Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues. We have updated the base image used by our Speech Services and the following vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2024-37891...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Uncontrolled Resource Consumption issues in FasterXML jackson-databind

Summary IBM Watson Speech Services Cartridge is vulnerable to Uncontrolled Resource Consumption issues in FasterXML jackson-databind. FasterXML jackson-databind is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Uncontrolled Resource Consumptions in FasterXML jackson-core (CVE-2026-89407, CVE-2026-89425)

Summary IBM Watson Speech Services Cartridge is vulnerable to Uncontrolled Resource Consumptions which can result in OutOfMemory Errors in FasterXML jackson-core. FasterXML jackson-core is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption in jackson-databind (CVE-2026-68497)

Summary IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption in jackson-databind due to deserializer flaws. Jackson-databind is used in our Speech microservices. This vulnerability has been addressed. Please read the details for remediation below. Vulnerabili...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a use after free issue in zstd-jni (CVE-2026-90852)

Summary Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a use after free issue, due to a flaw in the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. in zstd-jni. Zstd-jni is used in our Speech microservices. This...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in zstd-jni.

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in zstd-jni. Zstd-jni is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-87795 DESCRIPTION: zstd-jni...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Out-of-bounds Read and Infinite Loop condition in zstd-jni (CVE-2026-89045, CVE-2026-89046, CVE-2026-90560)

Summary IBM Watson Speech Services Cartridge is vulnerable to an Out-of-bounds Read and Infinite Loop condition in zstd-jni. Zstd-jni is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Uncontrolled Resource Consumptions in Spring Framework (CVE-2026-47886, CVE-2026-59283)

Summary IBM Watson Speech Services Cartridge is vulnerable to Uncontrolled Resource Consumptions in Spring Framework, due to flaws with the the power operator and SpEL expression compiler. Spring framework is used in our Speech microservices. These vulnerabilities have been addressed. Please read...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in nltk

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in nltk. Nltk is used in our Speech runtimes. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-12259 DESCRIPTION: In nltk version 3.9.4, the...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Netty (CVE-2026-62243, CVE-2026-75595, CVE-2026-75596)

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Netty: Improper Validation of Certificate with Host Mismatch, Improper Check for Unusual or Exceptional Conditions, and Inefficient Algorithmic Complexity. Netty is used in our Speech microservices. These...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a memory leak in Netty (CVE-2026-73508)

Summary IBM Watson Speech Services Cartridge is vulnerable to a memory leak in Netty, due to a failure to release memory when receiving a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. Netty is used in our Speech...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an finite Loop in Netty (CVE-2026-59901)

Summary IBM Watson Speech Services Cartridge is vulnerable to an finite Loop in Netty, due to a flaw in Netty's Bzip2Decoder. Netty is used in our Speech microservices. This vulnerability has been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-59901...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption and HTTP Request/Response Smuggling in Netty (CVE-2026-56819, CVE-2026-59900)

Summary IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption and HTTP Request/Response Smuggling in Netty, due to flaws in Netty's HTTP/2-to-HTTP/1.x translation layer and DelegatingDecompressorFrameListener. Netty is used in our Speech microservices. These...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Netty

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Netty. Netty is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-55831 DESCRIPTION: Netty is a network...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Unsafe Reflection and Deserialization of Untrusted Data in jackson-databind (CVE-2026-19032, CVE-2026-83557)

Summary IBM Watson Speech Services Cartridge is vulnerable to Unsafe Reflection and Deserialization of Untrusted Data in jackson-databind, due to issues with the DefaultBaseTypeLimitingValidator and deserializer for java.nio.file. Jackson-databind is used in our Speech microservices. These...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Path-traversal in QOS.CH Sarl Logback-classic (CVE-2026-19880)

Summary IBM Watson Speech Services Cartridge is vulnerable to a Path-traversal in QOS.CH Sarl Logback-classic due to a flaw in an MDC-based discriminator value that flows unsanitized into a nested FileAppender path. The logback-classic module is used in our Speech microservices. This vulnerabilit...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Bouncy Castle for Java

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Bouncy Castle for Java. Bouncy Castle is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-12185...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Bouncy Castle for Java

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Bouncy Castle for Java. Bouncy Castle is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-13505...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Golang go

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Golang go which can result in an Out-of-bounds Read, Infinite Loop, or Improper Validation condition. Golang go is used in our Speech utilities. These vulnerabilities have been addressed. Please read the details for...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to improper restrictions and Cross-site Scripting in Golang go

Summary IBM Watson Speech Services Cartridge is vulnerable to improper restrictions and Cross-site Scripting in Golang go due to a flaw where Render parsing can result in an unexpected HTML tree. Golang go is used in our Speech utilities. These vulnerabilities have been addressed. Please read the...