SB2026091638 - Multiple vulnerabilities in Confluence Data Center

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091638

SB2026091638 - Multiple vulnerabilities in Confluence Data Center

Published: September 16, 2026

Security Bulletin ID SB2026091638
CSH Severity
High
Patch available
YES
Number of vulnerabilities 25
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 12% Medium 88%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 25 vulnerabilities.


1) Improper Certificate Validation (CVE-ID: CVE-2026-8763)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass name constraints validation.

The vulnerability exists due to improper certificate validation in name constraints processing when handling rfc822Name and URI values with a trailing dot. A remote attacker can supply a crafted identifier to bypass name constraints validation.


2) Uncontrolled Recursion (CVE-ID: CVE-2026-13506)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in the lazy ASN.1 sequence parser when forcing sequence evaluation that resets the nesting-depth guard. A remote attacker can supply crafted ASN.1 data to cause a denial of service.


3) Integer overflow (CVE-ID: CVE-2026-59879)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in List#set, List#setIn, List#updateIn, List#setSize, and the related functional set, setIn, and updateIn operations when processing a crafted index, size, or key-path segment in the range [2 ** 30, 2 ** 31). A remote attacker can send a specially crafted request to cause a denial of service.

A single small unauthenticated request can trigger an uncatchable infinite loop on an empty List or unbounded allocation leading to process abort on a populated List.


4) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-59880)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in Immutable.Map and Immutable.Set collision bucket handling when processing attacker-controlled object keys. A remote attacker can supply many crafted colliding keys to cause a denial of service.

Applications are affected when untrusted input is used as keys in Immutable structures rather than only as values under fixed keys.


5) Input validation error (CVE-ID: CVE-2026-59650)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to weaken Diffie-Hellman key agreement security.

The vulnerability exists due to improper input validation in MTI/A0 DH agreement when processing an unvalidated peer value. A remote attacker can supply a crafted peer value to weaken Diffie-Hellman key agreement security.


6) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-12816)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to forge message authentication codes.

The vulnerability exists due to improper cryptographic implementation in IESEngine stream-mode MAC processing when deriving keys through a length-dependent KDF split. A remote attacker can supply crafted input to forge message authentication codes.


7) Input validation error (CVE-ID: CVE-2026-59639)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass CMS signature presence checks.

The vulnerability exists due to improper input validation in CMS verifySignatures when processing SignedData with zero signers. A remote attacker can supply crafted SignedData to bypass CMS signature presence checks.


8) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-12803)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to forge authenticated ciphertexts across nonces.

The vulnerability exists due to improper cryptographic binding in KCCMBlockCipher MAC processing when AAD is absent. A remote attacker can craft data that exploits the missing nonce binding to forge authenticated ciphertexts across nonces.


9) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-58060)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled memory allocation in HSS public-key verification when processing an unbounded level count. A remote attacker can provide a crafted public key to cause a denial of service.


10) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-58059)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in X.500 distinguished name stringification when escaping strings with quadratic-time behavior. A remote attacker can supply crafted distinguished names to cause a denial of service.


11) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-14682)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled memory allocation in definite-length read processing when performing an unbounded up-front allocation. A remote attacker can supply crafted input with a large declared length to cause a denial of service.


12) Insufficient verification of data authenticity (CVE-ID: CVE-2026-59642)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to tamper with CMS AuthenticatedData content.

The vulnerability exists due to improper cryptographic binding in CMS AuthenticatedData processing when authAttrs are present. A remote attacker can supply crafted CMS data to tamper with CMS AuthenticatedData content.


13) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-45416)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled memory allocation in SslClientHelloHandler.decode() when processing a TLS ClientHello that does not fit in the first record. A remote attacker can send a specially crafted ClientHello with a large handshake length to cause a denial of service.

The issue is exposed by the commonly used SniHandler and AbstractSniHandler constructors because they disable the client hello length guard and do not schedule a handshake timeout.


14) Insufficient verification of data authenticity (CVE-ID: CVE-2026-12802)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to tamper with decrypted data.

