SB20260919172 - Multiple vulnerabilities in IBM Db2 Developer Extension



SB20260919172 - Multiple vulnerabilities in IBM Db2 Developer Extension

Published: September 19, 2026

Security Bulletin ID SB20260919172
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 60% Low 40%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Session Fixation (CVE-ID: CVE-2026-41839)

CWE-ID: CWE-384 - Session Fixation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and modify data associated with an authenticated user's session.

The vulnerability exists due to improper session management in the WebFlux session handling mechanism when processing requests from a compromised subdomain. A remote attacker can exchange a known session ID for that of an authenticated user to disclose sensitive information and modify data associated with an authenticated user's session.

Exploitation requires user interaction and a compromised subdomain, for example through cross-site scripting.


2) Memory leak (CVE-ID: CVE-2026-41840)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to memory leakage in multipart request processing in Spring WebFlux when processing multipart requests. A remote attacker can send malicious multipart requests to cause a denial of service.

The issue affects applications that implement a web endpoint that receives multipart requests.


3) Cross-site scripting (CVE-ID: CVE-2026-41845)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script code in the victim's browser.

The vulnerability exists due to incorrect escaping in JavaScriptUtils.javaScriptEscape() when processing input for JavaScript output. A remote attacker can supply crafted input to execute arbitrary script code in the victim's browser.

User interaction is required to load the affected content in a browser.


4) Input validation error (CVE-ID: CVE-2026-41853)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass WAF or proxy checks.

The vulnerability exists due to improper input validation in multipart request handling in Spring MVC and Spring WebFlux when processing multipart requests. A remote attacker can send a malicious multipart request to bypass WAF or proxy checks.

Exploitation requires the application to accept multipart requests and to be protected by a WAF or proxy that parses multipart requests and performs checks based on their content.


5) Input validation error (CVE-ID: CVE-2026-41854)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform server-side request forgery.

The vulnerability exists due to incorrect host parsing in uricomponentsbuilder when parsing and validating an externally provided URL string. A remote attacker can supply a crafted URL string to perform server-side request forgery.

User interaction is required.


Remediation

Install update from vendor's website.