NCSC-2026-0254 [1.00] [M/H] Vulnerabilities fixed in Oracle database products

Oracle has fixed 158 vulnerabilities in Oracle Database Server, APEX, Autonomous Health Framework, Essbase, Global Lifecycle Management, GoldenGate, NoSQL Database, Spatial Studio, SQL Developer, and TimesTen In-Memory Database. Of these vulnerabilities, 91 are from third-party products for which updates have previously been released and are now processed by Oracle, or concern vulnerabilities that cannot lead to exploitation because they are in parts of the products that are not accessible. The six most severe vulnerabilities have received a CVSS score of 9 or higher. The vulnerability in Eclipse Jetty's HTTP/1.1 parser, used in Oracle REST Data Services versions 24.2.0 to 26.1.0, concerns incorrect parsing of chunked transfer encoding extensions with unclosed quoted strings, allowing HTTP request smuggling. This can lead to cache poisoning, bypass of access control, session hijacking, and unauthorized access to endpoints. Perl versions from 5.9.4 to 5.43.9 contain a vulnerable Compress::Raw::Zlib module due to an outdated zlib library with multiple security issues, including CVE-2026-3381 and CVE-2026-27171. This vulnerability is relevant for Perl distributions often deployed in Red Hat Enterprise Linux and OpenShift Container Platform environments. Apache Kafka versions 4.1.0 and 4.1.1 contain a vulnerability in JWT token validation where the default validator accepts any JWT token without proper validation, potentially allowing unauthorized access. This is resolved by explicitly setting the validator or upgrading to version 4.1.2 or higher. Oracle Communications Unified Assurance Message Bus components versions 6.1.1 to 7.0.0, which use Apache Kafka, contain a vulnerability that allows unauthenticated network attackers to gain unauthorized access and modify critical data. Oracle Net Services versions 19.3 to 19.31, 21.3.