{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-78030", "tracking": { "current_release_date": "2026-10-21T16:50:53.576089Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-78030", "initial_release_date": "2026-09-12T12:43:32.256868Z", "revision_history": [ { "date": "2026-09-12T12:43:32.256868Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Products connected (1)." }, { "date": "2026-09-12T12:43:37.241441Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-09-19T11:25:06.817434Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| References created (3).| CWES updated (1)." }, { "date": "2026-09-19T11:25:13.787937Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-09-19T11:34:49.837204Z", "number": "5", "summary": "NCSC Score updated." }, { "date": "2026-09-19T11:38:42.862570Z", "number": "6", "summary": "Source created.| CVE status created. (valid)| Description created for source.| References created (3).| CWES updated (1)." }, { "date": "2026-09-19T11:38:53.090797Z", "number": "7", "summary": "NCSC Score updated." }, { "date": "2026-09-19T18:25:09.855679Z", "number": "8", "summary": "References created (1)." }, { "date": "2026-09-19T18:38:42.404708Z", "number": "9", "summary": "References created (1)." }, { "date": "2026-09-20T01:27:49.961024Z", "number": "10", "summary": "CVSS created." }, { "date": "2026-09-20T01:27:55.917720Z", "number": "11", "summary": "NCSC Score updated." }, { "date": "2026-09-20T01:39:01.443201Z", "number": "12", "summary": "CVSS created.| Unknown change." }, { "date": "2026-09-20T01:39:02.925065Z", "number": "13", "summary": "NCSC Score updated." }, { "date": "2026-09-20T06:43:33.545265Z", "number": "14", "summary": "Description created for source." }, { "date": "2026-09-20T06:43:37.666078Z", "number": "15", "summary": "Source created.| CVE status created. (valid)| Description created for source.| Products created (1).| Products connected (55).| References created (7).| CWES updated (1)." }, { "date": "2026-09-20T15:14:44.372534Z", "number": "16", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-20T19:53:38.415818Z", "number": "17", "summary": "CVSS created." }, { "date": "2026-09-25T12:21:51.474480Z", "number": "18", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| CVSS created.| CWES updated (1)." }, { "date": "2026-09-25T12:46:06.473655Z", "number": "19", "summary": "Source created.| CVE status created. (valid)| Products created (2).| References created (3)." }, { "date": "2026-09-26T15:12:42.257935Z", "number": "20", "summary": "EPSS updated." }, { "date": "2026-09-29T00:45:13.523335Z", "number": "21", "summary": "Products connected (1).| Product Identifiers created (1).| Products removed (1)." }, { "date": "2026-09-29T00:45:15.761734Z", "number": "22", "summary": "NCSC Score updated." }, { "date": "2026-09-29T15:28:58.643982Z", "number": "23", "summary": "EPSS created.| Unknown change." }, { "date": "2026-10-21T00:33:08.949992Z", "number": "24", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (4).| Product Remediations created (4).| Product Threats created (3).| References created (2)." }, { "date": "2026-10-21T00:33:12.637757Z", "number": "25", "summary": "NCSC Score updated." }, { "date": "2026-10-21T14:44:01.645791Z", "number": "26", "summary": "Source connected.| CVE status created. (valid)" }, { "date": "2026-10-21T14:44:10.988744Z", "number": "27", "summary": "NCSC Score updated." }, { "date": "2026-10-21T16:17:53.008808Z", "number": "28", "summary": "Source connected.| CVE status created. (valid)| Products connected (28).| References created (3)." }, { "date": "2026-10-21T16:17:59.931877Z", "number": "29", "summary": "NCSC Score updated." } ], "status": "interim", "version": "29" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/11", "product": { "name": "vers:unknown/11", "product_id": "CSAFPID-6213344", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:11.0" } } }, { "category": "product_version_range", "name": "vers:unknown/14", "product": { "name": "vers:unknown/14", "product_id": "CSAFPID-1846967", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:14.0" } } }, { "category": "product_version_range", "name": "vers:unknown/15.0.0.0.0", "product": { "name": "vers:unknown/15.0.0.0.0", "product_id": "CSAFPID-1350134", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:15.0.0.