CVE-2019-11405: OpenAPI Tools OpenAPI Generator HTTP Insecure Dependency Resolution
Summary
CVE-2019-11405: OpenAPI Tools OpenAPI Generator uses HTTP in various files. Affects org.openapitools:openapi-generator versions < 4.0.0-20190419.052012-560. Fixed in 4.0.0-20190419.052012-560. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenAPI Tools OpenAPI Generator is a Maven package that provides code generation capabilities for OpenAPI specifications. It allows developers to generate client libraries, server stubs, and documentation from OpenAPI definitions. This vulnerability affects versions before 4.0.0-20190419.052012-560. The package uses http:// URLs in various build.gradle, build.gradle.mustache, and build.sbt files, which can lead to insecurely resolved dependencies.
Vulnerability Detail
The vulnerability (CVE-2019-11405) arises from the use of insecure http:// URLs in the OpenAPI Generator package. This can result in the resolution of dependencies over an insecure channel, potentially leading to the inclusion of malicious or tampered code. Attackers may exploit this vulnerability to inject malicious code into the generated client libraries or server stubs, compromising the security and integrity of the application. The vulnerability has a CVSS score of 7.4 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
How To Fix
Latest published version: 7.26.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.0-20190419.052012-560
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The OpenAPI Tools OpenAPI Generator package before version 4.0.0-20190419.052012-560 is vulnerable to insecure dependency resolution due to the use of https://devnack.comcan lead to the inclusion of malicious or tampered code in the generated client libraries or server stubs. To mitigate this vulnerability, it is crucial to update to the recommended version and ensure the use of secure https://devnack.comependency resolution. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.openapitools:openapi-generator →
FAQ
OpenAPI Tools OpenAPI Generator is a Maven package that provides code generation capabilities for OpenAPI specifications. It allows developers to generate client libraries, server stubs, and documentation from OpenAPI definitions.
This vulnerability can result in the inclusion of malicious or tampered code in the generated client libraries or server stubs, compromising the security and integrity of the application.
To fix this vulnerability, update to version 4.0.0-20190419.052012-560 or later of the OpenAPI Generator package and ensure that the build.gradle, build.gradle.mustache, and build.sbt files use secure https:// URLs for dependency resolution.
No specific workaround has been mentioned for this vulnerability.
The CVSS score of this vulnerability is 7.4 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
References
Related vulnerabilities
Recent vulnerabilities recorded for org.openapitools:openapi-generator.
