SB2026080430 - Multiple vulnerabilities in IBM Maximo Application Suite - Visual Inspection Component

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080430

SB2026080430 - Multiple vulnerabilities in IBM Maximo Application Suite - Visual Inspection Component

Published: August 4, 2026

Security Bulletin ID SB2026080430
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Permissive List of Allowed Inputs (CVE-ID: CVE-2026-11525)

CWE-ID: CWE-183 - Permissive List of Allowed Inputs

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to weaken SameSite cookie policy enforcement.

The vulnerability exists due to permissive list of allowed inputs in the Set-Cookie header parser when parsing Set-Cookie headers from server responses. A remote attacker can send a specially crafted Set-Cookie header to weaken SameSite cookie policy enforcement.

The issue affects applications that forward or rely on the parsed sameSite attribute from server responses.


2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-12151)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the WebSocket client message fragmentation handling when processing fragmented WebSocket messages from a server. A remote attacker can send many small or empty continuation frames to cause a denial of service.

Exploitation requires the application to connect to an attacker-controlled or compromised WebSocket endpoint using the WebSocket client or the WebSocketStream API.


3) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-6733)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause responses to be delivered to the wrong requests.

The vulnerability exists due to a time-of-check time-of-use race condition in the HTTP/1.1 client when reusing keep-alive sockets. A remote attacker can inject an unsolicited HTTP/1.1 response onto an idle socket to cause responses to be delivered to the wrong requests.

Exploitation requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.


4) CRLF injection (CVE-ID: CVE-2026-9679)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject arbitrary HTTP response headers.

The vulnerability exists due to improper neutralization of CRLF sequences in the parseSetCookie cookie parser when processing a crafted Set-Cookie header containing percent-encoded delimiter bytes. A remote attacker can supply a specially crafted upstream Set-Cookie header to inject arbitrary HTTP response headers.

Exploitation requires an application to parse a Set-Cookie header using parseSetCookie, parseCookie, or getSetCookies and then forward the parsed value into a downstream response header.


Remediation

Install update from vendor's website.

References