GCVE-110-NCSC-2026-25

Advisory PublishedCVSS 7.5/10

Vulnetix · Advisory published January 21, 2026

Multiple vulnerabilities, including the 'MadeYouReset' attack in HTTP/2 and unauthenticated issues in Oracle products, can lead to denial of service across various platforms such as Eclipse Jetty and SAP Commerce Cloud.

Download JSON Open in Console

Weaknesses (CWE)

CWE-400Uncontrolled Resource ConsumptionCWE-125Out-of-bounds ReadCWE-521Weak Password RequirementsCWE-918Server-Side Request Forgery (SSRF)CWE-289Authentication Bypass by Alternate NameCWE-285Improper AuthorizationCWE-284Improper Access ControlCWE-674Uncontrolled RecursionCWE-770Allocation of Resources Without Limits or ThrottlingCWE-404Improper Resource Shutdown or Release

Risk Scores

CVSS 3.1

7.5/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions	Platforms
Oracle	vers:unknown/*	—	—

Aliases

CVE-2025-22228 CVE-2025-27817 CVE-2025-41248 CVE-2025-41249 CVE-2025-48734 CVE-2025-48795 CVE-2025-48924 CVE-2025-48976 CVE-2025-49796 CVE-2025-5115 CVE-2025-55163 CVE-2025-61795 CVE-2025-66418 CVE-2025-9230 CVE-2026-21973 CVE-2026-21978

References

advisory

Browse GCVE Records

74,267 records in the GCVE database · Updated July 22, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON