---
id: "CVE-2026-91256"
kind: "vulnerability"
aliases: ["CVE-2026-91256"]
title: "Oracle Solaris 11.4: HTTP service flaw allows crash and partial data read"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Oracle Solaris", "fixed": ["11.4 SRU96 (11.4.96.227.1)"], "affected": "11.4 (before SRU96)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["http", "infrastructure", "oracle-solaris", "self-hosted", "solaris-11.4"]
not_affected_if: ["no-http-service-exposed", "solaris-not-11.4", "sru96-applied"]
published_at: "2026-10-20T22:20:26+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T03:35:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91256", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:35:05+00:00"}]
---

# Oracle Solaris 11.4: HTTP service flaw allows crash and partial data read

A low-privileged user with network access over HTTP can crash or hang Oracle Solaris 11.4 for a repeatable denial of service. The same flaw can also expose a subset of data the service can reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Solaris affected 11.4 (before SRU96) fixed 11.4 SRU96 (11.4.96.227.1)

## How to check

- Run 'pkg info entire' and compare the version to 11.4.96.227.1 or later; anything older on 11.4 is exposed.
- Run 'svcs -a | grep -i http' and 'netstat -an | grep LISTEN' to find HTTP services listening. Oracle does not name the affected service, so this only shows possible exposure.

## Fix

Update Oracle Solaris 11.4 to SRU96 (11.4.96.227.1, the October 2026 CPU) with 'pkg update' from the support repository. Oracle's patch doc is MOS KB631614. The advisory page I read does not state per-CVE that SRU96 fixes this one, so confirm in the MOS doc.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91256
- 2026-10-25T03:35:05+00:00 analyst — Oracle CPU Oct 2026 lists the CVE (Solaris 11.4, component Services); fix vehicle is Solaris 11.4 SRU96 CPU (blog + bulletin). The pages I read do not map this CVE to SRU96 explicitly (the per-CVE matrix text was truncated, the MOS patch doc needs a login), and Oracle does not name the service. Nothing marked verified. No exploitation or PoC found (Armis, Feedly).

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [fix] Announcing Oracle Solaris 11.4 SRU96 CPU https://blogs.oracle.com/solaris/announcing-oracle-solaris-11-4-sru96-cpu
- [mentions] Oracle Solaris Third Party Bulletin - October 2026 https://www.oracle.com/security-alerts/bulletinoct2026.html

## From the sources

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris and  unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_