Greetings, mail2spam@gmx.net! Since Cygwin(as a library/wrapper layer) is not packaging or in any other way providing Java code, no. As a software distribution platform, there are 33 packages that contain .jar files: https://cygwin.com/cgi-bin2/package-grep.cgi?grep=%5C.jar%24&arch=x86_64 What they are doing and if they are susceptible to the exploit - a question to the relevant package author(s). -- With best regards, Andrey Repin Wednesday, January 26, 2022 20:20:45 Sorry for my terrible english...