SB2026081925 - Multiple vulnerabilities in IBM App Connect for Manufacturing
Published: August 19, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Improper Certificate Validation (CVE-ID: CVE-2026-50010)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper certificate validation in X509TrustManagerWrapper within netty-handler when establishing client TLS connections with a user-supplied plain X509TrustManager. A remote attacker can present a certificate for an unexpected hostname to disclose sensitive information.
The issue occurs because hostname verification is not performed in this configuration, even when HTTPS endpoint identification is expected by default.
2) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-50020)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to smuggle HTTP requests.
The vulnerability exists due to inconsistent interpretation of HTTP requests in HttpObjectDecoder when parsing requests with non-CRLF control characters before the request-line. A remote attacker can send a specially crafted request to smuggle HTTP requests.
The issue can cause request-boundary confusion when a front-end component interprets the prepended bytes differently in pipelined or multiplexed transports.
3) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-45416)
CWE-ID: CWE-789 - Uncontrolled Memory Allocation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled memory allocation in SslClientHelloHandler.decode() when processing a TLS ClientHello that does not fit in the first record. A remote attacker can send a specially crafted ClientHello with a large handshake length to cause a denial of service.
The issue is exposed by the commonly used SniHandler and AbstractSniHandler constructors because they disable the client hello length guard and do not schedule a handshake timeout.
4) Incorrect Comparison (CVE-ID: CVE-2026-44249)
CWE-ID: CWE-697 - Incorrect Comparison
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass IPv6 subnet access controls.
The vulnerability exists due to incorrect comparison in IpSubnetFilterRule.compareTo() when evaluating IPv6 subnet rules. A remote attacker can use a valid public IP address to bypass IPv6 subnet access controls.
The issue is caused by applying a bitwise AND operation to the configured networkAddress instead of the subnetMask.
Remediation
Install update from vendor's website.