SB2026091639 - Multiple vulnerabilities in Crucible Data Center and Crucible Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091639

SB2026091639 - Multiple vulnerabilities in Crucible Data Center and Crucible Server

Published: September 16, 2026

Security Bulletin ID SB2026091639
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 14
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 93% Low 7%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 14 vulnerabilities.


1) Improper Certificate Validation (CVE-ID: CVE-2026-8763)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass name constraints validation.

The vulnerability exists due to improper certificate validation in name constraints processing when handling rfc822Name and URI values with a trailing dot. A remote attacker can supply a crafted identifier to bypass name constraints validation.


2) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-14682)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled memory allocation in definite-length read processing when performing an unbounded up-front allocation. A remote attacker can supply crafted input with a large declared length to cause a denial of service.


3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-54428)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the HTTP/2 HPACK decoder when processing compressed header blocks before the HTTP/2 SETTINGS acknowledgement. A remote attacker can send oversized compressed header blocks to cause a denial of service.

The issue can lead to memory exhaustion before the configured header list size limit is applied.


4) Unsafe reflection (CVE-ID: CVE-2026-55153)

CWE-ID: CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

CVSSv4: 7.5 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to unsafe reflection in com.mchange.v2.naming.JavaBeanObjectFactory when processing malicious JNDI Reference objects or Java-serialized objects. A remote user can cause an application to process a malicious object to execute arbitrary code.

Known deserialization gadget chains require a JVM prior to Java 16 and affected Apache commons-beanutils and commons-collections libraries on the application classpath.


5) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-58060)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled memory allocation in HSS public-key verification when processing an unbounded level count. A remote attacker can provide a crafted public key to cause a denial of service.


6) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-58059)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in X.500 distinguished name stringification when escaping strings with quadratic-time behavior. A remote attacker can supply crafted distinguished names to cause a denial of service.


7) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-12816)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to forge message authentication codes.

The vulnerability exists due to improper cryptographic implementation in IESEngine stream-mode MAC processing when deriving keys through a length-dependent KDF split. A remote attacker can supply crafted input to forge message authentication codes.


8) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-12803)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to forge authenticated ciphertexts across nonces.

The vulnerability exists due to improper cryptographic binding in KCCMBlockCipher MAC processing when AAD is absent. A remote attacker can craft data that exploits the missing nonce binding to forge authenticated ciphertexts across nonces.


9) Insufficient verification of data authenticity (CVE-ID: CVE-2026-59642)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to tamper with CMS AuthenticatedData content.

The vulnerability exists due to improper cryptographic binding in CMS AuthenticatedData processing when authAttrs are present. A remote attacker can supply crafted CMS data to tamper with CMS AuthenticatedData content.


10) Insufficient verification of data authenticity (CVE-ID: CVE-2026-12802)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to tamper with decrypted data.

The vulnerability exists due to improper authentication tag validation in CMS AuthEnvelopedData decryption when processing encrypted data with an invalid tag length. A remote attacker can supply crafted encrypted content to tamper with decrypted data.


11) Input validation error (CVE-ID: CVE-2026-59650)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to weaken Diffie-Hellman key agreement security.

The vulnerability exists due to improper input validation in MTI/A0 DH agreement when processing an unvalidated peer value. A remote attacker can supply a crafted peer value to weaken Diffie-Hellman key agreement security.


12) Uncontrolled Recursion (CVE-ID: CVE-2026-13506)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in the lazy ASN.1 sequence parser when forcing sequence evaluation that resets the nesting-depth guard. A remote attacker can supply crafted ASN.1 data to cause a denial of service.


13) Input validation error (CVE-ID: CVE-2026-59639)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass CMS signature presence checks.

The vulnerability exists due to improper input validation in CMS verifySignatures when processing SignedData with zero signers. A remote attacker can supply crafted SignedData to bypass CMS signature presence checks.


14) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-75140)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the XmlTreeBuilder namespace scope tracking when parsing untrusted XML input. A remote attacker can supply a deeply nested XML document with uniquely named namespace declarations to cause a denial of service.

Parsing documents with many nested namespace bindings grows quadratically in time and retained memory.


Remediation

Install update from vendor's website.

References