GHSA-4C8G-83QW-93J6 fast-uri vulnerable to host confusion via failed IDN canonicalization

Impact fast-uri versions = 2.3.1, = 4.0.0 fail to canonicalize Unicode/IDN hostnames for HTTP-family URLs. The IDN conversion path calls URL.domainToASCII... on the global WHATWG URL constructor, where that helper does not exist. The resulting TypeError is silently routed into parsed.error, but...

fast-uri vulnerable to host confusion via failed IDN canonicalization

Impact fast-uri versions = 2.3.1, = 4.0.0 fail to canonicalize Unicode/IDN hostnames for HTTP-family URLs. The IDN conversion path calls URL.domainToASCII... on the global WHATWG URL constructor, where that helper does not exist. The resulting TypeError is silently routed into parsed.error, but...

GHSA-XVCM-6775-5M9R Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

Summary Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a collision bucket that is scanned linearly. The string hash is public and deterministic, so an attacker who controls the keys inserted into a Map can craft many keys that all collide, degrading insertion and...

Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

Summary Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a collision bucket that is scanned linearly. The string hash is public and deterministic, so an attacker who controls the keys inserted into a Map can craft many keys that all collide, degrading insertion and...

Security Bulletin: Security Vulnerability in commons-lang affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-48924)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to commons-lang library. Vulnerability Details CVEID:CVE-2025-48924 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with...

Security Bulletin: Security Vulnerability in Ebics server affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-36298)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability in Ebics server Vulnerability Details CVEID:CVE-2025-36298 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway Ebics server component is vulnerable to cross-site scripting. This...

Security Bulletin: Security Vulnerability in logback affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-11226)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to logback libraries. Vulnerability Details CVEID:CVE-2025-11226 DESCRIPTION: ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18...

Security Bulletin: Security Vulnerability in EdDSA-Java affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2020-36843)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to EdDSA-Java's implementation of the cryptographic algorithm. Vulnerability Details CVEID:CVE-2020-36843 DESCRIPTION: The implementation of EdDSA in EdDSA-Java aka ed25519-java through 0.3.0 exhibi...

Security Bulletin: Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure in mailbox UI (CVE-2026-3157)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to information disclosure in mailbox UI. Vulnerability Details CVEID:CVE-2026-3157 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway is vulnerable to an information disclosure d...

Security Bulletin: Security Vulnerability in Jetty affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-5115)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Jetty Vulnerability Details CVEID:CVE-2025-5115 DESCRIPTION: In Eclipse Jetty, versions =9.4.57, =10.0.25, =11.0.25, =12.0.21, =12.1.0.alpha2, an HTTP/2 client may trigger the server to send...

Security Bulletin: Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure (CVE-2026-3159)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to information disclosure. Vulnerability Details CVEID:CVE-2026-3159 DESCRIPTION: IBM IBM Sterling File Gateway is vulnerable to an information disclosure due to sensitive information being included...

Security Bulletin: TS4500 CLI tool addresses security vulnerability CVE-2026-16107

Summary The TS4500 CLI tool used an insecure SSL configuration that did not properly validate server certificates, potentially allowing attackers to intercept communications through a Man-in-the-Middle MitM attack. The issue has been resolved by enforcing proper SSL certificate validation during...

Security Bulletin: Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure (CVE-2026-3158)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to information disclosure Vulnerability Details CVEID:CVE-2026-3158 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway is vulnerable to an information disclosure due to sensitive...

Security Bulletin: Security Vulnerability in IBM WebSphere Application Server - Liberty affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-14917)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to IBM WebSphere Application Server - Liberty Vulnerability Details CVEID:CVE-2025-14917 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application...

Security update for tomcat

This update for tomcat fixes the following issues Update to Tomcat 9.0.119. Security issues fixed: CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example bsc1269791. CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused...

SUSE-SU-2026:3167-1 Security update for tomcat

This update for tomcat fixes the following issues Update to Tomcat 9.0.119. Security issues fixed: - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example bsc1269791. - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caus...

Security Bulletin: Security Vulnerability in Apache Shiro affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-23901, CVE-2026-23903)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Apache Shiro Vulnerability Details CVEID:CVE-2026-23901 DESCRIPTION: Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1., 2. before 2.0.7. Users...

Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway store sensitive information in a log file (CVE-2026-1918)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to sensitive information in a log file. Vulnerability Details CVEID:CVE-2026-1918 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway stores potentially sensitive information in l...

Security Bulletin: Security Vulnerability in Apache Struts affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-66675)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Apache Struts Vulnerability Details CVEID:CVE-2025-66675 DESCRIPTION: Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issu...

Security Bulletin: Security Vulnerability in Jetty affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-11143)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Jetty. Vulnerability Details CVEID:CVE-2025-11143 DESCRIPTION: The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing ...