CVE-2026-55771
Description
CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 4.9.0, the EntityIdentifier.equals() has inverted null/self branches which could lead to incorrect equality comparisons. The EntityIdentifier.equals() method has inverted logic for null and self-reference checks, returning true for null comparisons and false for self-comparisons. This does not affect Cedar authorization decisions (computed in Rust from JSON), but could affect integrators who perform their own equality checks on entity identifiers. This issue has been fixed in version 4.9.0.
How to fix
- com.cedarpolicy:cedar-java2.3.6, 3.4.1, 4.9.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.cedarpolicy:cedar-javaMaven | v < 2.3.6, 3.1.2 ≤ v < 3.4.1, 4.0.0 ≤ v < 4.9.0 | 2.3.6, 3.4.1, 4.9.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.