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/15.0.1.0.0", "product": { "name": "vers:unknown/15.0.1.0.0", "product_id": "CSAFPID-5452530", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:15.0.1.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/15.1.0.0.0", "product": { "name": "vers:unknown/15.1.0.0.0", "product_id": "CSAFPID-5452533", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:15.1.0.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/15.2.0.0.0", "product": { "name": "vers:unknown/15.2.0.0.0", "product_id": "CSAFPID-8469661", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:15.2.0.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/24.2.4-25.2.000", "product": { "name": "vers:unknown/24.2.4-25.2.000", "product_id": "CSAFPID-9794255", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:24.2.4-25.2.000" } } }, { "category": "product_version_range", "name": "vers:unknown/25.1.100", "product": { "name": "vers:unknown/25.1.100", "product_id": "CSAFPID-2726924", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:25.1.100" } } }, { "category": "product_version_range", "name": "vers:unknown/25.1.200", "product": { "name": "vers:unknown/25.1.200", "product_id": "CSAFPID-5452528", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:25.1.200" } } }, { "category": "product_version_range", "name": "vers:unknown/25.2.100", "product": { "name": "vers:unknown/25.2.100", "product_id": "CSAFPID-5129856", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:25.2.100" } } }, { "category": "product_version_range", "name": "vers:unknown/25.2.200", "product": { "name": "vers:unknown/25.2.200", "product_id": "CSAFPID-6213342", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:25.2.200" } } }, { "category": "product_version_range", "name": "vers:unknown/25.2.201", "product": { "name": "vers:unknown/25.2.201", "product_id": "CSAFPID-9794259", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:25.2.201" } } }, { "category": "product_version_range", "name": "vers:unknown/25.2.202", "product": { "name": "vers:unknown/25.2.202", "product_id": "CSAFPID-9794251", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:25.2.202" } } }, { "category": "product_version_range", "name": "vers:unknown/26.1.200", "product": { "name": "vers:unknown/26.1.200", "product_id": "CSAFPID-9794254", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:26.1.200" } } }, { "category": "product_version_range", "name": "vers:unknown/26.1.202", "product": { "name": "vers:unknown/26.1.202", "product_id": "CSAFPID-9794257", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:26.1.202" } } }, { "category": "product_version_range", "name": "vers:unknown/47.0.0.2.0", "product": { "name": "vers:unknown/47.0.0.2.0", "product_id": "CSAFPID-9794256", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:47.0.0.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/6", "product": { "name": "vers:unknown/6", "product_id": "CSAFPID-5129855", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/6.1", "product": { "name": "vers:unknown/6.1", "product_id": "CSAFPID-5452527", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:6.1" } } }, { "category": "product_version_range", "name": "vers:unknown/6.1.1-7.0.0", "product": { "name": "vers:unknown/6.1.1-7.0.0", "product_id": "CSAFPID-9010919", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:6.1.1-7.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/7.0.0", "product": { "name": "vers:unknown/7.0.0", "product_id": "CSAFPID-9794252", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:7.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/7.5.0", "product": { "name": "vers:unknown/7.5.0", "product_id": "CSAFPID-5452523", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:7.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/7.5.1", "product": { "name": "vers:unknown/7.5.1", "product_id": "CSAFPID-9794258", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:7.5.1" } } }, { "category": "product_version_range", "name": "vers:unknown/7.6.0", "product": { "name": "vers:unknown/7.6.0", "product_id": "CSAFPID-6213349", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:7.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/7.7.0", "product": { "name": "vers:unknown/7.7.0", "product_id": "CSAFPID-5452536", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:7.7.0" } } }, { "category": "product_version_range", "name": "vers:unknown/7.8.0", "product": { "name": "vers:unknown/7.8.0", "product_id": "CSAFPID-5452531", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:7.8.