CVE-2026-13502: Time-of-check Time-of-use in antlr ANTLR4
A flaw has been found in antlr ANTLR4 up to 4.13.2. This affects the function ObjectInputStream.readObject of the file antlr4-maven-plugin/src/main/java/org/antlr/mojo/antlr4/GrammarDependencies.java of the component Maven Plugin. This manipulation causes time-of-check time-of-use. The attack is restricted to local execution. A high degree of complexity is needed for the attack. It is indicated that the exploitability is difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AI Analysis
Technical Summary
A TOCTOU vulnerability was identified in antlr ANTLR4 Maven Plugin versions 4.13.0 through 4.13.2. The issue resides in the ObjectInputStream.readObject method in the GrammarDependencies.java source file. This flaw allows a race condition between the time a resource is checked and the time it is used, potentially leading to unexpected behavior or security issues. The attack requires local execution privileges and is complex to carry out. The vendor was contacted but did not provide any advisory or patch. No known exploits are currently in the wild.
Potential Impact
The vulnerability could allow an attacker with local access to exploit a race condition in the Maven Plugin component of ANTLR4, potentially leading to unintended behavior during object deserialization. Due to the high complexity and local access requirement, the practical impact is limited. The CVSS score of 2.0 reflects low severity and low exploitability.
Mitigation Recommendations
No official fix or patch is currently available for this vulnerability. Since the vendor has not responded and no remediation level is provided, users should monitor vendor channels for updates. Given the local access and complexity requirements, restricting local access to trusted users may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-13502: Time-of-check Time-of-use in antlr ANTLR4
Description
A flaw has been found in antlr ANTLR4 up to 4.13.2. This affects the function ObjectInputStream.readObject of the file antlr4-maven-plugin/src/main/java/org/antlr/mojo/antlr4/GrammarDependencies.java of the component Maven Plugin. This manipulation causes time-of-check time-of-use. The attack is restricted to local execution. A high degree of complexity is needed for the attack. It is indicated that the exploitability is difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0
Score 2.0low
Affected software
pkg:maven/org.antlr/antlr4-maven-plugincpe:2.3:a:antlr:antlr4:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
A TOCTOU vulnerability was identified in antlr ANTLR4 Maven Plugin versions 4.13.0 through 4.13.2. The issue resides in the ObjectInputStream.readObject method in the GrammarDependencies.java source file. This flaw allows a race condition between the time a resource is checked and the time it is used, potentially leading to unexpected behavior or security issues. The attack requires local execution privileges and is complex to carry out. The vendor was contacted but did not provide any advisory or patch. No known exploits are currently in the wild.
Potential Impact
The vulnerability could allow an attacker with local access to exploit a race condition in the Maven Plugin component of ANTLR4, potentially leading to unintended behavior during object deserialization. Due to the high complexity and local access requirement, the practical impact is limited. The CVSS score of 2.0 reflects low severity and low exploitability.
Mitigation Recommendations
No official fix or patch is currently available for this vulnerability. Since the vendor has not responded and no remediation level is provided, users should monitor vendor channels for updates. Given the local access and complexity requirements, restricting local access to trusted users may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-06-27T18:28:04.377Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a41387727e9c797191e0dcb
Added to database: 06/28/2026, 15:06:31 UTC
Last enriched: 07/05/2026, 23:24:45 UTC
Last updated: 08/12/2026, 12:41:08 UTC
Views: 123
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.