Skip to content
OpenAdvisories
Medium WID-SEC-2026-1198 8 CVEs

Oracle Database Server: Mehrere Schwachstellen

Published Apr 21, 2026 · Updated Apr 21, 2026 · de-DE

Vendor: Oracle Product: Database Server Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Database Server ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Die Oracle Datenbank ist ein weit verbreitetes relationales Datenbanksystem.

Vulnerabilities 8

  • High 8.2
    CVE-2026-26007

    cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() a…

    pyca cryptography open-webui kubeflow-pipelines-apiserver Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • High 7.5
    CVE-2026-31790

    Incorrect Failure Handling in RSA KEM RSASVE Encapsulation

    Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous ex…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-33870

    Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

    Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Vers…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-35229

    Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.30 a…

    Oracle Oracle Database Server
  • Medium 5.3
    CVE-2025-48924 Public exploit

    Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs

    Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can thr…

    Apache Software Foundation Apache Commons Lang druid thingsboard-tb-node Debian Ubuntu Azure Linux Wolfi Maven
  • Medium 5.3
    CVE-2026-21999

    Vulnerability in the XML Database component of Oracle Database Server. Supported versions that are affected are 23.4.0-…

    Oracle Oracle Database Server
  • Low 3.3
    CVE-2025-31948

    Improper input validation for some Intel(R) oneAPI Math Kernel Library before version 2025.2 within Ring 3: User Applic…

  • Low 2.4
    CVE-2026-34312

    Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.30. Ea…

    Oracle Oracle Database Server

Revision history

  1. #1

    Initiale Fassung

References