CVE-2020-7226: Oracle Communications Services Gatekeeper

High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days.

CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data.

Affected products

• Oracle Communications Services Gatekeeper: version 7.0 only
• Oracle Webcenter Sites: version 12.2.1.3.0 only; version 12.2.1.4.0 only
• Oracle WebLogic Server: version 12.2.1.4.0 only; version 14.1.1.0.0 only
• Vt Cryptacular: before 1.1.4 (fixed in 1.1.4); from 1.2.0, before 1.2.4 (fixed in 1.2.4)

Published 2020-01-24. Last modified 2026-06-17.