Security Bulletin: IBM DB2 Developer Extension is affected due to vulnerability in Spring boot Core (CVE-2026-41848)

Summary IBM DB2 Developer Extension is affected due to vulnerability in Spring boot Core CVE-2026-41848 Vulnerability Details CVEID:CVE-2026-41848 DESCRIPTION: Applications may be vulnerable to a Regular Expression Denial of Service ReDoS attack if an attacker is able to provide a pattern which i...

Security Bulletin: Vulnerability in @opentelemetry/core affects DB2 Dev Extension (CVE-2026-54285)

Summary Upgraded @opentelemetry/core to 2.8.0. Vulnerability Details CVEID:CVE-2026-54285 DESCRIPTION: opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP header...

Security Bulletin: Vulnerability in DOMPurify affects DB2 Dev Extension (CVE-2026-0540, CVE-2026-41238, CVE-2026-41239, CVE-2026-41240)

Summary Upgraded dompurify to 3.4.0 to remediate CVE-2026-0540, CVE-2026-41238, CVE-2026-41239, and CVE-2026-41240 CWE-79: Cross-site Scripting — highest CVSS Base Score 6.9 Medium — PVR0810799. Vulnerability Details CVEID:CVE-2026-0540 DESCRIPTION: DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through...

Security Bulletin: Vulnerability in Apache Log4j API affects DB2 Dev Extension (CVE-2026-49844)

Summary Upgraded log4j-api to 2.25.5 to remediate CVE-2026-49844 CWE-116: Improper Encoding of non-finite floating-point values in MapMessage JSON serialization — CVSS Base Score 6.3 Medium — PVR0815934. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite...

Security Bulletin: brace-expansion-2.1.1.tgz (Publicly disclosed vulnerability found by Scanner)

Summary brace-expansion 2.1.1 affected by CVE-2026-13149 — exponential CPU consumption in expand via consecutive non-expanding brace groups, causing event-loop blocking DoS. Vulnerability Details CVEID:CVE-2026-13149 DESCRIPTION: brace-expansion through 5.0.6 is vulnerable to denial of service...

Security Bulletin: Vulnerability in Spring Boot affects DB2 Dev Extension (CVE-2026-40992, CVE-2026-41001)

Summary Upgraded spring-boot-autoconfigure to 3.5.15 to remediate CVE-2026-40992 Improper Certificate Validation and CVE-2026-41001 Insecure Temporary File — highest CVSS Base Score 5.3 Medium — PVR0789890. Vulnerability Details CVEID:CVE-2026-40992 DESCRIPTION: Spring Boot's Mail...

Security Bulletin: Vulnerability in brace-expansion affects DB2 Dev Extension (CVE-2026-14257)

Summary Upgraded brace-expansion to 5.0.8 to remediate CVE-2026-14257 CWE-400: Uncontrolled Resource Consumption — memory exhaustion DoS via unbounded result string length in expand — CVSS Base Score 7.5 High — PVR0827522. Vulnerability Details CVEID:CVE-2026-14257 DESCRIPTION: brace-expansion...

Security Bulletin: Vulnerability in Spring Framework affects DB2 Dev Extension (CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846)

Summary Upgraded spring-webmvc to 6.2.19 to remediate CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, and CVE-2026-41846 Information Disclosure, DoS, Path Traversal, Open Redirect, XSS — highest CVSS Base Score 7.5 High — PVR0786341. Vulnerability Details CVEID:CVE-2026-41841...

Security Bulletin: Vulnerability in form-data affects DB2 Dev Extension (CVE-2026-12143)

Summary Upgraded form-data to 4.0.6 to remediate CVE-2026-12143 CWE-93: CRLF Injection — CVSS Base Score 7.5 High — PVR0791412. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in Spring Expression (CVE-2026-41850, CVE-2026-41851,CVE-2026-41852 )

Summary IBM Db2 Developer Extension is affected by vulnerability in Spring Expression CVE-2026-41850, CVE-2026-41851,CVE-2026-41852 Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an...

Security Bulletin: Vulnerability in jackson-databind affects DB2 Dev Extension (CVE-2026-59888, CVE-2026-59889)

Summary Upgraded jackson-databind to 2.21.5 to remediate CVE-2026-59888 Improperly Controlled Modification of Dynamically-Determined Object Attributes and CVE-2026-59889 Incorrect Authorization — CVSS Base Score 6.5 Medium — PVR0820325. Vulnerability Details CVEID:CVE-2026-59888 DESCRIPTION:...

Security Bulletin: Vulnerability in DOMPurify affects DB2 Dev Extension (CVE-2026-49458, CVE-2026-49459, CVE-2026-49978)

Summary Upgraded dompurify to 3.4.7 to remediate CVE-2026-49458, CVE-2026-49459, and CVE-2026-49978 CWE-79: Cross-site Scripting via INPLACE sanitization bypasses — highest CVSS Base Score 6.3 Medium — PVR0817403. Vulnerability Details CVEID:CVE-2026-49458 DESCRIPTION: DOMPurify is a DOM-only...

Security Bulletin: Vulnerability in Apache Tomcat affects DB2 Dev Extension (CVE-2026-59083, CVE-2026-59084)

Summary Upgraded tomcat-embed-core to 10.1.57 to remediate CVE-2026-59083 Security Constraint Bypass via URL hex-encoding and CVE-2026-59084 Insufficient EncryptInterceptor Documentation — CVSS Base Score 9.1 Critical — PVR0818163. Vulnerability Details CVEID:CVE-2026-59083 DESCRIPTION: Improper...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a DBADM privileged user under certain conditions (CVE-2026-87958)

Summary IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a database administration authority DBADM privileged user under certain conditions CVE-2026-87958 Vulnerability Details CVEID:CVE-2026-87958 DESCRIPTION: IBM Db2 11.5.0 through...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core (CVE-2026-41293, CVE-2026-43512, CVE-2026-43513, CVE-2026-43515)

Summary IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core CVE-2026-41293, CVE-2026-43512, CVE-2026-43513, CVE-2026-43515 Vulnerability Details CVEID:CVE-2026-41293 DESCRIPTION: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat:...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in log4j core (CVE-2026-34477, CVE-2026-34478)

Summary IBM Db2 Developer Extension is affected by vulnerability in log4j core CVE-2026-34477, CVE-2026-34478 Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname verificatio...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in axios (CVE-2025-62718)

Summary IBM Db2 Developer Extension is affected by vulnerability in axios CVE-2025-62718 Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization whe...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core (CVE-2026-41284,CVE-2026-42498,CVE-2026-43514,CVE-2026-24880, CVE-2026-34483,CVE-2026-34487,CVE-2026-34500)

Summary IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core CVE-2026-41284,CVE-2026-42498,CVE-2026-43514,CVE-2026-24880, CVE-2026-34483,CVE-2026-34487,CVE-2026-34500 Vulnerability Details CVEID:CVE-2026-41284 DESCRIPTION: Allocation of Resources Without Limits or...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in spring boot (CVE-2026-40974)

Summary IBM Db2 Developer Extension is affected by vulnerability in spring boot CVE-2026-40974 Vulnerability Details CVEID:CVE-2026-40974 DESCRIPTION: Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spri...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in spring boot (CVE-2026-40972)

Summary IBM Db2 Developer Extension is affected by vulnerability in spring boot CVE-2026-40972 Vulnerability Details CVEID:CVE-2026-40972 DESCRIPTION: An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. ...