SB2026110772 - Multiple vulnerabilities in Oracle Banking Virtual Account Management

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110772

SB2026110772 - Multiple vulnerabilities in Oracle Banking Virtual Account Management

Published: November 7, 2026

Security Bulletin ID SB2026110772
CSH Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 67% Medium 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Resource exhaustion (CVE-ID: CVE-2026-44248)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in MqttDecoder when parsing MQTT 5 header Properties sections. A remote attacker can send a specially crafted MQTT message with an enormous Properties section to cause a denial of service.

The issue can lead to high CPU and memory usage because the Properties section is parsed and buffered before message size limits are applied, and repeated re-parsing occurs due to ReplayingDecoder behavior.


2) Input validation error (CVE-ID: CVE-2024-47561)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input when parsing schema in Java SDK. A remote attacker can pass specially crafted schema to the application and execute arbitrary code on the system.


3) Protection Mechanism Failure (CVE-ID: CVE-2026-22732)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper security header handling in HTTP response header writing for servlet applications when using lazy writing of HTTP headers. A remote attacker can trigger application responses where the configured security headers are not written to disclose sensitive information.

This issue affects servlet applications that specify HTTP response headers using Spring Security with lazy header writing enabled.


Remediation

Install update from vendor's website.

References