SB2026090214 - Multiple vulnerabilities in IBM Db2 Developer Extension
Published: September 2, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 vulnerabilities.
1) Open redirect (CVE-ID: CVE-2026-25854)
CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to redirect users to an arbitrary URI.
The vulnerability exists due to improper input validation in LoadBalancerDrainingValve when handling a specially crafted URL while a Tomcat node is in the disabled (draining) state. A remote attacker can send a specially crafted URL to redirect users to an arbitrary URI.
Only clustered deployments using LoadBalancerDrainingValve in the disabled (draining) state are affected.
2) Configuration (CVE-ID: CVE-2026-29129)
CWE-ID: CWE-16 - Configuration
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause the server to use TLS cipher suites in an unintended order.
The vulnerability exists due to improper configuration handling in TLS 1.3 cipher suite configuration when negotiating TLS connections. A remote attacker can initiate a TLS connection to cause the server to use TLS cipher suites in an unintended order.
3) Improper Certificate Validation (CVE-ID: CVE-2026-29145)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass certificate revocation checks during authentication.
The vulnerability exists due to improper certificate validation in CLIENT_CERT authentication when processing OCSP checks in some scenarios with soft fail disabled. A remote user can present a certificate in affected scenarios to bypass certificate revocation checks during authentication.
Only some scenarios are affected when soft fail is disabled.
4) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2026-29146)
CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to decrypt protected communications.
The vulnerability exists due to the use of a padding-oracle-prone cryptographic mode in EncryptInterceptor when processing encrypted traffic with the default CBC configuration. A remote attacker can perform a padding oracle attack to decrypt protected communications.
5) Improper input validation (CVE-ID: CVE-2026-32990)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass strict SNI checks.
The vulnerability exists due to improper input validation in SNI name and host name validation when processing TLS connections. A remote attacker can use differences in case between the SNI name and host name to bypass strict SNI checks.
6) Improper authorization (CVE-ID: CVE-2025-66614)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass client certificate verification.
The vulnerability exists due to Tomcat does not validate that the host name provided via the SNI extension is the same as the host name provided in the HTTP host header field. If there is more than one virtual host configured and the TLS configuration for one of those hosts does not require client certificate authentication, it is possible for a client to bypass the client certificate authentication for the target host by sending different host names in the SNI extension and the HTTP host header field.
Remediation
Install update from vendor's website.