CVE-2026-44088

Name of the Vulnerable Software and Affected Versions SzafirHost versions prior to 1.2.1

Description SzafirHost verifies the signature of downloaded JAR files using the JarInputStream class, which reads from the beginning of the file, but loads classes using the JarFile/URLClassLoader classes, which read the Central Directory from the end. This discrepancy allows an attacker to combine a genuine, signed JAR file with a malicious ZIP file, bypassing verification to achieve remote code execution.

Recommendations Update to version 1.2.1.