CVE-2026-91255 in Solaris
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the kernel component of Oracle Solaris version 11.4, representing a critical security flaw that impacts system stability and availability. As a core operating system component, the kernel manages hardware resources and enforces security policies; therefore, any compromise at this level poses significant risks to the integrity of the entire platform. The vulnerability is characterized by its ease of exploitation, allowing an unauthenticated attacker who possesses network access via HTTP to trigger the flaw without requiring prior authentication or user interaction. This lack of prerequisite credentials significantly lowers the barrier for entry, enabling remote adversaries to target systems that are exposed to standard web traffic on affected ports.
The technical nature of this vulnerability centers around a condition within the kernel's handling of specific HTTP-related operations that leads to resource exhaustion or state corruption. When an attacker sends crafted requests over the network, the kernel fails to properly validate input or manage memory states associated with these connections. This failure results in a denial of service scenario where the operating system becomes unresponsive or enters a continuous crash loop. The impact is strictly confined to availability, as indicated by the CVSS vector which shows zero impact on confidentiality and integrity but high impact on availability. Consequently, successful exploitation does not grant the attacker control over data or user accounts directly but effectively renders the server unusable for legitimate users and services hosted upon it.
From a classification perspective, this vulnerability aligns with CWE-400, Uncontrolled Resource Consumption, as the root cause involves the system failing to limit resources consumed by maliciously crafted requests leading to exhaustion. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior is consistent with techniques found under T1499 Endpoint Denial of Service or potentially T1529 System Shutdown/Reboot if the crash leads to a hard reset scenario. The attack vector is classified as Network (AV:N) with Low Complexity (AC:L), indicating that no specialized conditions are required beyond network connectivity, and it requires No Privileges (PR:N) from the attacker, making it particularly dangerous in internet-facing environments where Oracle Solaris instances may be exposed to public traffic without adequate filtering.
The operational impact of this vulnerability is severe due to its potential for complete denial of service. Organizations relying on Oracle Solaris 11.4 for critical infrastructure face the risk of extended downtime if an attacker successfully exploits this flaw repeatedly or sustains a continuous attack stream. Since the crash is frequently repeatable, it allows for persistent disruption rather than a one-time event. This can lead to significant financial loss and reputational damage depending on the role of the affected system within the enterprise architecture. Furthermore, because the vulnerability affects the kernel level, standard application-layer security controls may not be sufficient to mitigate the risk if they do not specifically inspect or limit HTTP traffic destined for vulnerable kernel handlers before it reaches the operating system core.
Mitigation strategies must focus primarily on patching and network-level defenses. Oracle has likely released a patch addressing this specific issue in subsequent updates for Solaris 11.4, so applying the latest security patches is the most effective remediation step. In environments where immediate patching is not feasible due to operational constraints or testing requirements, temporary mitigation should involve configuring firewalls or web application firewalls to restrict HTTP access to trusted IP ranges only. Additionally, implementing rate limiting on incoming connections can help mitigate the impact of repeated exploitation attempts by slowing down the attack pace enough for system resources to recover or for alerts to trigger manual intervention. Regular monitoring of kernel logs and system stability metrics is also recommended to detect early signs of resource exhaustion indicative of such an exploit attempt.