SB20260917196 - Uncontrolled Recursion in IBM Tivoli Business Service Manager and IBM Tivoli Netcool Impact

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260917196

SB20260917196 - Uncontrolled Recursion in IBM Tivoli Business Service Manager and IBM Tivoli Netcool Impact

Published: September 17, 2026 Updated: September 30, 2026

Security Bulletin ID SB20260917196
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Uncontrolled Recursion (CVE-ID: CVE-2026-16440)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the class file annotation parser in runtime/bcutil/cfreader.c when loading a crafted .class file with deeply nested annotations. A remote user can supply a specially crafted class file to cause a denial of service.

The JVM crashes during class loading in native code before any bytecode executes, and user interaction is required to load the crafted class file.


Remediation

Install update from vendor's website.

References