SB2026090335 - Multiple vulnerabilities in IBM Netezza Appliance
Published: September 3, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-44893)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource management in HAProxyMessage.readNextTLV() when decoding a PP2_TYPE_SSL TLV with an invalid length. A remote attacker can send a specially crafted HAProxy TLV to cause a denial of service.
The issue is triggered when the TLV length is set below 5, causing an IndexOutOfBoundsException to propagate while a retained slice on the pooled cumulation buffer is not released.
2) Memory leak (CVE-ID: CVE-2026-48059)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper memory management in the HAProxy PROXY protocol v2 codec when parsing syntactically valid headers containing nested PP2_TYPE_SSL TLVs. A remote attacker can send a specially crafted header to cause a denial of service.
The issue occurs on the successful parse path without throwing an exception, and the underlying pooled cumulation buffer remains pinned even if the application releases the HAProxyMessage normally.
Remediation
Install update from vendor's website.