SB2026030306 - Multiple vulnerabilities in IBM QRadar Pre-Validation App
Published: March 3, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 secuirty vulnerabilities.
1) Race condition (CVE-ID: CVE-2025-32421)
The vulnerability allows a remote attacker to gain access to sensitive information or perform spoofing attack.
The vulnerability exists due to a race condition within the Pages Router. A remote attacker can exploit the race and obtain pageProps data instead of standard HTML code and poison the CDN cache by injecting the response body from a non-cacheable data request (?__nextDataRequest=1) into a normal request that retains cacheable headers, such as Cache-Control: public, max-age=300.
2) Improper authorization (CVE-ID: CVE-2025-29927)
The vulnerability allows a remote attacker to bypass authorization process.
The vulnerability exists due to missing authorization checks. A remote attacker can bypass authorization mechanism and compromise the affected application.
3) Information disclosure (CVE-ID: CVE-2025-55183)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the server may expose the source code of any server function when receiving a specially crafted HTTP request. A remote attacker can gain access to sensitive information.
The vulnerability affects the following components:
- react-server-dom-webpack (Meta)
- react-server-dom-turbopack (Meta)
- react-server-dom-parcel (Meta)
Successful exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.
4) Deserialization of Untrusted Data (CVE-ID: CVE-2025-55184)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can send a specially crafted HTTP request, which can cause an infinite loop and prevent future HTTP requests from being served, leading to a denial of service condition.
The vulnerability affects the following components:
- react-server-dom-webpack (Meta)
- react-server-dom-turbopack (Meta)
- react-server-dom-parcel (Meta)
5) Deserialization of Untrusted Data (CVE-ID: CVE-2025-67779)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can send a specially crafted HTTP request, which can cause an infinite loop and prevent future HTTP requests from being served, leading to a denial of service condition.
The vulnerability affects the following components:
- react-server-dom-webpack (Meta)
- react-server-dom-turbopack (Meta)
- react-server-dom-parcel (Meta)
6) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2025-57822)
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input when next() is used without explicitly passing the request object. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
7) Improper authorization (CVE-ID: CVE-2024-51479)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to an error when handling authorization requests based on pathname. A remote attacker can bypass authorization and gain access to sensitive information.
8) Input validation error (CVE-ID: CVE-2025-55173)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient validation of user-supplied input within the Image Optimization feature. A remote attacker with control over external image sources can trigger file downloads with arbitrary content and filenames under specific configurations and perform phishing attacks.
9) Use of cache containing sensitive information (CVE-ID: CVE-2025-57752)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to improper cache management in Image Optimization API. A remote attacker can gain access to sensitive images cached by the application.
10) Missing Origin Validation in WebSockets (CVE-ID: CVE-2025-48068)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to missing origin validation on the WebSocket interface if the project uses the App Router. When running next dev, a malicious website can open a WebSocket connection to localhost and access component source code.
11) Resource management error (CVE-ID: CVE-2024-56332)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of internal resources in Server Actions handler. A remote attacker can send specially crafted requests to force the server to keep connections open and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.