SB20260917194 - Multiple vulnerabilities in Network Threat Analytics App for IBM QRadar SIEM
Published: September 17, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 vulnerabilities.
1) Infinite loop (CVE-ID: CVE-2026-43871)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an infinite loop in TCompactProtocol varint handling when parsing input. A remote attacker can send specially crafted serialized data to cause a denial of service.
2) Improper handling of highly compressed data (CVE-ID: CVE-2026-48586)
CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of highly compressed data in TZlibTransport when processing compressed input. A remote attacker can send specially crafted compressed data to cause a denial of service.
3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-14257)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in expand() when processing attacker-influenced brace expansion patterns. A remote attacker can send a specially crafted input string to cause a denial of service.
The issue can terminate the Node process with an uncatchable out-of-memory error.
4) Resource exhaustion (CVE-ID: CVE-2026-69152)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the expand() function when processing attacker-controlled brace patterns. A remote attacker can send a specially crafted input to cause a denial of service.
The issue can terminate the Node process with an uncatchable out-of-memory error or block the event loop for an extended period.
5) Improper access control (CVE-ID: CVE-2026-66010)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script code.
The vulnerability exists due to improper access control in the CUSTOM_ELEMENT_HANDLING sanitization logic when processing allowed custom elements. A remote attacker can supply specially crafted HTML content to execute arbitrary script code.
The bypass affects the afterSanitizeElements hook and the payload becomes executable only after a custom element writes sanitized data into innerHTML.
6) Information disclosure (CVE-ID: CVE-2026-44431)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to exposure of sensitive information in ProxyManager.connection_from_url().urlopen() when following cross-origin redirects with assert_same_host=False through a proxy. A remote attacker can trigger a cross-origin redirect to disclose sensitive information.
Sensitive headers such as Authorization, Cookie, and Proxy-Authorization may be forwarded across origins in this low-level redirect flow.
7) Improper handling of highly compressed data (CVE-ID: CVE-2026-44432)
CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of highly compressed data in the urllib3 streaming API when processing compressed HTTP responses from untrusted sources. A remote attacker can send a highly compressed response to cause a denial of service.
Exploitation requires either incremental reads of a Brotli-encoded response with at least two read or stream calls while using the official Brotli library, or calling HTTPResponse.drain_conn() after decompression has already started.
8) Improper handling of highly compressed data (CVE-ID: CVE-2026-41608)
CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of highly compressed data in Python THeaderTransport when processing compressed input. A remote attacker can send specially crafted compressed data to cause a denial of service.
9) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-66053)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass hostname verification in TLS certificate validation.
The vulnerability exists due to improper validation of certificate with host mismatch in the Python TSSLSocket hostname matcher import in Apache Thrift Python bindings when establishing TLS connections. A remote attacker can present a certificate with a mismatched hostname to bypass hostname verification in TLS certificate validation.
10) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-41603)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to impersonate a trusted host.
The vulnerability exists due to improper validation of certificate with host mismatch in Java TSSLTransportFactory when establishing TLS connections. A remote attacker can present a certificate with a mismatched hostname to impersonate a trusted host.
Remediation
Install update from vendor's website.