SB2026091105 - Multiple vulnerabilities in IBM Db2
Published: September 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2026-55831)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in DefaultSpdySettingsFrame settings map handling when processing a crafted SPDY/3.1 SETTINGS frame. A remote attacker can send a specially crafted SETTINGS frame to cause a denial of service.
Exploitation requires the target to accept SPDY/3.1 traffic through a Netty pipeline containing SpdyFrameCodec.
2) Input validation error (CVE-ID: CVE-2026-55833)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in the SPDY header decoder in SpdyFrameCodec when processing zlib-compressed SPDY header blocks after maxHeaderSize truncation. A remote attacker can send a specially crafted HEADERS frame to cause a denial of service.
Exploitation requires a reachable SPDY pipeline using SpdyFrameCodec and a decoder path that selects the zlib decoder.
3) Incorrect Comparison (CVE-ID: CVE-2026-44249)
CWE-ID: CWE-697 - Incorrect Comparison
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass IPv6 subnet access controls.
The vulnerability exists due to incorrect comparison in IpSubnetFilterRule.compareTo() when evaluating IPv6 subnet rules. A remote attacker can use a valid public IP address to bypass IPv6 subnet access controls.
The issue is caused by applying a bitwise AND operation to the configured networkAddress instead of the subnetMask.
4) Memory leak (CVE-ID: CVE-2026-56819)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in Http2Decompressor.decompress(...) in DelegatingDecompressorFrameListener when processing HTTP/2 DATA frames for a stream whose decompressor channel has already been closed. A remote attacker can send specially crafted HTTP/2 DATA frames to cause a denial of service.
Only applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener are vulnerable.
5) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-56745)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource management in the SpdyHttpDecoder handler when processing a client-initiated SYN_STREAM frame followed by an RST_STREAM frame or oversized content. A remote attacker can send crafted SPDY frames to cause a denial of service.
The issue leaks a pooled ByteBuf by removing the partially constructed FullHttpRequest from an internal map without releasing the underlying buffer.
6) Improper access control (CVE-ID: CVE-2026-56746)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to a logical operator error in the origin evaluation process. A remote attacker can send a specially crafted request to bypass the short-circuit mechanism.
7) Improper Certificate Validation (CVE-ID: CVE-2026-50010)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper certificate validation in X509TrustManagerWrapper within netty-handler when establishing client TLS connections with a user-supplied plain X509TrustManager. A remote attacker can present a certificate for an unexpected hostname to disclose sensitive information.
The issue occurs because hostname verification is not performed in this configuration, even when HTTPS endpoint identification is expected by default.
Remediation
Install update from vendor's website.