SB2026082568 - Multiple vulnerabilities in IBM App Connect Enterprise
Published: August 25, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Use of uninitialized resource (CVE-ID: CVE-2026-45736)
CWE-ID: CWE-908 - Use of Uninitialized Resource
CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to use of uninitialized resource in websocket.close() when processing a TypedArray passed as the reason argument. A remote privileged user can pass a crafted TypedArray as the close reason to disclose sensitive information.
The issue is only exploitable through misuse that is unlikely in practice.
2) Resource exhaustion (CVE-ID: CVE-2026-45149)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource consumption in the numeric range expansion logic when processing a string containing a single large numeric range. A remote attacker can supply a specially crafted expansion string to cause a denial of service.
User interaction is required to process the crafted expansion input.
3) Incorrect Control Flow Scoping (CVE-ID: CVE-2026-3449)
CWE-ID: CWE-705 - Incorrect Control Flow Scoping
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. A local user can trigger the vulnerability to cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.
4) NULL pointer dereference (CVE-ID: CVE-2026-8723)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to null pointer dereference in qs.stringify when processing arrays with comma format and encodeValuesOnly enabled. A remote attacker can supply input containing null or undefined array elements to cause a denial of service.
In typical Node.js HTTP frameworks, the synchronous exception usually causes the affected request to return an error rather than terminating the worker process. The vulnerable input is reachable from JSON request bodies or from application code constructing arrays from user input.
Remediation
Install update from vendor's website.