SB2026110737 - Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function

Description

This security bulletin contains information about 7 vulnerabilities.

1) Input validation error (CVE-ID: CVE-2026-22747)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to impersonate another user.

The vulnerability exists due to improper input validation in SubjectX500PrincipalExtractor when processing malformed X.509 certificate CN values. A remote user can present a carefully crafted certificate to impersonate another user.

Exploitation presupposes compromise of a trusted upstream that validates the presented credentials in the pre-authentication flow.

2) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-5795)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to sensitive information in resource not removed before reuse in JaspiAuthenticator.java when handling certain error or incomplete authentication flows. A remote attacker can trigger a request sequence that leaves residual authentication metadata in ThreadLocal storage to escalate privileges.

A subsequent unprivileged request processed by the same worker thread may inherit residual security roles if a mandatory CallerPrincipalCallback is missing or an exception occurs after a GroupPrincipalCallback has been persisted.

3) Input validation error (CVE-ID: CVE-2026-27135)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing state validation in the nghttp2 session handling logic when processing malformed frames after session termination has been initiated. A remote attacker can send specially crafted frames to cause a denial of service.

For PRIORITY_UPDATE and ALTSVC frames, the affected extension types must be explicitly enabled. Builds with assertions disabled may not crash under the same conditions.

4) Improper handling of highly compressed data (CVE-ID: CVE-2026-21441)

CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the application does not properly handle highly compressed data when sending HTTP redirect responses. A remote attacker can multiple large requests to the application, consume all available CPU and memory resources and perform a denial of service attack.

5) Improper Encoding or Escaping of Output (CVE-ID: CVE-2026-34481)

CWE-ID: CWE-116 - Improper Encoding or Escaping of Output

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause downstream log processing systems to reject or fail to index affected records.

The vulnerability exists due to improper serialization of non-finite floating-point values in JsonTemplateLayout when processing log events containing a MapMessage with an attacker-controlled floating-point value. A remote attacker can supply a non-finite floating-point value to cause downstream log processing systems to reject or fail to index affected records.

Exploitation is possible only if the application uses JsonTemplateLayout and logs a MapMessage containing the attacker-controlled value.

6) Resource exhaustion (CVE-ID: CVE-2026-42587)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in HttpContentDecompressor and DelegatingDecompressorFrameListener when processing compressed HTTP request bodies with Content-Encoding set to br, zstd, or snappy. A remote attacker can send a specially crafted compressed payload to cause a denial of service.

The configured maxAllocation limit is enforced for gzip and deflate, but is silently ignored for brotli, zstd, and snappy. The issue affects both HTTP/1.1 and HTTP/2 handling.

7) Deserialization of Untrusted Data (CVE-ID: CVE-2026-41855)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform unauthorized actions.

The vulnerability exists due to unsafe deserialization in org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter when processing messages in an untrusted JMS environment. A remote attacker can send a crafted message to perform unauthorized actions.

Exploitation can lead to arbitrary class instantiation through gadget class deserialization.

Remediation

Install update from vendor's website.

References

• https://www.oracle.com/security-alerts/cpujul2026.html