SB2026110743 - Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
Published: November 7, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2026-41989)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.9 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local non-authenticated attacker to damange or delete data.
The vulnerability exists due to improper input validation within the Alarms, KPI, and Measurements (libgcrypt) component in Oracle Communications Cloud Native Core Policy. A local non-authenticated attacker can exploit this vulnerability to damange or delete data.
2) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-5795)
CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escalate privileges.
The vulnerability exists due to sensitive information in resource not removed before reuse in JaspiAuthenticator.java when handling certain error or incomplete authentication flows. A remote attacker can trigger a request sequence that leaves residual authentication metadata in ThreadLocal storage to escalate privileges.
A subsequent unprivileged request processed by the same worker thread may inherit residual security roles if a mandatory CallerPrincipalCallback is missing or an exception occurs after a GroupPrincipalCallback has been persisted.
3) Improper Encoding or Escaping of Output (CVE-ID: CVE-2026-34481)
CWE-ID: CWE-116 - Improper Encoding or Escaping of Output
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause downstream log processing systems to reject or fail to index affected records.
The vulnerability exists due to improper serialization of non-finite floating-point values in JsonTemplateLayout when processing log events containing a MapMessage with an attacker-controlled floating-point value. A remote attacker can supply a non-finite floating-point value to cause downstream log processing systems to reject or fail to index affected records.
Exploitation is possible only if the application uses JsonTemplateLayout and logs a MapMessage containing the attacker-controlled value.
4) Input validation error (CVE-ID: CVE-2026-27135)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing state validation in the nghttp2 session handling logic when processing malformed frames after session termination has been initiated. A remote attacker can send specially crafted frames to cause a denial of service.
For PRIORITY_UPDATE and ALTSVC frames, the affected extension types must be explicitly enabled. Builds with assertions disabled may not crash under the same conditions.
5) Improper handling of highly compressed data (CVE-ID: CVE-2026-21441)
CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the application does not properly handle highly compressed data when sending HTTP redirect responses. A remote attacker can multiple large requests to the application, consume all available CPU and memory resources and perform a denial of service attack.
6) Resource exhaustion (CVE-ID: CVE-2026-40192)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the FITS image decoder when parsing a specially crafted GZIP-compressed FITS file. A remote attacker can supply a specially crafted FITS file to cause a denial of service.
The issue can result in unbounded memory consumption, leading to an out-of-memory crash or severe performance degradation.
7) Resource exhaustion (CVE-ID: CVE-2026-42587)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in HttpContentDecompressor and DelegatingDecompressorFrameListener when processing compressed HTTP request bodies with Content-Encoding set to br, zstd, or snappy. A remote attacker can send a specially crafted compressed payload to cause a denial of service.
The configured maxAllocation limit is enforced for gzip and deflate, but is silently ignored for brotli, zstd, and snappy. The issue affects both HTTP/1.1 and HTTP/2 handling.
8) Improper access control (CVE-ID: CVE-2025-14821)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to manipulate trusted SSH configuration and host key data to compromise connection security.
The vulnerability exists due to improper access control in the global configuration file loading behavior on Windows when loading configuration files and ssh_known_hosts from the C:etc directory. A local user can create attacker-controlled files in that directory to manipulate trusted SSH configuration and host key data to compromise connection security.
This issue occurs when libssh is built with default configure options on Windows.
9) Input validation error (CVE-ID: CVE-2026-22747)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to impersonate another user.
The vulnerability exists due to improper input validation in SubjectX500PrincipalExtractor when processing malformed X.509 certificate CN values. A remote user can present a carefully crafted certificate to impersonate another user.
Exploitation presupposes compromise of a trusted upstream that validates the presented credentials in the pre-authentication flow.
10) Deserialization of Untrusted Data (CVE-ID: CVE-2026-41855)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform unauthorized actions.
The vulnerability exists due to unsafe deserialization in org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter when processing messages in an untrusted JMS environment. A remote attacker can send a crafted message to perform unauthorized actions.
Exploitation can lead to arbitrary class instantiation through gadget class deserialization.
11) Improper access control (CVE-ID: CVE-2026-40976)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain unauthorized access to all endpoints.
The vulnerability exists due to improper access control in the default web security filter chain when handling requests in certain actuator configurations. A remote attacker can send requests to application endpoints to gain unauthorized access to all endpoints.
Only servlet-based web applications that rely on the default web security filter chain, depend on spring-boot-actuator-autoconfigure, and do not depend on spring-boot-health are vulnerable.
12) Code Injection (CVE-ID: CVE-2026-4800)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper control of code generation in _.template when processing untrusted options.imports key names. A remote attacker can supply crafted imports key names to execute arbitrary code.
Code execution occurs at template compilation time. If Object.prototype has been polluted by another vector, inherited polluted keys can also be copied into the imports object and passed to Function().
Remediation
Install update from vendor's website.