CVE-2026-46718: Apache Calcite is Vulnerable to Use of Externally-Controlled Input to Select Classes

June 2, 2026 (updated July 9, 2026)

Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) vulnerability in Apache Calcite.

This issue affects Apache Calcite: from 1.5.0 before 1.42.

Users are recommended to upgrade to version 1.42, which fixes the issue.

References

github.com/advisories/GHSA-c2rv-hwqm-wjpg
github.com/apache/calcite/commit/5855cfa14d8038e2a123ff6ce9722edce0e0cc25
issues.apache.org/jira/browse/CALCITE-7532
lists.apache.org/thread/9s37svo343w5ck1ovh478lkzcqk4949v
nvd.nist.gov/vuln/detail/CVE-2026-46718

Code Behaviors & Features

Detect and mitigate CVE-2026-46718 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →