Oracle Communications Unified Assurance: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 8

• Critical 9.1
  CVE-2026-33557

  Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication

  A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without valida…

  Apache Software Foundation Apache Kafka apache-nifi debezium-3.5-connector-jdbc Ubuntu Wolfi Maven
  Apr 20, 2026
• High 8.8
  CVE-2025-15467 Public exploit EPSS 75%

  Stack buffer overflow in CMS (Auth)EnvelopedData parsing

  Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote c…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jan 27, 2026
• High 8.8
  CVE-2026-41044 Public exploit

  Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia

  Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All. An authenticated attacker can use the admin web console page to construct a malicious broker na…

  Apache Software Foundation Apache ActiveMQ Apache ActiveMQ All Apache ActiveMQ Broker Debian Ubuntu Maven
  Apr 24, 2026
• High 8.3
  CVE-2026-25646

  LIBPNG has a heap buffer overflow in png_set_quantize

  LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function i…

  pnggroup libpng openjpeg2 fltk Debian Ubuntu Azure Linux Alpine Wolfi
  Feb 10, 2026
• High 7.5
  CVE-2026-34059

  Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()

  Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  May 4, 2026
• High 7.5
  CVE-2026-34487

  Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

  Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 9, 2026
• Medium 6.9
  CVE-2025-58050

  PCRE2: heap-buffer-overflow read in match_ref due to missing boundary restoration in SCS

  The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regular expression matching engine, specifically within the handling of the (*scs:...…

  PCRE2Project pcre2 pcre2 pcre2 Debian Alpine PyPI
  Aug 27, 2025
• Medium 6.5
  CVE-2026-24308

  Apache ZooKeeper: Sensitive information disclosure in client configuration handling

  Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO leve…

  Apache Software Foundation Apache ZooKeeper druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Mar 7, 2026

Revision history

1. 2026-05-28 #1

   Initiale Fassung

References

• Oracle Critical Security Patch Update Advisory - May 2026 - Appendix Oracle Communications vom 2026-05-28
  https://www.oracle.com/security-alerts/cspumay2026.html#AppendixCGBU