Medium WID-SEC-2026-1212 6 CVEs

Oracle Utilities Applications: Mehrere Schwachstellen

Published Apr 21, 2026 · Updated Apr 21, 2026 · de-DE

Vendor: Oracle Product: Utilities Applications Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Utilities Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Utilities Applications ist eine Produktfamilie mit branchenspezifischen Lösungen für Ver- und Entsorger.

Vulnerabilities 6

High 8.9

CVE-2025-66418

urllib3 allows an unbounded number of links in the decompression chain

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leadin…

urllib3 urllib3 open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi PyPI

Dec 5, 2025
High 7.4

CVE-2026-24734

Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass

Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could al…

Apache Software Foundation Apache Tomcat Apache Tomcat Native tomcat9 Debian Ubuntu Alpine Maven

Feb 17, 2026
Medium 6.3

CVE-2025-68161

Apache Log4j Core: Missing TLS hostname verification in Socket appender

The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-att…

Apache Software Foundation Apache Log4j Core airflow-3 celeborn-0.6 Debian Ubuntu Wolfi Maven

Dec 18, 2025
Medium 5.5

CVE-2020-17521

Information Disclosure in Apache Groovy

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems…

Apache Software Foundation Apache Groovy org.codehaus.groovy:groovy-all groovy Debian Ubuntu Maven

Dec 7, 2020
Medium 5.3

CVE-2025-48924 Public exploit

Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs

Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can thr…

Apache Software Foundation Apache Commons Lang druid thingsboard-tb-node Debian Ubuntu Azure Linux Wolfi Maven

Jul 11, 2025
Low 1.7

CVE-2025-53643

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of …

aio-libs aiohttp airflow-3 py3-cassandra-medusa Debian Ubuntu Azure Linux Wolfi PyPI

Jul 14, 2025

Revision history

2026-04-21 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - April 2026 - Appendix Oracle Utilities Applications vom 2026-04-21
https://www.oracle.com/security-alerts/cpuapr2026.html#AppendixUTIL