SB2026091636 - Multiple vulnerabilities in Bitbucket Data Center

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091636

SB2026091636 - Multiple vulnerabilities in Bitbucket Data Center

Published: September 16, 2026

Security Bulletin ID SB2026091636
CSH Severity
High
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 30% Medium 70%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 vulnerabilities.


1) Improper Authentication (CVE-ID: CVE-2026-21582)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 7.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform actions as another user.

The vulnerability exists due to broken authentication and session management in Jira Data Center when handling authentication and session management. A remote attacker can exploit the authentication and session management flaw to perform actions as another user.

User interaction is required.


2) Code Injection (CVE-ID: CVE-2026-4800)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper control of code generation in _.template when processing untrusted options.imports key names. A remote attacker can supply crafted imports key names to execute arbitrary code.

Code execution occurs at template compilation time. If Object.prototype has been polluted by another vector, inherited polluted keys can also be copied into the imports object and passed to Function().


3) Improper Handling of URL Encoding (Hex Encoding) (CVE-ID: CVE-2026-76172)

CWE-ID: CWE-177 - Improper Handling of URL Encoding (Hex Encoding)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass host validation and inject carriage return and line feed characters into output.

The vulnerability exists due to improper handling of url encoding in the scheme component normalization logic when normalizing or resolving untrusted URLs. A remote attacker can supply a specially crafted percent-encoded scheme to bypass host validation and inject carriage return and line feed characters into output.

Applications that treat a missing authority as same-origin during redirect checks, host allowlist enforcement, or outbound request decisions are particularly exposed.


4) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-75975)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass host-policy checks and perform server-side request forgery.

The vulnerability exists due to improper input validation in the IPv6 literal normalization logic of fast-uri when normalizing untrusted URLs containing malformed bracketed IPv6 literals. A remote attacker can supply a specially crafted URL to bypass host-policy checks and perform server-side request forgery.

Malformed bracketed IPv6 literals with invalid trailing text are silently truncated to different valid IPv6 addresses, and parse().error is not set for these inputs.


5) Double Decoding of the Same Data (CVE-ID: CVE-2026-75899)

CWE-ID: CWE-174 - Double Decoding of the Same Data

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform server-side request forgery.

The vulnerability exists due to double decoding of the same data in the fast-uri normalize() and resolve() hostname handling logic when processing a URI with a nested percent-encoded host. A remote attacker can supply a specially crafted URI to perform server-side request forgery.

The issue can cause the hostname to be interpreted as a different destination than the input appears to contain, including internal addresses such as loopback or a cloud metadata endpoint.


6) Integer overflow (CVE-ID: CVE-2026-73086)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to predict generated identifiers and bypass authentication.

The vulnerability exists due to integer overflow or wraparound in the nanoid(size) function when processing a user-controlled size parameter. A remote attacker can submit a size value of at least 2^31 to corrupt the process-wide CSPRNG pool and predict subsequently generated tokens.

The issue affects all consumers of nanoid in the same process until the process restarts or the pool offset wraps back to a positive value.


7) Incorrect Comparison (CVE-ID: CVE-2026-44249)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass IPv6 subnet access controls.

The vulnerability exists due to incorrect comparison in IpSubnetFilterRule.compareTo() when evaluating IPv6 subnet rules. A remote attacker can use a valid public IP address to bypass IPv6 subnet access controls.

The issue is caused by applying a bitwise AND operation to the configured networkAddress instead of the subnetMask.


8) Improper Certificate Validation (CVE-ID: CVE-2026-50010)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper certificate validation in X509TrustManagerWrapper within netty-handler when establishing client TLS connections with a user-supplied plain X509TrustManager. A remote attacker can present a certificate for an unexpected hostname to disclose sensitive information.

The issue occurs because hostname verification is not performed in this configuration, even when HTTPS endpoint identification is expected by default.


9) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-45416)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled memory allocation in SslClientHelloHandler.decode() when processing a TLS ClientHello that does not fit in the first record. A remote attacker can send a specially crafted ClientHello with a large handshake length to cause a denial of service.

The issue is exposed by the commonly used SniHandler and AbstractSniHandler constructors because they disable the client hello length guard and do not schedule a handshake timeout.


10) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-42583)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in io.netty.handler.codec.compression.Lz4FrameDecoder#decode when processing crafted LZ4 frames. A remote attacker can send a specially crafted compressed frame header and payload to cause a denial of service.

On the compressed path, header fields are trusted for sizing, allowing a small request to force allocation of a much larger ByteBuf.


Remediation

Install update from vendor's website.

References