CVE-2026-61223

Oracle has fixed vulnerabilities in Communications products and underlying third-party software. There are a total of 213 vulnerabilities, of which 67 are in Oracle products and 146 in third-party products for which updates have previously been released and are now included in these Oracle updates. The most severe vulnerabilities, 12 in total, have received a CVSS score of 9 or higher and are described below. 11 of these are in embedded third-party products. The remaining vulnerabilities have lower scores, and it is too extensive to include detailed information in this advisory. For this, the NCSC refers to the attached reference. Oracle Communications Converged Application Server versions 8.2 and 8.3 contain a vulnerability that allows unauthorized network access and can lead to full system takeover. Libtiff up to version 4.7.0 contains a write-what-where vulnerability and a stack-based buffer overflow that can be triggered by specially crafted TIFF files, potentially leading to code execution or crashes. Apache Tomcat versions 8.5.0 to 11.0.5 contain vulnerabilities that allow specially crafted HTTP requests to bypass rewrite rules and security constraints, potentially resulting in data disclosure, modification, or denial of service. Eclipse Jetty's HTTP/1.1 parser improperly processes chunked transfer encoding extensions with improperly closed quotes, allowing request smuggling and potentially leading to cache poisoning, access control bypass, and session hijacking. Perl versions with an outdated vendored zlib in Compress::Raw::Zlib contain multiple security issues that have been resolved in a specific commit. Lodash versions up to 4.17.23 contain multiple vulnerabilities including code injection via untrusted keys in _.template, prototype pollution, regex denial of service, and command injection. Apache HTTP Server versions 2.4.0 to 2.4.67 contain various vulnerabilities in multiple modules.

[![CVE-2026-61223 status](https://www.csirts.com/badge/CVE-2026-61223)](https://www.csirts.com/cve/CVE-2026-61223)