[GHSA-c9ff-59g8-m36q] Add finder credit and affected Maven ranges (CVE-2026-84218)

[ByteHackr]

Adds a credits entry crediting Sandipan Roy (@ByteHackr) as FINDER for this advisory, and adds the CVE record JSON as a supporting WEB reference.

Public evidence supporting this credit:

• The CVE record published by the Red Hat CNA lists the credit: "This issue was discovered by Sandipan Roy (Red Hat)." — https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/84xxx/CVE-2026-84218.json
• Red Hat Bugzilla #2526752 (CVE-2026-84218) was created by Sandipan Roy (Bugzilla REST API creator field: "Sandipan Roy", account saroy)

The credits structure follows the OSV schema and the convention already used in this repository (e.g. merged PR #7190 and open PR #9446).

Per CONTRIBUTING.md this PR touches exactly one advisory.

[ByteHackr]

Thanks! Aside from the credit, would the curation team be able to consider this advisory for review (i.e., upgrade it from the NVD mirror entry to a reviewed advisory)? It affects a system/distro package (jolokia), so I understand ecosystem version-range mapping may be limited, but happy to help with any additional information (affected versions, fixed versions, references) that makes the review possible.

[ByteHackr]

Context for the added affected ranges, all verified against upstream sources:

Fix commit: 6ef036d78c3b40602f5e32352e97aed7c0fd5241 — "[Fixes #1049] Deny all target JMX URLs by default if not allowed ... Resolves CVE-2026-84218" — shipped in v2.6.2 (2026-09-02; compare v2.6.2...6ef036d confirms the commit is contained in the tag).

2.x range: org.jolokia:jolokia-service-jsr160 — the JSR-160 proxy handler moved to the reorganized org.jolokia.service.* modules in 2.0.0 (class Jsr160RequestHandler present at tags v2.0.0 through v2.6.1), fixed in 2.6.2.

1.x range: org.jolokia:jolokia-jsr160 — per upstream issue #1049, affected versions are all 1.x from 1.5.0 onward (the CVE-2018-1000130 denylist landed in 1.5.0; class Jsr160RequestDispatcher present at v1.5.0+). No fixed event is declared because no 1.x release contains the fix — only two commits reference #1049 and both are on the 2.x line (search: repo:jolokia/jolokia 1049). If/when a 1.x backport ships, this can be updated.

Happy to adjust if the curation team prefers a different range treatment.