Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates

Summary IBM App Connect Enterprise Certified Container ACEcc is built on the Red Hat Universal Base Images. ACEcc operator versions 12.0.27 and 13.5.0 contain fixes to the listed CVEs found in the base images. This bulletin provides patch information to address the reported vulnerabilities...

Security Bulletin: IBM MQ is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty (CVE-2026-50645,CVE-2026-9322,CVE-2026-9171)

Summary Multiple issues were identified with IBM WebSphere Application Server Liberty, which IBM MQ ships and uses to supply IBM MQ Console and IBM MQ REST API functionality. Vulnerability Details CVEID:CVE-2026-50645 DESCRIPTION: There is no restriction on the amount of attachment headers that a...

CVE-2026-53752: Uncontrolled Recursion

docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed...

CVE-2026-17463: Uncontrolled Resource Consumption

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows includes DB2 Connect Server could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption...

ROS-20260914-73-0002

The vulnerability in github.com/moby/sys/user version up to 0.4.1 relates to uncontrolled resource consumption during analysis of specially created user or group databases. This allows attackers to cause excessive memory consumption, potentially leading to process termination due to out-of-memory...

CVE-2026-68955: Uncontrolled Search Path Element

The installer for Rakuten Kobo Desktop Application Windows version insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privileges of the user who performed the installation...

CVE-2026-12759: Uncontrolled Resource Consumption

IBM Cloud Pak for Business Automation could allow an authenticated user to cause a denial of service due to uncontrolled resource consumption...

CVE-2026-88932: Uncontrolled Resource Consumption

multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned...

CVE-2026-53495: Uncontrolled Resource Consumption

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/containerexecsync.go when CRI ExecSync is used by exec probes or lifecycle hooks...

CVE-2026-90927: Uncontrolled Resource Consumption

filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mdadm (UTSA-2023-002893)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002893 advisory. Uncontrolled resource consumption in some IntelR SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: poppler (UTSA-2023-002399)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002399 advisory. Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input. Tenable has extracted the...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in protobuf-5.29.5-cp38-abi3-manylinux2014_x86_64.whl

Summary IBM Watson Discovery Cartridge affected by vulnerability in protobuf-5.29.5-cp38-abi3-manylinux2014x8664.whl Vulnerability Details CVEID:CVE-2026-0994 DESCRIPTION: A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion due to recursive deserialization in MessageUnpacker.unpackValue in msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java. An attacker can trigger StackOverflowError by supplying MessagePack payloads wit...

Linux Distros Unpatched Vulnerability : CVE-2026-19201

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 allows an attacker to...

CVE-2026-90472: Uncontrolled Recursion

msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger...

CVE-2026-90554: Uncontrolled Resource Consumption

vLLM versions =0.10.2 and 0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. In nanonemotronvl.py, extractaudiofromvideos calls loadaudiopyavBytesIOvideobytes without the maxdurations or maxdecodebytes parameters, so neith...

Security Bulletin: IBM webMethods Integration is affected by multiple vulnerabilities

Summary Vulnerabilities have been addressed in IBM webMethods Integration. Vulnerability Details CVEID:CVE-2026-59645 DESCRIPTION: In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java...

Security Bulletin: Security Vulnerability identified in neethi-3.2.2.jar used by IBM Maximo Application Suite - MREF ( CVE-2026-66142, CVE-2026-66143, CVE-2026-66144 )

Summary There is a vulnerability in neethi-3.2.2.jar used by IBM Maximo Application Suite - MREF Vulnerability Details CVEID:CVE-2026-66142 DESCRIPTION: Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lea...

BIT-TOMCAT-2026-68763 Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were EOL at...