Oracle Goldengate Stream Analytics vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Oracle Goldengate Stream Analytics: 7 record(s), with affected versions and fixes.cpe:2.3:a:oracle:goldengate_stream_analytics
CVE-2026-47022
Low · 3.3
CWE-400 Jul 21, 2026
Uncontrolled Resource Consumption in Oracle Goldengate Stream Analytics
Vulnerability in the GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security). The supported version that is affected is 26.1.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where GoldenGate Stream Analytics executes to compromise GoldenGate Stream Analytics. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of GoldenGate Stream Analytics. CVSS 3.1 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
CVE-2019-14893
Critical · 9.8
CWE-502 Mar 2, 2020
Deserialization of Untrusted Data in Fasterxml Jackson-databind
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.
CVE-2019-20330
Critical · 9.8
CWE-502 Jan 3, 2020
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
CVE-2019-16335
Critical · 9.8
CWE-502 Sep 15, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
CVE-2019-14540
Critical · 9.8
CWE-502 Sep 15, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVE-2019-14439
High · 7.5
CWE-502 Jul 30, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
CVE-2019-14379
Critical · 9.8
CWE-1321 Jul 29, 2019
Prototype Pollution in Fasterxml Jackson-databind
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.