Read the docs
TI-2026-34627 Aliases CVE-2026-47022GHSA-j465-g235-7vw4

Uncontrolled resource consumption in Oracle GoldenGate Stream Analytics

Priority LOW 15CWE-400Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Vulnerability in the GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security). The supported version that is affected is 26.1.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where GoldenGate Stream Analytics executes to compromise GoldenGate Stream Analytics. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of GoldenGate Stream Analytics. CVSS 3.1 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00149 4th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OracleGoldenGate Stream Analytics26.1.0.0.0—No fix listedCNA
  • GoldenGate Stream Analytics VendorOracle Affected 26.1.0.0.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:oracle:goldengate_stream_analytics:26.1.0.0.0:*:*:*:*:*:*:*26.1.0.0.0VulnerableOracle
  • cpe:2.3:a:oracle:goldengate_stream_analytics:26.1.0.0.0:*:*:*:*:*:*:* Versions 26.1.0.0.0 Vulnerable ·Oracle

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47022
  2. 2026-10-03 Alias added: GHSA-j465-g235-7vw4

References

Advisory 1

  • TI-2019-10835 A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. CVSS 3.1CRITICAL 9.8
  • TI-2019-10718 SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default… CVSS 3.1CRITICAL 9.8
  • TI-2019-14589 FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking. CVSS 3.1CRITICAL 9.8
  • TI-2018-05845 org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows… CVSS 3.1CRITICAL 9.8
  • TI-2019-12294 A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. CVSS 3.1CRITICAL 9.8
  • TI-2019-11097 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences