…. A patch is available.

Is there a public PoC exploit available for CVE-2026-4200?

Yes, a public proof-of-concept exploit is available for CVE-2026-4200. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4200?

Within 24 hours: Inventory all instances of glowxq-oj in your environment and immediately restrict network access to the application. Within 7 days: Implement WAF rules to block malicious uploadTestcaseZipUrl requests, disable the affected upload feature if operationally feasible, and segment the application from sensitive internal systems. Within 30 days: Evaluate alternative online judge platforms or conduct a comprehensive code review to develop an internal patch, establish vendor communication requirements, and implement monitoring for exploitation attempts.

Java CVE-2026-4200

Q: What is the CVSS score of CVE-2026-4200?

CVE-2026-4200 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12271 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-16 VulDB

Java SSRF Glowxq Oj Suse

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Severity Changed

Apr 22, 2026 - 21:37 NVD

HIGH MEDIUM

CVSS changed

Apr 22, 2026 - 21:37 NVD

7.3 (HIGH) 6.9 (MEDIUM)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 16, 2026 - 01:00 euvd

EUVD-2026-12271

Analysis Generated

Mar 16, 2026 - 01:00 vuln.today

CVE Published

Mar 16, 2026 - 00:02 nvd

HIGH 7.3

DescriptionCVE.org

A security flaw has been discovered in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This affects the function uploadTestcaseZipUrl of the file business/business-oj/src/main/java/com/glowxq/oj/problem/controller/ProblemCaseController.java. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Server-side request forgery in Glowxq OJ's test case upload functionality (ProblemCaseController.java) allows unauthenticated remote attackers to make arbitrary network requests from the affected server. Public exploit code is available and the vulnerability remains unpatched, with the vendor unresponsive to disclosure attempts.

Technical ContextAI

The vulnerability affects glowxq-oj (CPE: cpe:2.3:a:glowxq:glowxq-oj:*:*:*:*:*:*:*:*), a Java-based online judge platform used for competitive programming. The flaw is located in the ProblemCaseController.java file's uploadTestcaseZipUrl function, which appears to accept user-controlled URLs for fetching test case ZIP files without proper validation. This is a classic CWE-918 (Server-Side Request Forgery) issue where untrusted input is used to construct server-side requests, allowing attackers to probe internal networks, access cloud metadata endpoints, or bypass network security controls.

RemediationAI

No official patch is available as the vendor has not responded to the disclosure. Organizations should: 1) Update to a commit after 6f7c723090472057252040fd2bbbdaa1b5ed2393 if a fix has been silently deployed, 2) Implement input validation and URL allowlisting in the uploadTestcaseZipUrl function, 3) Deploy the application in a segmented network to limit SSRF impact, 4) Consider using a web application firewall to filter SSRF attempts, 5) Monitor for suspicious outbound requests from the application server. Review the POC at https://fx4tqqfvdw4.feishu.cn/docx/K0SjdZTPRo31LExSdlfcC3jwn1c?from=from_copylink to understand attack patterns.