Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption in Netty (CVE-2026-56816)

Summary IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption in Netty, due to a flaw in Netty's Http3FrameCodec that allows it to buffer incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits. Netty is used in our...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Netty

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Netty. Netty is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-55831 DESCRIPTION: Netty is a network...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Unsafe Reflection and Deserialization of Untrusted Data in jackson-databind (CVE-2026-19032, CVE-2026-83557)

Summary IBM Watson Speech Services Cartridge is vulnerable to Unsafe Reflection and Deserialization of Untrusted Data in jackson-databind, due to issues with the DefaultBaseTypeLimitingValidator and deserializer for java.nio.file. Jackson-databind is used in our Speech microservices. These...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Improper Input Validation in QOS.CH logback-core (CVE-2026-13006)

Summary IBM Watson Speech Services Cartridge is vulnerable to an Improper Input Validation in QOS.CH logback-core. Logback-core is used in our Speech microservices. This vulnerability has been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-13006...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Path-traversal in QOS.CH Sarl Logback-classic (CVE-2026-19880)

Summary IBM Watson Speech Services Cartridge is vulnerable to a Path-traversal in QOS.CH Sarl Logback-classic due to a flaw in an MDC-based discriminator value that flows unsanitized into a nested FileAppender path. The logback-classic module is used in our Speech microservices. This vulnerabilit...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to memory allocation and data amplification issues in Amazon ion-java (CVE-2026-75935, CVE-2026-75936, CVE-2026-85786)

Summary IBM Watson Speech Services Cartridge is vulnerable to memory allocation and data amplification issues in Amazon ion-java which could cause a denial of service condition. Amazon ion-java is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to memory allocation and validation issues in Bouncy Castle for Java (CVE-2026-59638, CVE-2026-59646)

Summary IBM Watson Speech Services Cartridge is vulnerable to memory allocation and validation issues in Bouncy Castle for Java, due to flaws with the handshake reassembler and hostname verifier. Bouncy Castle is used in our Speech microservices. These vulnerabilities have been addressed. Please...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Bouncy Castle for Java

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Bouncy Castle for Java. Bouncy Castle is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-12185...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Bouncy Castle for Java

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Bouncy Castle for Java. Bouncy Castle is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-13505...

DEBIAN-CVE-2026-114655

libmongocrypt builds requests to external key management services AWS, Azure and GCP by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with...

CVE-2026-114655

libmongocrypt builds requests to external key management services AWS, Azure and GCP by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with...

EUVD-2026-108330

libmongocrypt builds requests to external key management services AWS, Azure and GCP by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Bouncy Castle for Java

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Bouncy Castle for Java. Bouncy Castle is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-12802...

CVE-2026-113873 SmileCDR HAPI FHIR improper data decompression

SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed...

CVE-2026-113873

The SmileCDR HAPI FHIR software is vulnerable to a denial-of-service attack because it does not properly handle highly compressed data (CWE-409 ). An unauthenticated attacker can send compressed payloads that, upon decompression, exhaust the server heap or crash specific services. To mitigate thi...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Golang go

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Golang go which can result in an Out-of-bounds Read, Infinite Loop, or Improper Validation condition. Golang go is used in our Speech utilities. These vulnerabilities have been addressed. Please read the details for...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to improper restrictions and Cross-site Scripting in Golang go

Summary IBM Watson Speech Services Cartridge is vulnerable to improper restrictions and Cross-site Scripting in Golang go due to a flaw where Render parsing can result in an unexpected HTML tree. Golang go is used in our Speech utilities. These vulnerabilities have been addressed. Please read the...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Apache Tomcat-Embed-Core

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Apache Tomcat-Embed-Core. Apache Tomcat-Embed-Core is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Apache HttpComponents (CVE-2026-64607, CVE-2026-71290 )

Summary IBM Watson Speech Services Cartridge is vulnerable to Improper Certificate Validation and Missing Release of Resource in Apache HttpComponents, due to flaws in TLS hostname verification and HttpClient. Apache is used in our Speech microservices. These vulnerabilities have been addressed...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in nltk (CVE-2026-62383)

Summary IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in nltk, due to a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypasses nltk.pathsec validation entirely. Nltk is used in our Speech runtimes. This vulnerability has been addressed...