Threats affecting pkg:maven/com.oracle/oracle-net-services

CVE-2026-101510 is a vulnerability in Oracle Net Services affecting Oracle Database Server versions 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3. It allows a high privileged attacker with no privileges but with logon access to cause a hang or repeated crash, resulting in a denial of service (DoS). The vulnerability has a CVSS 3.1 base score of 4.4, indicating a medium severity focused on availability impact.

CVE-2026-47040 is a critical vulnerability in Oracle Net Services affecting Oracle Database Server versions 19.3 through 19.31, 21.3 through 21.22, and 23.4.0 through 23.26.2. It allows an unauthenticated attacker with network access to compromise Oracle Net Services, potentially gaining unauthorized access to critical data or causing a denial of service by crashing the service. The vulnerability has a CVSS 3.1 base score of 9.1, indicating high severity with significant confidentiality and availability impacts. Oracle has released a Critical Patch Update advisory addressing multiple vulnerabilities, including this one, and strongly recommends applying patches promptly. Patch status for this specific vulnerability is not explicitly confirmed in the advisory, so users should consult the vendor advisory for current remediation guidance.