SB2026081479 - IBM Watson Speech Services Cartridge update for LangChain

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081479

SB2026081479 - IBM Watson Speech Services Cartridge update for LangChain

Published: August 14, 2026

Security Bulletin ID SB2026081479
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Deserialization of Untrusted Data (CVE-ID: CVE-2026-44843)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and manipulate application behavior.

The vulnerability exists due to unsafe deserialization in the load() deserialization logic when processing untrusted structured input that is later deserialized from LangChain run data. A remote attacker can submit crafted LangChain serialized constructor dictionaries to disclose sensitive information and manipulate application behavior.

Applications are exposed only if untrusted structured input is preserved in run inputs or outputs and later reaches affected runtime surfaces such as RunnableWithMessageHistory, astream_log(), or astream_events(version="v1").


Remediation

Install update from vendor's website.

References