SB2026090813 - Multiple vulnerabilities in IBM App Connect Enterprise
Published: September 8, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2026-59868)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the js-yaml parser when parsing YAML documents with merge keys enabled. A remote attacker can send a specially crafted YAML document containing a chain of merged mappings to cause a denial of service.
The issue occurs only when merge keys are enabled.
2) Resource exhaustion (CVE-ID: CVE-2026-59870)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in omapTag.addItem() in the !!omap tag handling for YAML11_SCHEMA when parsing crafted YAML input with yaml.load(). A remote attacker can send a specially crafted YAML document to cause a denial of service.
Only applications that parse untrusted YAML with { schema: yaml.YAML11_SCHEMA } are vulnerable.
3) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-73643)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in readFlowCollection in parser.ts when parsing untrusted YAML flow collections via load() or loadAll(). A remote attacker can send a specially crafted small YAML document to cause a denial of service.
A single request can keep one CPU busy for minutes or longer and block the Node event loop, which can stall the whole process.
4) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-55968)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity and allocation of resources without limits or throttling in Node.js server receive transports when processing input. A remote attacker can send specially crafted input to cause a denial of service.
5) Inefficient regular expression complexity (CVE-ID: CVE-2026-69207)
CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient regular expression complexity in the built-in CORS middleware when processing the Access-Control-Request-Headers header during a CORS preflight request. A remote attacker can send a specially crafted OPTIONS request with a long whitespace sequence in the header value to cause a denial of service.
Only applications using cors() with the default or an empty allowHeaders setting reach the affected code path.
6) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-71848)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to algorithmic complexity in languageDetector middleware when processing crafted language tags with a large number of hyphen-separated subtags. A remote attacker can send a specially crafted request to cause a denial of service.
Language values may be sourced from a query parameter, cookie, Accept-Language header, or URL path depending on configuration, and the default detector order exposes query-string, cookie, and header-based processing.
7) Information disclosure (CVE-ID: CVE-2026-71849)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper handling of connection-scoped response headers in Proxy Helper (hono/proxy) when forwarding proxied origin responses. A remote attacker can cause an application to proxy a response that names additional headers in the Connection header to disclose sensitive information.
Only applications that proxy responses from origins that list custom header names in the Connection response header are affected.
8) Exposure of Data Element to Wrong Session (CVE-ID: CVE-2026-71850)
CWE-ID: CWE-488 - Exposure of Data Element to Wrong Session
CVSSv4: 5.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to exposure of data element to wrong session in the memo() function in hono/jsx when rendering server-side components that read request-specific ambient context through memoized rendering with comparator-equal props. A remote user can trigger rendering of a specially crafted request sequence to disclose sensitive information.
User interaction is required, and exploitation depends on both requests reaching the same warm instance in an order that populates the retained render output.
Remediation
Install update from vendor's website.