Hi, Yeikel, As you have guessed, the CVE is referencing a new version that is still pending a release.
> On Jun 6, 2026, at 3:54 PM, Yeikel Santana <[email protected]> wrote: > > Hi all, > > Apologies if this has already been discussed, but I'm a bit confused about > CVE-2026-48589: > > https://nvd.nist.gov/vuln/detail/CVE-2026-48589 > > The advisory appears to reference a version 2.2.1, but I haven't been able to > find that version in Maven Central or any other package registry. From the > GitHub releases and repository activity, it looks like 2.2.0 is still the > latest released version. > > Am I missing something, or is the CVE referencing a version that is pending? > > Thanks >
