Oracle Database Server: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 13

• Critical 9.1
  CVE-2026-75803

  AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()

  Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EV…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Aug 25, 2026
• High 8.8
  CVE-2026-91499

  Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3…

  Oracle Oracle Database Server
  Oct 20, 2026
• High 8.8
  CVE-2026-91563

  Vulnerability in the Oracle OLAP component of Oracle Database Server. Supported versions that are affected are 19.3-19.…

  Oracle Oracle OLAP
  Oct 20, 2026
• High 8.2
  CVE-2026-93569

  Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority

  A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prio…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat build of Keycloak 26.6 Debian Ubuntu
  Sep 18, 2026
• High 8.1
  CVE-2026-91503

  Vulnerability in the VPD component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3…

  Oracle Oracle Database Server
  Oct 20, 2026
• High 7.7
  CVE-2026-91568

  Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3…

  Oracle Oracle Database Server
  Oct 20, 2026
• High 7.5
  CVE-2026-54399

  Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration

  Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with e…

  Apache Software Foundation Apache HttpComponents Core druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Jul 1, 2026
• Medium 6.5
  CVE-2026-101512

  Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3…

  Oracle Oracle Database Server
  Oct 20, 2026
• Medium 6.5
  CVE-2026-59889

  jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization

  jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrap…

  FasterXML jackson-databind druid thingsboard-tb-node Ubuntu Wolfi Maven
  Jul 14, 2026
• Medium 6.5
  CVE-2026-91479

  Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3…

  Oracle Oracle Database Server
  Oct 20, 2026
• Medium 6.3
  CVE-2026-91615

  Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, …

  Oracle Oracle Database Server
  Oct 20, 2026
• Medium 4.4
  CVE-2026-101510

  Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are …

  Oracle Oracle Net Services
  Oct 20, 2026
• Low 2.7
  CVE-2026-73964

  Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32 and…

  Oracle Oracle Database Server
  Oct 20, 2026

Revision history

1. 2026-10-20 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - October 2026 - Appendix Oracle Database Server vom 2026-10-20
  https://www.oracle.com/security-alerts/cpuoct2026.html#AppendixDB