SB2026091015 - Multiple vulnerabilities in IBM Netezza Appliance - Cyclops
Published: September 10, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 17 vulnerabilities.
1) CRLF injection (CVE-ID: CVE-2026-15157)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject arbitrary HTTP headers and potentially smuggle a second request past the upstream.
The vulnerability exists due to improper neutralization of CRLF sequences in lib/dispatcher/client-h1.js when processing a duck-typed blob-like body with an untrusted .type property through the HTTP/1.1 dispatcher. A remote attacker can supply crafted CRLF sequences in the .type value to inject arbitrary HTTP headers and potentially smuggle a second request past the upstream.
User interaction is required because exploitation occurs when an application passes untrusted input into a blob-like body's .type property. Native Blob is not affected, and fetch() is unaffected.
2) Infinite loop (CVE-ID: CVE-2026-67214)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). A remote attacker can consume all available system resources and cause denial of service conditions.
3) Infinite loop (CVE-ID: CVE-2026-59843)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to an infinite loop in channel_write_common() when processing an SSH_MSG_CHANNEL_OPEN request with a maximum packet length of zero. A remote user can send a specially crafted channel open request to cause a denial of service.
Repeating the attack over multiple connections can exhaust CPU resources of the server.
4) Resource exhaustion (CVE-ID: CVE-2026-69152)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the expand() function when processing attacker-controlled brace patterns. A remote attacker can send a specially crafted input to cause a denial of service.
The issue can terminate the Node process with an uncatchable out-of-memory error or block the event loop for an extended period.
5) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-14257)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in expand() when processing attacker-influenced brace expansion patterns. A remote attacker can send a specially crafted input string to cause a denial of service.
The issue can terminate the Node process with an uncatchable out-of-memory error.
6) Use of Web Browser Cache Containing Sensitive Information (CVE-ID: CVE-2026-13697)
CWE-ID: CWE-525 - Use of Web Browser Cache Containing Sensitive Information
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper cache handling in the cache interceptor when processing malformed qualified Cache-Control private directives in shared cache mode. A remote attacker can cause an upstream response with a malformed private directive to be stored in the shared cache and served to a later caller with the same cache key to disclose sensitive information.
Exploitation requires shared cache mode, a later request matching the same cache key, and no separating Vary header.
7) Interpretation Conflict (CVE-ID: CVE-2026-14643)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to interpretation conflict in the cache interceptor when processing Cache-Control directives with optional whitespace around the = character. A remote attacker can send requests that cause authenticated responses to be stored and later served to another caller to disclose sensitive information.
Only applications that explicitly enable shared cache mode, forward Authorization headers upstream, and receive cacheable responses with qualified private or no-cache directives are vulnerable.
8) Use of cache containing sensitive information (CVE-ID: CVE-2026-9678)
CWE-ID: CWE-524 - Use of Cache Containing Sensitive Information
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to use of cache containing sensitive information in the cache interceptor when processing responses with whitespace-padded qualified private or no-cache directives in the Cache-Control header. A remote attacker can send requests that resolve to the same cache key to disclose sensitive information.
Only applications that explicitly enable interceptors.cache() in shared-cache mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified directives are vulnerable.
9) Path traversal (CVE-ID: CVE-2026-69153)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
10) CRLF injection (CVE-ID: CVE-2026-1527)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject arbitrary HTTP headers and smuggle raw data to non-HTTP services.
The vulnerability exists due to improper neutralization of CRLF sequences in the upgrade option of client.request() when processing user-controlled input. A remote attacker can supply a specially crafted upgrade value to inject arbitrary HTTP headers and smuggle raw data to non-HTTP services.
User interaction is required because an application must pass user-controlled input to the upgrade option.
11) Improper access control (CVE-ID: CVE-2026-59851)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to impersonate any local user on the server.
The vulnerability exists due to improper access control in the libssh server gssapi-keyex authentication handling when processing gssapi-keyex authentication requests. A remote user can authenticate with valid Kerberos credentials and request an arbitrary username to impersonate any local user on the server.
Only SSH servers built on libssh with GSSAPIKeyExchange enabled are vulnerable.
12) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-16728)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause downstream response desynchronization, connection hangs, or response corruption.
The vulnerability exists due to inconsistent interpretation of HTTP response framing in interceptors.retry() when retrying or resuming a partial upstream response. A remote attacker can send a partial response with mismatched framing headers to cause downstream response desynchronization, connection hangs, or response corruption.
The issue requires interceptors.retry() to be enabled and a downstream forwarder that forwards upstream headers and bodies without removing or recalculating Content-Length.
CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass cookie security protections and modify cookie attributes.
The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in the setCookie function when processing user-controlled domain or unparsed setCookie fields. A remote attacker can supply crafted input containing cookie attributes to bypass cookie security protections and modify cookie attributes.
Exploitation requires an application to pass user-controlled input to these fields, such as in multi-tenant or reverse-proxy deployments.
14) Resource exhaustion (CVE-ID: CVE-2026-59848)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of unexpected responses in the sftp client response queue when processing server-supplied sftp response packets. A remote attacker can send response packets with unknown request IDs to cause a denial of service.
The issue affects the client side only.
15) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-59845)
CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of fork() failure in ProxyCommand execution in the libssh client when cleaning up a session after executing a ProxyCommand. A local user can trigger a fork() failure and then cause the process to send a KILL signal to process group -1 to cause a denial of service.
This issue affects the client only and typically occurs under low-memory conditions.
16) Infinite loop (CVE-ID: CVE-2026-67213)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. A remote attacker can consume all available system resources and cause denial of service conditions.
17) CRLF injection (CVE-ID: CVE-2022-35948)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject arbitrary data in server response.
The vulnerability exists due to insufficient validation of unsanitized input passed as request headers. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior.
Remediation
Install update from vendor's website.