SB2026012079 - Multiple vulnerabilities in Oracle Database Server
Published: January 20, 2026 Updated: February 3, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 secuirty vulnerabilities.
1) Heap-based buffer overflow (CVE-ID: CVE-2025-54874)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the opj_jp2_read_header() function in src/lib/openjp2/jp2.c. A remote attacker can pass specially crafted image to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Improper input validation (CVE-ID: CVE-2025-61755)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to improper input validation within the Compiler component in Oracle GraalVM for JDK. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.
3) Improper input validation (CVE-ID: CVE-2026-21975)
The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within the Java VM in Oracle Database Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.
4) CRLF injection (CVE-ID: CVE-2025-67735)
The vulnerability allows a remote attacker to inject arbitrary data in server response.
The vulnerability exists due to insufficient validation of attacker-supplied data in io.netty.handler.codec.http.HttpRequestEncoder. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior.
5) Infinite loop (CVE-ID: CVE-2025-8194)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in the “tarfile” module when handling tar archives with negative offsets. A remote attacker can pass a specially crafted tar archive to the application and consume all available system resources, resulting in a deadlock and a denial of service.
6) Improper input validation (CVE-ID: CVE-2026-21939)
The vulnerability allows a local non-authenticated attacker to execute arbitrary code.
The vulnerability exists due to improper input validation within the SQLcl in Oracle Database Server. A local non-authenticated attacker can exploit this vulnerability to execute arbitrary code.
7) Race condition (CVE-ID: CVE-2025-12383)
The vulnerability allows a remote attacker to bypass trust restrictions.
The vulnerability exists due to a race condition in the SSL/TLS configuration handling. A remote attacker can bypass trust restrictions and gain unauthorized access to the application.
Remediation
Install update from vendor's website.