SB2026083177 - Multiple vulnerabilities in Confluence Data Center

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026083177

SB2026083177 - Multiple vulnerabilities in Confluence Data Center

Published: August 31, 2026

Security Bulletin ID SB2026083177
CSH Severity
High
Patch available
YES
Number of vulnerabilities 14
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 14% Medium 86%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 14 vulnerabilities.


1) SQL injection (CVE-ID: CVE-2026-0603)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and manipulate or delete data.

The vulnerability exists due to sql injection in InlineIdsOrClauseBuilder when processing ID values containing unsanitized non-alphanumeric characters. A remote user can supply crafted input to disclose sensitive information and manipulate or delete data.

This is only exploitable if the user is able to set their own IDs, those IDs allow non-alphanumeric characters, and the application is using InlineIdsOrClauseBuilder.


2) Link following (CVE-ID: CVE-2026-29786)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to overwrite arbitrary files on the system.

The vulnerability exists due to insecure handling of hard links inside archives. A remote attacker can supply a specially crafted archive to the application that can overwrite arbitrary files on the system with privileges of the process performing data extraction. 


3) Uncontrolled recursion (CVE-ID: CVE-2026-27601)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to an uncontrolled recursion within the _.flatten() and _.isEqual() function. A remote attacker can pass specially crafted input to the application and perform a denial of service attack.


4) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-59873)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the Unpack stream in src/extract.ts when extracting crafted compressed tar archives. A remote attacker can send a specially crafted archive to cause a denial of service.

The issue can exhaust disk space and CPU through decompression and parsing of highly compressible input.


5) Infinite loop (CVE-ID: CVE-2026-59874)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to loop with an unreachable exit condition in tar.replace() when scanning an attacker-controlled existing archive. A remote attacker can supply a specially crafted tar archive with a negative base-256 encoded entry size to cause a denial of service.

Only applications that call the replace API on an existing attacker-controlled archive are affected; plain extraction-only workflows are not affected.


6) Type conversion (CVE-ID: CVE-2026-59871)

CWE-ID: CWE-704 - Type conversion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to incorrect type conversion or cast in the PAX header parser when parsing a crafted tar archive with an all-digit path value. A remote attacker can supply a specially crafted tar archive to cause a denial of service.

The crash occurs as an uncaught TypeError during extraction and bypasses application-level error handling, including error and warning handlers.


7) Resource exhaustion (CVE-ID: CVE-2021-44906)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.


8) Incorrect calculation (CVE-ID: CVE-2025-14813)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause cryptographic operations to fail.

The vulnerability exists due to improper implementation in G3413CTRBlockCipher when encrypting or decrypting more than 255 blocks. A remote attacker can supply data that exceeds this limit to cause cryptographic operations to fail.

The issue affects the GOST-R-3413-2015 CTR mode implementation because it uses a single-byte counter instead of a counter size aligned with the algorithm definition.


9) Path traversal (CVE-ID: CVE-2026-45623)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in lib/previous-map.js. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.


10) Inefficient regular expression complexity (CVE-ID: CVE-2026-48801)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in LinkifyIt.prototype.match when processing user-supplied text containing many fuzzy links or email-like strings. A remote attacker can send a specially crafted request body to cause a denial of service.

This affects services that synchronously render untrusted Markdown with linkification enabled on the request path, including transitive use through markdown-it with linkify:true.


11) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-59887)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in the mailto: schema validator scan loop when processing user-supplied text containing repeated mailto: sequences. A remote attacker can send specially crafted input to cause a denial of service.

The issue is reachable through the documented .test() and .match() API and through markdown rendering with linkification enabled.


12) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-42198)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in SCRAM-SHA-256 authentication handling when processing a server-supplied PBKDF2 iteration count. A remote attacker can send a specially crafted SCRAM server-first-message with a very large iteration count to cause a denial of service.

The issue is triggered only when the client uses SCRAM-SHA-256 authentication and reaches a malicious, compromised, or attacker-controlled PostgreSQL endpoint.


13) Improper Certificate Validation (CVE-ID: CVE-2026-53434)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to authenticate with an invalid certificate.

The vulnerability exists due to improper certificate revocation validation in the FFM Connector when handling connections with invalid CRL configuration. A remote attacker can present an invalid certificate to authenticate with an invalid certificate.

Only configurations using the FFM Connector with invalid CRLs are affected.


14) Input validation error (CVE-ID: CVE-2026-40983)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ObservationGrpcServerInterceptor when handling specially crafted gRPC requests. A remote attacker can send a specially crafted gRPC request to cause a denial of service.

The issue is exposed only when observations are recorded and metrics are output through DefaultMeterObservationHandler or a similarly behaving custom ObservationHandler.


Remediation

Install update from vendor's website.

References