SB2026072414 - Multiple vulnerabilities in IBM App Connect Enterprise
Published: July 24, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Incomplete cleanup (CVE-ID: CVE-2026-5038)
CWE-ID: CWE-459 - Incomplete cleanup
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to incomplete cleanup in diskStorage when handling aborted or malformed multipart uploads. A remote attacker can send a malformed multipart upload or abort an upload to cause a denial of service.
Exploitation causes orphaned partial files to accumulate on disk.
2) Resource exhaustion (CVE-ID: CVE-2026-5079)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the append-field dependency used by multipart form data processing when parsing deeply nested field names in bracket notation. A remote attacker can send a specially crafted multipart request to cause a denial of service.
A single HTTP request is sufficient to trigger the issue.
3) CRLF injection (CVE-ID: CVE-2026-12143)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to inject arbitrary data in server response.
The vulnerability exists due to insufficient validation of attacker-supplied data. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior.
4) Uncontrolled Recursion (CVE-ID: CVE-2026-54269)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in protobufjs runtime helpers when processing schema-derived names that shadow runtime-significant properties. A remote attacker can provide a crafted protobuf schema or protobufjs JSON descriptor to cause a denial of service.
Exploitation requires the application to load or use a schema or descriptor containing a problematic name and to reach the affected API path.
5) Interpretation Conflict (CVE-ID: CVE-2026-53655)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to hide archive members from security tooling or downstream processing.
The vulnerability exists due to interpretation conflict in Header.decode in node-tar's tar parser when parsing an attacker-supplied tar archive containing a PAX extended header before intermediary GNU long-name or long-link headers. A remote attacker can supply a specially crafted archive to hide archive members from security tooling or downstream processing.
The issue occurs because PAX overrides such as size are applied to intermediary metadata headers, which can desynchronize parsing and cause different tar implementations to report different archive contents.
Remediation
Install update from vendor's website.