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.0-8.1", "product": { "name": "vers:unknown/8.0-8.1", "product_id": "CSAFPID-9794260", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:8.0-8.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.0-8.3", "product": { "name": "vers:unknown/8.0-8.3", "product_id": "CSAFPID-9794253", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:8.0-8.3" } } }, { "category": "product_version_range", "name": "vers:unknown/8.0.1", "product": { "name": "vers:unknown/8.0.1", "product_id": "CSAFPID-9010916", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:8.0.1" } } } ], "category": "product_name", "name": "Communications" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:oracle/>=6.1.1|<=7.0.0", "product": { "name": "vers:oracle/>=6.1.1|<=7.0.0", "product_id": "CSAFPID-6212729", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:communications_unified_assurance:6.1.1-7.0.0:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "Oracle Communications Unified Assurance" } ], "category": "product_family", "name": "Oracle Communications" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:oracle/>=19.3|<=19.32", "product": { "name": "vers:oracle/>=19.3|<=19.32", "product_id": "CSAFPID-9763667", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:database_-_rdbms:19.3-19.32:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:oracle/>=21.3|<=21.23", "product": { "name": "vers:oracle/>=21.3|<=21.23", "product_id": "CSAFPID-9763665", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:database_-_java_vm:21.3-21.23:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:oracle/>=23.4.0|<=23.26.3", "product": { "name": "vers:oracle/>=23.4.0|<=23.26.3", "product_id": "CSAFPID-9763666", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:database_-_rdbms:23.4.0-23.26.3:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "Oracle Database Server" } ], "category": "product_family", "name": "Oracle Database Server" } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/1.602", "product": { "name": "vers:unknown/1.602", "product_id": "CSAFPID-3370381" } }, { "category": "product_version_range", "name": "vers:unknown/1.607", "product": { "name": "vers:unknown/1.607", "product_id": "CSAFPID-3370382" } }, { "category": "product_version_range", "name": "vers:unknown/1.611_90", "product": { "name": "vers:unknown/1.611_90", "product_id": "CSAFPID-3370383" } }, { "category": "product_version_range", "name": "vers:unknown/1.611_91", "product": { "name": "vers:unknown/1.611_91", "product_id": "CSAFPID-3370384" } }, { "category": "product_version_range", "name": "vers:unknown/1.611_92", "product": { "name": "vers:unknown/1.611_92", "product_id": "CSAFPID-3370385" } }, { "category": "product_version_range", "name": "vers:unknown/1.611_93", "product": { "name": "vers:unknown/1.611_93", "product_id": "CSAFPID-3370386" } }, { "category": "product_version_range", "name": "vers:unknown/1.611_94", "product": { "name": "vers:unknown/1.611_94", "product_id": "CSAFPID-3370387" } }, { "category": "product_version_range", "name": "vers:unknown/1.613_70", "product": { "name": "vers:unknown/1.613_70", "product_id": "CSAFPID-3370388" } }, { "category": "product_version_range", "name": "vers:unknown/1.613_71", "product": { "name": "vers:unknown/1.613_71", "product_id": "CSAFPID-3370389" } }, { "category": "product_version_range", "name": "vers:unknown/1.613_90", "product": { "name": "vers:unknown/1.613_90", "product_id": "CSAFPID-3370390" } }, { "category": "product_version_range", "name": "vers:unknown/1.613_91", "product": { "name": "vers:unknown/1.613_91", "product_id": "CSAFPID-3370391" } }, { "category": "product_version_range", "name": "vers:unknown/1.613_92", "product": { "name": "vers:unknown/1.613_92", "product_id": "CSAFPID-3370392" } }, { "category": "product_version_range", "name": "vers:unknown/1.613_93", "product": { "name": "vers:unknown/1.613_93", "product_id": "CSAFPID-3370393" } }, { "category": "product_version_range", "name": "vers:unknown/1.614_90", "product": { "name": "vers:unknown/1.614_90", "product_id": "CSAFPID-3370394" } }, { "category": "product_version_range", "name