Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in libxml2

Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include an open-source package libxml2 that is affected by three critical-severity vulnerabilities. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependency to a fixed version. Vulnerability Details...

Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0 (optim-spark) by vulnerability in github.com/slackhq/nebula package

Summary Impacted IBM optim 1.0.0, 1.1.0 optim-spark by vulnerability in github.com/slackhq/nebula package. IBM optim 1.2.0 resolves this vulnerability by upgrading the package from vulnerable version Vulnerability Details CVEID:CVE-2026-25793 DESCRIPTION: Nebula is a scalable overlay networking...

Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0, 1.2.0 by vulnerabilities in the package bind9.18-libs, bind9.18-utils.

Summary Impacted IBM optim 1.0.0, 1.1.0, 1.2.0 by vulnerabilities in the package bind9.18-libs, bind9.18-utils. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-1519 DESCRIPTION: If a BIND...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0  by vulnerabilities in jackc/pgx

Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include an open-source package jackc/pgx that is affected by a critical-severity vulnerability. IBM Optim 2.0.0 resolves this vulnerability by upgrading the affected open-source dependency to fixed version. Vulnerability Details CVEID:CVE-2026-338...

Security Bulletin: Impacted IBM Optim 1.2.0  by vulnerabilities in scrapy

Summary IBM Optim version 1.2.0 depends on an open-source package scrapy which is affected by a high-severity vulnerabilities. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependency to a fixed version. Vulnerability Details CVEID:CVE-2025-6176 DESCRIPTION:...

Security Bulletin: IBM Optim 1.0.0, 1.1.0 impacted by a denial of service vulnerability in axios

Summary axios is used by IBM Optim as part of its front-end user interface for making HTTP requests from the browser. CVE-2026-25639, A denial of service vulnerability exists in axios prior to versions 0.30.3 and 1.13.5, where the mergeConfig function crashes with a TypeError when processing a...

Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0 (optim-spark) by vulnerabilities in crypto/x509 package.

Summary Impacted IBM optim 1.0.0, 1.1.0 optim-spark by vulnerabilities in crypto/x509 package. IBM Optim 1.2.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2025-61729 DESCRIPTION: Within HostnameError.Error,...

Security Bulletin: IBM Optim 1.1.0 impacted by vulnerability in lodash-es 4.17.21

Summary IBM Optim 1.1.0 includes lodash-es 4.17.21 as an npm dependency in the archon-ui component. This version is affected by CVE-2025-13465, a prototype pollution vulnerability that allows a remote attacker to manipulate JavaScript object prototypes via specially crafted input, potentially...

Security Bulletin: IBM Optim 1.0.0, 1.1.0 and 1.2.0 impacted by vulnerabilities in webkit2gtk3-jsc 2.50.4-1.el9_7, gstreamer1-plugins-base 1.22.12-4.el9, jetty-io 11.0.24, zookeeper 3.9.3, jackson-core 2.12.7, aircompressor 2.0.2, libtiff 4.4.0-1

Summary webkit2gtk3-jsc, gstreamer1-plugins-base, libtiff, and giflib are bundled with IBM Optim as part of its base OS image; Eclipse Jetty jetty-io is used for HTTP server infrastructure; Apache ZooKeeper zookeeper is used for distributed coordination; Jackson Core jackson-core is used for JSON...

Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0 ,1.2.0 by vulnerabilities in the package google.golang.org/grpc

Summary Impacted IBM optim 1.0.0, 1.1.0 ,1.2.0 by vulnerabilities in the package google.golang.org/grpc. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-33186 DESCRIPTION: gRPC-Go is the Go...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by a vulnerability in Go's HTTP/2 transport

Summary BM Optim versions 1.0.0, 1.1.0, and 1.2.0 include the Go net/http package, which is affected by a high-severity denial-of-service vulnerability. IBM Optim 2.0.0 resolves this vulnerability by upgrading the affected Go dependency to a fixed version. Vulnerability Details CVEID:CVE-2026-338...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in form-data 4.0.5

Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include open-source package axios which transitively depends on package form-data, which is affected by a high severity vulnerability. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed...

Security Bulletin: IBM Optim 1.0.0, 1.1.0 and 1.2.0 impacted by XSS, open redirect, denial of service, and remote code execution vulnerabilities in react-router 7.7.0 / 7.12.0

Summary react-router is used by IBM Optim as part of its front-end user interface Optim UI to provide client-side and server-side routing for the web application. CVE-2026-33244 and CVE-2026-33245 are cross-site scripting XSS vulnerabilities in react-router's redirect and RSC handling;...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0  by vulnerabilities in nghttp2 and libarchive

Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include open-source packages nghttp2 and libarchive that are affected by three high-severity vulnerabilities. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Detail...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0, 1.2.0 by vulnerabilities in the packages picomatch-2.3.1.tgz.

Summary Impacted IBM Optim 1.0.0, 1.1.0, 1.2.0 by vulnerabilities in the packages picomatch-2.3.1.tgz. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch is a glob...

Security Bulletin: IBM Optim 1.0.0, 1.1.0 impacted by a denial of service vulnerability in quic-go

Summary quic-go github.com/quic-go/quic-go is used by IBM Optim as part of its network transport layer, providing a Go implementation of the QUIC protocol used for high-performance HTTP/3 communication.CVE-2025-59530 — A denial of service vulnerability exists in quic-go prior to version 0.54.1. A...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 ( runtime, metadb, ui, spark) images by vulnerabilities in gnupg2 package

Summary Impacted IBM Optim 1.0.0, 1.1.0 runtime, metadb, ui, spark images by vulnerabilities in gnupg2 package. IBM Optim 1.2.0 resolves these vulnerabilities by upgrading the packages to fixed versions 2.3.3-5.el97. Vulnerability Details CVEID:CVE-2025-68973 DESCRIPTION: In GnuPG before 2.4.9,...

Security Bulletin: Impacted IBM Optim 1.0.0 and 1.2.0  by vulnerability in go.opentelemetry.io/otel/sdk

Summary IBM Optim versions 1.0.0 and 1.1.0 include open-source package go.opentelemetry.io/otel/sdk which is affected by a high-severity vulnerability. IBM Optim 1.2.0 resolves this vulnerability by upgrading the affected open-source package to a fixed version. Vulnerability Details...

Security Bulletin: IBM Optim 1.0.0, 1.1.0 and 1.2.0 impacted by vulnerabilities in glibc 2.34, netty-codec-http 4.1.x, ncurses 6.2, and net/http

Summary glibc, netty-codec-http, ncurses, and net/http are bundled with IBM Optim as OS base image and application runtime dependencies. CVE-2026-0861 is an integer overflow in glibc that may cause heap corruption; CVE-2025-58056 is an HTTP request smuggling flaw in Netty; CVE-2022-29458 is an...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0  by vulnerabilities in plexus-utils, OpenSSL, jose4j, Go net/url, and Apache Hadoop

Summary IBM Optim versions 1.0.0, 1.1.0, and 1.2.0 include open-source packages plexus-utils, OpenSSL, jose4j, Go net/url, and Apache Hadoop that are affected by five vulnerabilities ranging from high to medium-high severity, including path traversal, stack buffer overflow, denial-of-service via...