SB2026110730 - Multiple vulnerabilities in Oracle Cloud Native Session Border Controller

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110730

SB2026110730 - Multiple vulnerabilities in Oracle Cloud Native Session Border Controller

Published: November 7, 2026

Security Bulletin ID SB2026110730
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) NULL pointer dereference (CVE-ID: CVE-2026-27141)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the HTTP/2 handling component when processing HTTP/2 frames. A remote attacker can send specially crafted HTTP/2 frames to cause a denial of service.


2) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-2332)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject arbitrary HTTP requests.

The vulnerability exists due to inconsistent interpretation of HTTP requests in the chunked transfer encoding extension parser when parsing quoted strings in HTTP/1.1 chunked transfer encoding extension values. A remote attacker can send a specially crafted chunked HTTP request to inject arbitrary HTTP requests.

The issue occurs because CRLF sequences inside quoted strings are treated as chunk header terminators instead of parsing errors.


Remediation

Install update from vendor's website.

References