": "vers:unknown/1.615", "product": { "name": "vers:unknown/1.615", "product_id": "CSAFPID-3370395" } }, { "category": "product_version_range", "name": "vers:unknown/1.618", "product": { "name": "vers:unknown/1.618", "product_id": "CSAFPID-3370396" } }, { "category": "product_version_range", "name": "vers:unknown/1.619", "product": { "name": "vers:unknown/1.619", "product_id": "CSAFPID-3370397" } }, { "category": "product_version_range", "name": "vers:unknown/1.622", "product": { "name": "vers:unknown/1.622", "product_id": "CSAFPID-3370398" } }, { "category": "product_version_range", "name": "vers:unknown/1.624", "product": { "name": "vers:unknown/1.624", "product_id": "CSAFPID-3370399" } }, { "category": "product_version_range", "name": "vers:unknown/1.625", "product": { "name": "vers:unknown/1.625", "product_id": "CSAFPID-3370400" } }, { "category": "product_version_range", "name": "vers:unknown/1.626", "product": { "name": "vers:unknown/1.626", "product_id": "CSAFPID-3370401" } }, { "category": "product_version_range", "name": "vers:unknown/1.627", "product": { "name": "vers:unknown/1.627", "product_id": "CSAFPID-3370402" } }, { "category": "product_version_range", "name": "vers:unknown/1.628", "product": { "name": "vers:unknown/1.628", "product_id": "CSAFPID-3370403" } }, { "category": "product_version_range", "name": "vers:unknown/1.630", "product": { "name": "vers:unknown/1.630", "product_id": "CSAFPID-3370404" } }, { "category": "product_version_range", "name": "vers:unknown/1.631", "product": { "name": "vers:unknown/1.631", "product_id": "CSAFPID-3370405" } }, { "category": "product_version_range", "name": "vers:unknown/1.632", "product": { "name": "vers:unknown/1.632", "product_id": "CSAFPID-3370406" } }, { "category": "product_version_range", "name": "vers:unknown/1.632_90", "product": { "name": "vers:unknown/1.632_90", "product_id": "CSAFPID-3370407" } }, { "category": "product_version_range", "name": "vers:unknown/1.633", "product": { "name": "vers:unknown/1.633", "product_id": "CSAFPID-3370408" } }, { "category": "product_version_range", "name": "vers:unknown/1.633_90", "product": { "name": "vers:unknown/1.633_90", "product_id": "CSAFPID-3370409" } }, { "category": "product_version_range", "name": "vers:unknown/1.633_91", "product": { "name": "vers:unknown/1.633_91", "product_id": "CSAFPID-3370410" } }, { "category": "product_version_range", "name": "vers:unknown/1.633_92", "product": { "name": "vers:unknown/1.633_92", "product_id": "CSAFPID-3370411" } }, { "category": "product_version_range", "name": "vers:unknown/1.634", "product": { "name": "vers:unknown/1.634", "product_id": "CSAFPID-3370412" } }, { "category": "product_version_range", "name": "vers:unknown/1.635", "product": { "name": "vers:unknown/1.635", "product_id": "CSAFPID-3370413" } }, { "category": "product_version_range", "name": "vers:unknown/1.636", "product": { "name": "vers:unknown/1.636", "product_id": "CSAFPID-3370414" } }, { "category": "product_version_range", "name": "vers:unknown/1.637", "product": { "name": "vers:unknown/1.637", "product_id": "CSAFPID-3370415" } }, { "category": "product_version_range", "name": "vers:unknown/1.638", "product": { "name": "vers:unknown/1.638", "product_id": "CSAFPID-3370416" } }, { "category": "product_version_range", "name": "vers:unknown/1.639", "product": { "name": "vers:unknown/1.639", "product_id": "CSAFPID-3370417" } }, { "category": "product_version_range", "name": "vers:unknown/1.640", "product": { "name": "vers:unknown/1.640", "product_id": "CSAFPID-3370418" } }, { "category": "product_version_range", "name": "vers:unknown/1.641", "product": { "name": "vers:unknown/1.641", "product_id": "CSAFPID-3370419" } }, { "category": "product_version_range", "name": "vers:unknown/1.642", "product": { "name": "vers:unknown/1.642", "product_id": "CSAFPID-3370420" } }, { "category": "product_version_range", "name": "vers:unknown/1.643", "product": { "name": "vers:unknown/1.643", "product_id": "CSAFPID-8579888" } }, { "category": "product_version_range", "name": "vers:unknown/1.643_01", "product": { "name": "vers:unknown/1.643_01", "product_id": "CSAFPID-8579887" } }, { "category": "product_version_range", "name": "vers:unknown/1.643_02", "product": { "name": "vers:unknown/1.643_02", "product_id": "CSAFPID-8579886" } }, { "category": "product_version_range", "name": "vers:unknown/1.644", "product": { "name": "vers:unknown/1.644", "product_id": "CSAFPID-8579885" } }, { "category": "product_version_range", "name": "vers:unknown/1.645", "product": { "name": "vers:unknown/1.645", "product_id": "CSAFPID-8579884" } }, { "category": "product_version_range", "name": "vers:unknown/1.646", "product": { "name": "vers:unknown/1.646", "product_id": "CSAFPID-8579883" } }, { "category": "product_version_range", "name": "vers:unknown/1.647", "product": { "name": "vers:unknown/1.647", "product_id": "CSAFPID-8579882" } }, { "category": "product_version_range", "name": "vers:unknown/1.648", "product": { "name": "vers:unknown/1.648", "product_id": "CSAFPID-8579881" } }, { "category": "product_version_range", "name": "vers:unknown/1.649", "product": { "name": "vers:unknown/1.649", "product_id": "CSAFPID-8579880" } }, { "category": "product_version_range", "name": "vers:unknown/1.650", "product": { "name": "vers:unknown/1.650", "product_id": "CSAFPID-8848417" } }, { "category": "product_version_range", "name": "vers:unknown/1.651", "product": { "name": "vers:unknown/1.651", "product_id": "CSAFPID-9000057" } }, { "category": "product_version_range", "name": "vers:unknown/1.652", "product": { "name": "vers:unknown/1.652", "product_id": "CSAFPID-9361875" } }, { "category": "product_version_range", "name": "vers:unknown/dbi-1.47", "product": { "name": "vers:unknown/dbi-1.47", "product_id": "CSAFPID-3370421" } }, { "category": "product_version_range", "name": "vers:unknown/dbi-1.51", "product": { "name": "vers:unknown/dbi-1.51", "product_id": "CSAFPID-3370422" } }, { "category": "product_version_range", "name": "vers:unknown/dbi-1.57", "product": { "name": "vers:unknown/dbi-1.57", "product_id": "CSAFPID-3370423" } }, { "category": "product_version_range", "name": "vers:unknown/dbi-1.58", "product": { "name": "vers:unknown/dbi-1.58", "product_id": "CSAFPID-3370424" } } ], "category": "product_name", "name": "dbi" } ], "category": "vendor", "name": "perl5-dbi" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/1.643-4+deb12u3", "product": { "name": "vers:deb/1.643-4+deb12u3", "product_id": "CSAFPID-9483880", "product_identification_helper": { "purl": "pkg:deb/debian/libdbi-perl@1.643-4+deb12u3?distro=bookworm" } } } ], "category": "product_name", "name": "libdbi-perl" } ], "category": "product_family", "name": "bookworm" } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<1.628-5.24.1", "product": { "name": "vers:unknown/>=0|<1.628-5.24.1", "product_id": "CSAFPID-9411094" } } ], "category": "product_name", "name": "perl-DBI" } ], "category": "product_family", "name": "SUSE:Linux Enterprise Server 12 SP5-LTSS" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<1.628-5.24.1", "product": { "name": "vers:unknown/>=0|<1.628-5.24.1", "product_id": "CSAFPID-9411095" } } ], "category": "product_name", "name": "perl-DBI" } ], "category": "product_family", "name": "SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5" } ], "category": "vendor", "name": "SUSE" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-78030", "cwe": { "id": "CWE-470", "name": "Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')" }, "flags": [ { "label": "vulnerable_code_cannot_be_controlled_by_adversary", "product_ids": [ "CSAFPID-9763665", "CSAFPID-9763666", "CSAFPID-9763667" ] } ], "notes": [ { "category": "description", "text": "DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.\n\nDBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.\n\nThe MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.\n\nA caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.\n\nFor example,\n\n my $dsn = \"dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm\"\n my $dbh = DBI->connect( $dsn );\n\nNote that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.", "title": "osvgit - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-78030.json?alt=media" }, { "category": "description", "text": "Security-in-Depth issue in the RDBMS (DBI) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.", "title": "oracle - https://www.oracle.com/a/tech/docs/security-alerts/cpuoct2026csaf.json" }, { "category": "description", "text": "DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm\\_type and dbm\\_mldbm attributes in DBD::DBM", "title": "microsoft - https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Sep" }, { "category": "description", "text": "DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.