SB2026091611 - Multiple vulnerabilities in IBM Sterling B2B Integrator and IBM Sterling File Gateway
Published: September 16, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 16 vulnerabilities.
1) Improper Resource Shutdown or Release (CVE-ID: CVE-2026-48006)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in RedisArrayAggregator when a Redis pipeline connection closes before a RESP array aggregate completes. A remote attacker can repeatedly open and close connections to cause a denial of service.
The issue leaks pooled direct-memory buffers retained in per-handler state, which can exhaust the shared direct-memory pool and trigger allocation failures across Netty channels in the same process.
2) Memory leak (CVE-ID: CVE-2026-48059)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper memory management in the HAProxy PROXY protocol v2 codec when parsing syntactically valid headers containing nested PP2_TYPE_SSL TLVs. A remote attacker can send a specially crafted header to cause a denial of service.
The issue occurs on the successful parse path without throwing an exception, and the underlying pooled cumulation buffer remains pinned even if the application releases the HAProxyMessage normally.
3) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-48043)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a reference-count leak in DelegatingDecompressorFrameListener when processing HTTP/2 frames that cause the flow-controller to throw. A remote attacker can send crafted frames to cause a denial of service.
The issue may exhaust memory and eventually take down the JVM due to an out-of-memory error.
4) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-50020)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to smuggle HTTP requests.
The vulnerability exists due to inconsistent interpretation of HTTP requests in HttpObjectDecoder when parsing requests with non-CRLF control characters before the request-line. A remote attacker can send a specially crafted request to smuggle HTTP requests.
The issue can cause request-boundary confusion when a front-end component interprets the prepended bytes differently in pipelined or multiplexed transports.
5) Resource exhaustion (CVE-ID: CVE-2026-50560)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of SETTINGS_MAX_HEADER_LIST_SIZE in the netty http/2 codec when processing http/2 requests with a client-supplied maximum header list size setting. A remote attacker can send specially crafted http/2 requests to cause a denial of service.
The issue is similar in effect to the HTTP/2 Rapid Reset attack but has a different on-the-wire signature.
6) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-50011)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in RedisArrayAggregator when processing RESP array headers. A remote attacker can send a specially crafted array header with a large declared element count to cause a denial of service.
The backing array allocation is attempted based on the declared array length before the corresponding child messages are received.
7) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-45416)
CWE-ID: CWE-789 - Uncontrolled Memory Allocation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled memory allocation in SslClientHelloHandler.decode() when processing a TLS ClientHello that does not fit in the first record. A remote attacker can send a specially crafted ClientHello with a large handshake length to cause a denial of service.
The issue is exposed by the commonly used SniHandler and AbstractSniHandler constructors because they disable the client hello length guard and do not schedule a handshake timeout.
8) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-45536)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource shutdown in netty_unix_socket_recvFd when receiving SCM_RIGHTS control messages containing two file descriptors over a unix domain socket. A remote attacker can send a specially crafted message to cause a denial of service.
The issue is reachable via Epoll/KQueue DomainSocketChannel only when the application enables DomainSocketReadMode.FILE_DESCRIPTORS.
9) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-44893)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource management in HAProxyMessage.readNextTLV() when decoding a PP2_TYPE_SSL TLV with an invalid length. A remote attacker can send a specially crafted HAProxy TLV to cause a denial of service.
The issue is triggered when the TLV length is set below 5, causing an IndexOutOfBoundsException to propagate while a retained slice on the pooled cumulation buffer is not released.
10) Resource exhaustion (CVE-ID: CVE-2023-44487) Exploited
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improperly control of consumption for internal resources when handling HTTP/2 requests with compressed HEADERS frames. A remote attacker can send a sequence of compressed HEADERS frames followed by RST_STREAM frames and perform a denial of service (DoS) attack, a.k.a. "Rapid Reset".
Note, the vulnerability is being actively exploited in the wild.
11) Information disclosure (CVE-ID: CVE-2026-41715)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose credentials.
The vulnerability exists due to improper handling of credential forwarding in the Reactor Netty HTTP client redirect handling when following redirects from a secure endpoint to an insecure endpoint. A remote attacker can trigger a protocol downgrade redirect to disclose credentials.
The HTTP client must be explicitly configured to follow redirects, and user interaction is required.
12) Incorrect Comparison (CVE-ID: CVE-2026-44249)
CWE-ID: CWE-697 - Incorrect Comparison
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass IPv6 subnet access controls.
The vulnerability exists due to incorrect comparison in IpSubnetFilterRule.compareTo() when evaluating IPv6 subnet rules. A remote attacker can use a valid public IP address to bypass IPv6 subnet access controls.
The issue is caused by applying a bitwise AND operation to the configured networkAddress instead of the subnetMask.
13) Improper Certificate Validation (CVE-ID: CVE-2026-50010)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper certificate validation in X509TrustManagerWrapper within netty-handler when establishing client TLS connections with a user-supplied plain X509TrustManager. A remote attacker can present a certificate for an unexpected hostname to disclose sensitive information.
The issue occurs because hostname verification is not performed in this configuration, even when HTTPS endpoint identification is expected by default.
14) Resource exhaustion (CVE-ID: CVE-2026-44890)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in RedisDecoder when processing crafted Redis payloads that omit the required \r\n terminator. A remote attacker can send specially crafted Redis payloads across multiple concurrent connections to cause a denial of service.
Exploitation requires multiple concurrent connections to exhaust the direct memory pool and trigger an OutOfDirectMemoryError.
15) Resource exhaustion (CVE-ID: CVE-2026-44250)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in RedisArrayAggregator when processing deeply nested Redis array headers. A remote attacker can send a specially crafted Redis payload to cause a denial of service.
The issue can lead to memory exhaustion and an OutOfMemoryError in applications that handle untrusted Redis traffic.
16) Resource exhaustion (CVE-ID: CVE-2026-47244)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the HTTP/2 stream management logic when handling HTTP/2 connections without an explicitly configured concurrent stream limit. A remote attacker can open a large number of streams over a single TCP connection to cause a denial of service.
The issue occurs when the application does not explicitly configure a maximum concurrent streams setting.
Remediation
Install update from vendor's website.