CVE-2009-4269: Use of Password Hash With Insufficient Computational Effort in Apache Derby
Summary
CVE-2009-4269: Use of Password Hash With Insufficient Computational Effort in Apache Derby. Affects org.apache.derby:derby versions < 10.6.1.0. Fixed in 10.6.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Derby is an open-source relational database management system written in Java. It provides a lightweight, embedded database that can be easily integrated into Java applications. The BUILTIN authentication functionality in Apache Derby allows users to authenticate using a username and password. However, prior to version 10.6.1.0, the password hash generation algorithm used in Apache Derby performs a transformation that reduces the size of the input set to SHA-1. This reduction in the search space makes it easier for attackers to crack passwords by generating hash collisions.
Vulnerability Detail
The vulnerability in Apache Derby (CVE-2009-4269) arises from the use of a password hash generation algorithm that reduces the size of the input set to SHA-1. This reduction in the search space makes it easier for attackers to crack passwords by generating hash collisions. The vulnerability primarily affects the BUILTIN authentication functionality in Apache Derby. Local and possibly remote attackers can exploit this vulnerability to crack passwords and gain unauthorized access to the database. The vulnerability has a moderate severity rating and is classified under CWE-916.
How To Fix
Latest published version: 10.17.1.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.6.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed version of Apache Derby.
Conclusion
The vulnerability (CVE-2009-4269) in Apache Derby allows attackers to crack passwords and gain unauthorized access to the database. To mitigate this vulnerability, it is crucial to upgrade to Apache Derby version 10.6.1.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.derby:derby →
FAQ
Apache Derby is an open-source relational database management system written in Java. It provides a lightweight, embedded database that can be easily integrated into Java applications.
The BUILTIN authentication functionality in Apache Derby allows users to authenticate using a username and password.
This vulnerability makes it easier for attackers to crack passwords and gain unauthorized access to the database.
This vulnerability has a moderate severity rating.
To protect against this vulnerability, it is recommended to upgrade to Apache Derby version 10.6.1.0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.derby:derby.
