Medium WID-SEC-2026-4062 8 CVEs

Oracle Utilities Applications: Mehrere Schwachstellen

Published Oct 20, 2026 · Updated Oct 20, 2026 · de-DE

Vendor: Oracle Product: Utilities Applications Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Utilities Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Utilities Applications ist eine Produktfamilie mit branchenspezifischen Lösungen für Ver- und Entsorger.

Vulnerabilities 8

High 7.5

CVE-2026-42587

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is c…

netty io.netty netty netty-codec-http Debian Wolfi Maven

May 13, 2026
High 7.5

CVE-2026-68497

jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._dese…

FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

Sep 11, 2026
Medium 6.8

CVE-2026-41239

DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES` strips `{{...}}` expressions from untrusted HTML. This works in string mode but not with `RETURN_DOM`…

cure53 DOMPurify opensearch-dashboards-3 nextcloud-server-33 Debian Ubuntu Wolfi npm

Apr 23, 2026
Medium 6.3

CVE-2026-49844 Public exploit

Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-…

Apache Software Foundation Apache Log4j API druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

Jul 10, 2026
Medium 5.5

CVE-2026-101517

Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Sy…

Oracle Oracle Utilities Network Management System

Oct 20, 2026
Medium 5.3

CVE-2026-101589

Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Sy…

Oracle Oracle Utilities Network Management System

Oct 20, 2026
Medium 5.3

CVE-2026-101605

Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Sy…

Oracle Oracle Utilities Network Management System

Oct 20, 2026
Medium 5.3

CVE-2026-64607

Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not …

Apache Software Foundation Apache HttpComponents Client druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

Jul 31, 2026

Revision history

2026-10-20 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - October 2026 - Appendix Oracle Utilities Applications vom 2026-10-20
https://www.oracle.com/security-alerts/cpuoct2026.html#AppendixUTIL