\n\nDBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.\n\nThe MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.\n\nA caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.\n\nFor example,\n\n my $dsn = \"dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm\"\n my $dbh = DBI->connect( $dsn );\n\nNote that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-78030" }, { "category": "description", "text": "DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs. The MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table. A caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names. For example, my $dsn = \"dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm\" my $dbh = DBI->connect( $dsn ); Note that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.", "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-78030" }, { "category": "description", "text": "DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.\n\nDBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.\n\nThe MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.\n\nA caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.\n\nFor example,\n\n my $dsn = \"dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm\"\n my $dbh = DBI->connect( $dsn );\n\nNote that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-78030" }, { "category": "other", "text": "0.00424", "title": "EPSS" }, { "category": "other", "text": "5.9", "title": "NCSC Score" }, { "category": "other", "text": "VENDOR FIX as product remediation category, There is product_remediation data available from source Oracle, There is product data available from source Certbundde, There is product data available from source Oracle", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "Is related to (a version of) an uncommon product, There is cwe data available from source Nvd", "title": "NCSC Score top decreasing factors" } ], "product_status": { "first_fixed": [ "CSAFPID-9483880" ], "known_affected": [ "CSAFPID-9411094", "CSAFPID-9411095", "CSAFPID-3370381", "CSAFPID-3370382", "CSAFPID-3370383", "CSAFPID-3370384", "CSAFPID-3370385", "CSAFPID-3370386", "CSAFPID-3370387", "CSAFPID-3370388", "CSAFPID-3370389", "CSAFPID-3370390", "CSAFPID-3370391", "CSAFPID-3370392", "CSAFPID-3370393", "CSAFPID-3370394", "CSAFPID-3370395", "CSAFPID-3370396", "CSAFPID-3370397", "CSAFPID-3370398", "CSAFPID-3370399", "CSAFPID-3370400", "CSAFPID-3370401", "CSAFPID-3370402", "CSAFPID-3370403", "CSAFPID-3370404", "CSAFPID-3370405", "CSAFPID-3370406", "CSAFPID-3370407", "CSAFPID-3370408", "CSAFPID-3370409", "CSAFPID-3370410", "CSAFPID-3370411", "CSAFPID-3370412", "CSAFPID-3370413", "CSAFPID-3370414", "CSAFPID-3370415", "CSAFPID-3370416", "CSAFPID-3370417", "CSAFPID-3370418", "CSAFPID-3370419", "CSAFPID-3370420", "CSAFPID-8579888", "CSAFPID-8579887", "CSAFPID-8579886", "CSAFPID-8579885", "CSAFPID-8579884", "CSAFPID-8579883", "CSAFPID-8579882", "CSAFPID-8579881", "CSAFPID-8579880", "CSAFPID-8848417", "CSAFPID-9000057", "CSAFPID-9361875", "CSAFPID-3370421", "CSAFPID-3370422", "CSAFPID-3370423", "CSAFPID-3370424", "CSAFPID-6212729", "CSAFPID-1350134", "CSAFPID-1846967", "CSAFPID-2726924", "CSAFPID-5129855", "CSAFPID-5129856", "CSAFPID-5452523", "CSAFPID-5452527", "CSAFPID-5452528", "CSAFPID-5452530", "CSAFPID-5452531", "CSAFPID-5452533", "CSAFPID-5452536", "CSAFPID-6213342", "CSAFPID-6213344", "CSAFPID-6213349", "CSAFPID-8469661", "CSAFPID-9010916", "CSAFPID-9010919", "CSAFPID-9794251", "CSAFPID-9794252", "CSAFPID-9794253", "CSAFPID-9794254", "CSAFPID-9794255", "CSAFPID-9794256", "CSAFPID-9794257", "CSAFPID-9794258", "CSAFPID-9794259", "CSAFPID-9794260" ], "known_not_affected": [ "CSAFPID-9763665", "CSAFPID-9763666", "CSAFPID-9763667" ] }, "references": [ { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-78030.json?alt=media" }, { "category": "external", "summary": "Source - debian", "url": "https://security-tracker.debian.org/tracker/CVE-2026-78030" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-78030" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78030" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Source - microsoft", "url": "https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Sep" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/SUSE%2FSUSE-SU-2026:4346-1.json?alt=media" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-78030" }, { "category": "external", "summary": "Source - oracle", "url": "https://www.oracle.com/a/tech/docs/security-alerts/cpuoct2026csaf.json" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0444" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-4090.json" }, { "category": "external", "summary": "Reference - osv", "url": "https://bugzilla.suse.com/1281704" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/security/cve/CVE-2026-78030" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264346-1/" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd; osv", "url": "https://github.com/perl5-dbi/dbi/commit/315c6ce703b8b3cbe9188062d9ec80730293554a.patch" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd; osv", "url": "https://github.com/perl5-dbi/dbi/security/advisories/GHSA-wqmw-wqwx-3fr7" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd; osv", "url": "https://metacpan.org/release/HMBRAND/DBI-1.653/changes" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd; osv", "url": "http://www.openwall.com/lists/oss-security/2026/09/19/4" }, { "category": "external", "summary": "Reference - osv", "url": "https://cpan.org/modules" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78030.json" }, { "category": "external", "summary": "Reference - osv", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78030" }, { "category": "external", "summary": "Reference - oracle", "url": "https://www.oracle.com/security-alerts/cpuoct2026.html" }, { "category": "external", "summary": "Reference - oracle", "url": "https://www.oracle.com/docs/tech/security-alerts/cpuoct2026csaf.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-4090.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4090" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.oracle.com/security-alerts/cpuoct2026.html#AppendixCGBU" } ], "remediations": [ { "category": "vendor_fix", "details": "Oracle customers with valid support contracts", "product_ids": [ "CSAFPID-6212729" ], "url": "https://support.oracle.com/support/?documentId=CPU362" }, { "category": "vendor_fix", "details": "Oracle customers with valid support contracts", "product_ids": [ "CSAFPID-9763665", "CSAFPID-9763666", "CSAFPID-9763667" ], "url": "https://support.oracle.com/support/?documentId=CPU359" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1350134", "CSAFPID-1846967", "CSAFPID-2726924", "CSAFPID-3370381", "CSAFPID-3370382", "CSAFPID-3370383", "CSAFPID-3370384", "CSAFPID-3370385", "CSAFPID-3370386", "CSAFPID-3370387", "CSAFPID-3370388", "CSAFPID-3370389", "CSAFPID-3370390", "CSAFPID-3370391", "CSAFPID-3370392", "CSAFPID-3370393", "CSAFPID-3370394", "CSAFPID-3370395", "CSAFPID-3370396", "CSAFPID-3370397", "CSAFPID-3370398", "CSAFPID-3370399", "CSAFPID-3370400", "CSAFPID-3370401", "CSAFPID-3370402", "CSAFPID-3370403", "CSAFPID-3370404", "CSAFPID-3370405", "CSAFPID-3370406", "CSAFPID-3370407", "CSAFPID-3370408", "CSAFPID-3370409", "CSAFPID-3370410", "CSAFPID-3370411", "CSAFPID-3370412", "CSAFPID-3370413", "CSAFPID-3370414", "CSAFPID-3370415", "CSAFPID-3370416", "CSAFPID-3370417", "CSAFPID-3370418", "CSAFPID-3370419", "CSAFPID-3370420", "CSAFPID-3370421", "CSAFPID-3370422", "CSAFPID-3370423", "CSAFPID-3370424", "CSAFPID-5129855", "CSAFPID-5129856", "CSAFPID-5452523", "CSAFPID-5452527", "CSAFPID-5452528", "CSAFPID-5452530", "CSAFPID-5452531", "CSAFPID-5452533", "CSAFPID-5452536", "CSAFPID-6212729", "CSAFPID-6213342", "CSAFPID-6213344", "CSAFPID-6213349", "CSAFPID-8469661", "CSAFPID-8579880", "CSAFPID-8579881", "CSAFPID-8579882", "CSAFPID-8579883", "CSAFPID-8579884", "CSAFPID-8579885", "CSAFPID-8579886", "CSAFPID-8579887", "CSAFPID-8579888", "CSAFPID-8848417", "CSAFPID-9000057", "CSAFPID-9010916", "CSAFPID-9010919", "CSAFPID-9361875", "CSAFPID-9411094", "CSAFPID-9411095", "CSAFPID-9794251", "CSAFPID-9794252", "CSAFPID-9794253", "CSAFPID-9794254", "CSAFPID-9794255", "CSAFPID-9794256", "CSAFPID-9794257", "CSAFPID-9794258", "CSAFPID-9794259", "CSAFPID-9794260" ] } ], "threats": [ { "category": "impact", "details": "The vulnerable component is present, and the component contains the vulnerable code. However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.", "product_ids": [ "CSAFPID-9763665", "CSAFPID-9763666", "CSAFPID-9763667" ] } ], "title": "CVE-2026-78030" } ] }