SB2026031708 - Multiple vulnerabilities in IBM Planning Analytics Local
Published: March 17, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2025-15284)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the arrayLimit option does not enforce limits for bracket notation (a[]=1&a[]=2). A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
2) Improper certificate validation (CVE-ID: CVE-2025-61727)
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists in crypto/x509 due to incorrect handling of wildcard SANs in the leaf certificate when processing excluded constraint in a certificate chain. A remote attacker can create a specially crafted certificate and bypass implemented domain restrictions and perform MitM or phishing attacks.
3) Resource exhaustion (CVE-ID: CVE-2025-61729)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources within the HostnameError.Error() function in crypto/x509 when printing error string for host certificate validation. A remote attacker can supply a specially crafted certificate to the application and trigger resource exhaustion, leading to a denial of service condition.
4) Information disclosure (CVE-ID: CVE-2026-1267)
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to lack of proper access controls. A remote user can gain unauthorized access to sensitive information on the system.
5) Use of cache containing sensitive information (CVE-ID: CVE-2025-14806)
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote user can trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources.
Remediation
Install update from vendor's website.