The vulnerability exists due to improper authentication tag validation in CMS AuthEnvelopedData decryption when processing encrypted data with an invalid tag length. A remote attacker can supply crafted encrypted content to tamper with decrypted data.


15) Insufficient verification of data authenticity (CVE-ID: CVE-2026-47691)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to poison the DNS cache.

The vulnerability exists due to insufficient verification of data authenticity in the DnsResolveContext.AuthoritativeNameServerList handling of NS records when processing DNS responses containing NS records in the AUTHORITY section and A records in the ADDITIONAL section. A remote attacker can provide crafted DNS records to poison the DNS cache.

Exploitation requires control of an authoritative name server for a subdomain, and the poisoned cache can affect future resolutions under the parent domain.


16) Insufficient verification of data authenticity (CVE-ID: CVE-2026-45674)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to poison the DNS cache.

The vulnerability exists due to insufficient verification of data authenticity in DnsResolveContext buildAliasMap when processing CNAME records in DNS responses. A remote attacker can send a malicious DNS response containing out-of-bailiwick CNAME records to poison the DNS cache.

Any application using Netty's DNS resolver is impacted.


17) Improper Certificate Validation (CVE-ID: CVE-2026-50010)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper certificate validation in X509TrustManagerWrapper within netty-handler when establishing client TLS connections with a user-supplied plain X509TrustManager. A remote attacker can present a certificate for an unexpected hostname to disclose sensitive information.

The issue occurs because hostname verification is not performed in this configuration, even when HTTPS endpoint identification is expected by default.


18) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-48043)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a reference-count leak in DelegatingDecompressorFrameListener when processing HTTP/2 frames that cause the flow-controller to throw. A remote attacker can send crafted frames to cause a denial of service.

The issue may exhaust memory and eventually take down the JVM due to an out-of-memory error.


19) Incorrect Comparison (CVE-ID: CVE-2026-44249)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass IPv6 subnet access controls.

The vulnerability exists due to incorrect comparison in IpSubnetFilterRule.compareTo() when evaluating IPv6 subnet rules. A remote attacker can use a valid public IP address to bypass IPv6 subnet access controls.

The issue is caused by applying a bitwise AND operation to the configured networkAddress instead of the subnetMask.


20) Resource exhaustion (CVE-ID: CVE-2026-55831)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in DefaultSpdySettingsFrame settings map handling when processing a crafted SPDY/3.1 SETTINGS frame. A remote attacker can send a specially crafted SETTINGS frame to cause a denial of service.

Exploitation requires the target to accept SPDY/3.1 traffic through a Netty pipeline containing SpdyFrameCodec.


21) Input validation error (CVE-ID: CVE-2026-55833)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the SPDY header decoder in SpdyFrameCodec when processing zlib-compressed SPDY header blocks after maxHeaderSize truncation. A remote attacker can send a specially crafted HEADERS frame to cause a denial of service.

Exploitation requires a reachable SPDY pipeline using SpdyFrameCodec and a decoder path that selects the zlib decoder.


22) Infinite loop (CVE-ID: CVE-2026-59901)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in Bzip2BlockDecompressor.read() when parsing a malformed bzip2 stream. A remote attacker can send a specially crafted compressed stream to cause a denial of service.

The issue can permanently capture the event-loop thread in an infinite loop.


23) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-56745)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in the SpdyHttpDecoder handler when processing a client-initiated SYN_STREAM frame followed by an RST_STREAM frame or oversized content. A remote attacker can send crafted SPDY frames to cause a denial of service.

The issue leaks a pooled ByteBuf by removing the partially constructed FullHttpRequest from an internal map without releasing the underlying buffer.


24) Memory leak (CVE-ID: CVE-2026-56819)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in Http2Decompressor.decompress(...) in DelegatingDecompressorFrameListener when processing HTTP/2 DATA frames for a stream whose decompressor channel has already been closed. A remote attacker can send specially crafted HTTP/2 DATA frames to cause a denial of service.

Only applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener are vulnerable.


25) Resource exhaustion (CVE-ID: CVE-2026-73507)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in XmlFrameDecoder. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Remediation

Install update from vendor's website.

References