SB2026083174 - Multiple vulnerabilities in Bitbucket Data Center

Security Bulletin ID SB2026083174

CSH Severity

High

Patch available

YES

Number of vulnerabilities 12

Exploitation vector Remote access

Highest impact Denial of service

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 12 vulnerabilities.

1) Prototype pollution (CVE-ID: CVE-2026-67320)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improperly controlled modification of object prototype attributes in the Node.js HTTP adapter request path when processing interceptor-returned regular object configs with a polluted Object.prototype.proxy. A remote user can trigger prototype pollution elsewhere in the process and cause affected HTTP requests to be routed through an attacker-controlled proxy to disclose sensitive information.

Exploitation requires Node.js HTTP adapter usage and a request interceptor that returns a plain object copy of the request configuration. The confirmed disclosure impact is limited to plaintext HTTP requests and can expose authorization headers, request metadata, and request body content.

2) Resource exhaustion (CVE-ID: CVE-2026-59869)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the js-yaml parser when parsing YAML documents containing chained merge keys. A remote attacker can send a specially crafted YAML document to cause a denial of service.

The issue results in quadratic CPU consumption for input whose size grows only linearly.

3) Resource exhaustion (CVE-ID: CVE-2026-69152)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the expand() function when processing attacker-controlled brace patterns. A remote attacker can send a specially crafted input to cause a denial of service.

The issue can terminate the Node process with an uncatchable out-of-memory error or block the event loop for an extended period.

4) CRLF injection (CVE-ID: CVE-2026-12143)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to inject arbitrary data in server response.

The vulnerability exists due to insufficient validation of attacker-supplied data. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior.

5) Interpretation Conflict (CVE-ID: CVE-2026-18446)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass host-based policy checks and steer requests to an unintended destination.

The vulnerability exists due to interpretation conflict in the fast-uri URI parser when parsing references that use backslash-based authority introducers. A remote attacker can supply a specially crafted URL to bypass host-based policy checks and steer requests to an unintended destination.

The issue arises from inconsistent host extraction between fast-uri and Node's WHATWG URL handling for special schemes.

6) Memory leak (CVE-ID: CVE-2026-56819)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in Http2Decompressor.decompress(...) in DelegatingDecompressorFrameListener when processing HTTP/2 DATA frames for a stream whose decompressor channel has already been closed. A remote attacker can send specially crafted HTTP/2 DATA frames to cause a denial of service.

Only applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener are vulnerable.

7) Interpretation Conflict (CVE-ID: CVE-2026-16221)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass host-based policy checks and route requests to an unintended destination.

The vulnerability exists due to interpretation conflict in the fast-uri URL parser when parsing URLs containing a literal backslash in the authority section for special schemes. A remote attacker can supply a specially crafted URL to bypass host-based policy checks and route requests to an unintended destination.

This issue can occur when an application validates a URL with fast-uri and then passes the same input to Node's WHATWG URL parser or fetch-related consumers, which extract a different host from the same string.

8) Interpretation Conflict (CVE-ID: CVE-2026-13676)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to modify data on the system.

The vulnerability exists due to fast-uri fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. A remote attacker can trigger the vulnerability to modify data on the system.

9) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-13149)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in expand() when processing attacker-influenced brace expansion patterns containing consecutive non-expanding {} groups. A remote attacker can send a specially crafted input string to cause a denial of service.

The issue can block the calling thread for minutes or indefinitely with a small all-ASCII input, and applications using Node's single-threaded event loop may fully stall a worker or process.

10) Resource exhaustion (CVE-ID: CVE-2026-48779)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the WebSocket message handling logic when processing a high volume of exceptionally small fragments and data chunks. A remote attacker can send a large number of tiny fragmented messages to cause a denial of service.

The issue can lead to process termination due to out-of-memory conditions.

11) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-14257)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in expand() when processing attacker-influenced brace expansion patterns. A remote attacker can send a specially crafted input string to cause a denial of service.

The issue can terminate the Node process with an uncatchable out-of-memory error.

12) Incorrect Regular Expression (CVE-ID: CVE-2022-3517)

CWE-ID: CWE-185 - Incorrect Regular Expression

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

Remediation

Install update from vendor's website.

SB2026083174 - Multiple vulnerabilities in Bitbucket Data Center

Breakdown by Severity

Description

Remediation

References

Please verify you're human