Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to improper restrictions and Cross-site Scripting in Golang go

Summary IBM Watson Speech Services Cartridge is vulnerable to improper restrictions and Cross-site Scripting in Golang go due to a flaw where Render parsing can result in an unexpected HTML tree. Golang go is used in our Speech utilities. These vulnerabilities have been addressed. Please read the...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Apache Tomcat-Embed-Core

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Apache Tomcat-Embed-Core. Apache Tomcat-Embed-Core is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Apache HttpComponents (CVE-2026-64607, CVE-2026-71290 )

Summary IBM Watson Speech Services Cartridge is vulnerable to Improper Certificate Validation and Missing Release of Resource in Apache HttpComponents, due to flaws in TLS hostname verification and HttpClient. Apache is used in our Speech microservices. These vulnerabilities have been addressed...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in nltk (CVE-2026-62383)

Summary IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in nltk, due to a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypasses nltk.pathsec validation entirely. Nltk is used in our Speech runtimes. This vulnerability has been addressed...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption in Apache Tomcat (CVE-2026-66299)

Summary IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption in Apache Tomcat due to a flaw in in Apache Tomcat's WebSocket chat example. Apache Tomcat is used in our Speech microservices. This vulnerability has been addressed. Please read the details for...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Observable Timing Discrepancy in cryptography (CVE-2026-69247)

Summary IBM Watson Speech Services Cartridge is vulnerable to an Observable Timing Discrepancy in cryptography due to issues in decryption. Cryptography is used in our Speech runtimes. This vulnerability has been addressed. Please read the details for remediation below. Vulnerability Details...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption in Golang Go (CVE-2026-25680)

Summary IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption in Golang Go due to issues while parsing arbitrary HTML. Golang go is used in our Speech utilities. This vulnerability has been addressed. Please read the details for remediation below. Vulnerabilit...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a 'Failing Open' issue in pgjdbc PostgreSQL JDBC Driver (CVE-2026-54291)

Summary IBM Watson Speech Services Cartridge is vulnerable to a 'Failing Open' issue in pgjdbc PostgreSQL JDBC Driver. This is due to a flaw which allows channelBinding=require connections to be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it,...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Insufficient Technical Documentation and Hex Encoding in Apache Tomcat (CVE-2026-59083, CVE-2026-59084)

Summary IBM Watson Speech Services Cartridge is vulnerable to Insufficient Technical Documentation and Hex Encoding in Apache Tomcat. Apache Tomcat is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Apache Tomcat

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Apache Tomcat. Apache Tomcat is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-50229 DESCRIPTION:...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Improperly Controlled Modification of Object Attributes in jackson-databind (CVE-2026-54515)

Summary IBM Watson Speech Services Cartridge is vulnerable to an Improperly Controlled Modification of Object Attributes in jackson-databind. This is due to a flaw in the per-property case-insensitivity block, that overwrites the filtered map — restoring already removed properties and making...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Incorrect Authorization in jackson-databind (CVE-2026-59889)

Summary IBM Watson Speech Services Cartridge is vulnerable to Incorrect Authorization in jackson-databind due to a flaw allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. Jackson-databind is used in our Speech...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Starlette (CVE-2026-54283, CVE-2026-48818, CVE-2026-48817, CVE-2026-54282)

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Starlette. Starlette is a lightweight ASGI framework/toolkit used in our Speech runtimes. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in LangSmith (CVE-2026-16725)

Summary IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in LangSmith due to a flaw in LangSmith SDK's TracingMiddleware that allows the server into accept a malicious HTTP request, reading a file from its local filesystem and uploading the contents to LangSmith as a trace...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in LangChain (CVE-2026-55443)

Summary IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in LangChain, due to several LangChain components that resolve filesystem paths or expand search patterns that do not consistently confine the resolved path to the intended root directory. LangChain is used in our Spee...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Off-by-one Error in Libreswan (CVE-2026-12413)

Summary IBM Watson Speech Services Cartridge is vulnerable to a Off-by-one Error in Libreswan, due to an invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Libreswan is used in our Speech runtimes. This vulnerability has been addressed. Please read the...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in OpenSSH

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in OpenSSH. OpenSSH is used in our Speech runtimes. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-55655 DESCRIPTION: A flaw was found in...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DOS in Libreswan (CVE-2026-50721, CVE-2026-50722)

Summary IBM Watson Speech Services Cartridge is vulnerable to a DOS in Libreswan, due to an Improper Verification of Cryptographic Signature. Libreswan is used in our Speech runtimes. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Unchecked Return Value in Libreswan (CVE-2026-14957)

Summary IBM Watson Speech Services Cartridge is vulnerable to an Unchecked Return Value in Libreswan that can result in a denial of service condition in FIPS mode. Libreswan is used in our Speech Service runtimes This vulnerability has been addressed. Please read the details for remediation below...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Unrestricted Upload of File with Dangerous Type in pip (CVE-2026-3219)

Summary IBM Watson Speech Services Cartridge is vulnerable to an Unrestricted Upload of File with Dangerous Type in pip. Pip is used in our Speech Service Runtimes. This vulnerability has been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-3219...