CVE Intelligence

Dev.dsf Dsf-common-jetty vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Dev.dsf Dsf-common-jetty: 1 record(s), with affected versions and fixes.

CVE-2026-40939 Medium · 6.8 CWE-613 Apr 21, 2026
DSF: Missing Session Timeout for OIDC Sessions
The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired. This vulnerability is fixed in 2.1.0.