Security Bulletin: IBM Financial Transaction Manager v4.0.6.0 is impacted by multiple vulnerabilities in RedHat Universal Base Image

Summary IBM Financial Transaction Manager v4.0.6.0 has addressed the following vulnerabilities. Vulnerability Details CVEID:CVE-2025-5914 DESCRIPTION: A vulnerability has been identified in the libarchive library, specifically within the archivereadformatrarseekdata function. This flaw involves a...

MINI-R4P5-H6PM-QWFC

Bulletin has no description...

MINI-FXJ3-W3J2-X7J3

Bulletin has no description...

MINI-6H7R-C37Q-GMJ5

Bulletin has no description...

MINI-HHRG-QP8J-884C

Bulletin has no description...

MINI-2Q75-VCRM-MF34

Bulletin has no description...

MINI-3MXM-CCP3-HVQJ

Bulletin has no description...

MINI-H263-F4P6-C6QF

Bulletin has no description...

MINI-RP3X-QWP7-M6MG

Bulletin has no description...

CVE-2026-72678

A flaw was found in Elasticsearch. An authenticated user with read privileges can submit a crafted request that causes the node to attempt an excessively large memory allocation due to unvalidated user input. This memory exhaustion leads to a fatal error, terminating the Elasticsearch node proces...

CVE-2026-74238

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

CVE-2026-72058

A flaw was found in the Linux kernel's ixp4xxhss network driver. The ixp4xxhssprobe function incorrectly allocates two High-Level Data Link Control HDLC network devices instead of one. This programming error leads to a memory leak, as the initially allocated device is not properly unregistered an...

haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling

A flaw was found in HAProxy. A malicious FastCGI Fast Common Gateway Interface backend can exploit an integer overflow vulnerability in the fcgiconn structure's drl field. This occurs when specific contentLength and paddingLength values cause the drl field to wrap to zero, leading to incorrect...

kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()

A flaw was found in the Linux kernel's IPv6 ICMP error generation. A remote attacker could send a specially crafted IPv4 ICMP error packet with a Common Internet Protocol Security Option CIPSO IP option. This could lead to incorrect handling of packet control block data when generating an IPv6 IC...

CVE-2026-73523

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The numcanms...

CVE-2026-59902

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...

DEBIAN-CVE-2026-59902

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...

CVE-2026-72048

A flaw was found in the Linux kernel. The ieee802154: ca8210 driver fails to free allocated memory casctl when the spiasync operation encounters an error. Under sustained Serial Peripheral Interface SPI bus contention, this can lead to repeated memory leaks. This continuous resource exhaustion ma...

CVE-2026-59902

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...

CVE-2026-72045

A flaw was found in the Linux kernel component octeontx2-af. A local attacker with access to a Virtual Function VF could exploit an unsanitized input in the rvumboxhandlerlmtsttblsetup function. This vulnerability allows the VF to read the physical base address of another function's LMTLINE, whic...