SB2026052937 - Multiple vulnerabilities in IBM Library Support for Spring

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026052937

SB2026052937 - Multiple vulnerabilities in IBM Library Support for Spring

Published: May 29, 2026

Security Bulletin ID SB2026052937
CSH Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 50% Medium 25% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Protection Mechanism Failure (CVE-ID: CVE-2026-22732)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper security header handling in HTTP response header writing for servlet applications when using lazy writing of HTTP headers. A remote attacker can trigger application responses where the configured security headers are not written to disclose sensitive information.

This issue affects servlet applications that specify HTTP response headers using Spring Security with lazy header writing enabled.


2) Path traversal (CVE-ID: CVE-2026-22737)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper path limitation in script view templates when rendering views with Java scripting engine enabled and the view name is not explicitly specified. A remote attacker can send a specially crafted request to disclose sensitive information.

Exploitation requires a mapping for "/**" that results in view rendering.


3) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2026-22735)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to corrupt data streams sent to other users.

The vulnerability exists due to improper neutralization of special elements in Server-Sent Events handling in Spring MVC and Spring WebFlux when streaming plain text Server-Sent Events to clients. A remote user can control data that is streamed to other users to corrupt data streams sent to other users.

The issue is exposed only when plain text messages are used instead of a structured format such as JSON, and user interaction is required.


4) Improper access control (CVE-ID: CVE-2026-22733)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to bypass authentication and disclose sensitive information.

The vulnerability exists due to improper access control in application endpoints declared under the CloudFoundry Actuator path when handling requests to authenticated application endpoints mapped beneath that path. A remote attacker can send a request to the affected endpoint to bypass authentication and disclose sensitive information.

The issue occurs only when an authenticated application endpoint is exposed under a subpath used by the CloudFoundry Actuator endpoints.


Remediation

Install update from vendor's website.

References