SB2026040715 - Multiple vulnerabilities in IBM Maximo Application Suite
Published: April 7, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 secuirty vulnerabilities.
1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2025-66418)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to missing limits on the number of links in the decompression chain when handling gzip or zstd data in the server response. A malicious server can send a response with a large amount of links and cause high CPU load, leading to a denial of service condition.
2) Resource exhaustion (CVE-ID: CVE-2025-66471)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the streaming API does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
3) Improper handling of highly compressed data (CVE-ID: CVE-2026-21441)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the application does not properly handle highly compressed data when sending HTTP redirect responses. A remote attacker can multiple large requests to the application, consume all available CPU and memory resources and perform a denial of service attack.
4) Insufficient verification of data authenticity (CVE-ID: CVE-2026-26007)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. A remote attacker can provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup.
5) Out-of-bounds write (CVE-ID: CVE-2026-25990)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when loading PSD images. A remote attacker can trigger an out-of-bounds write and execute arbitrary code on the target system.
6) Prototype pollution (CVE-ID: CVE-2025-13465)
The vulnerability allows a remote attacker to alter application's behavior.
The vulnerability exists due to improper input validation within the in the _.unset and _.omit functions. A remote attacker can pass specially crafted input to the application and delete methods from global prototypes.
7) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-25639)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper error handling within proto Key in mergeConfig. A remote attacker can send specially crafted data to the application and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.