SB20260919172 - Multiple vulnerabilities in IBM Db2 Developer Extension
Published: September 19, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Session Fixation (CVE-ID: CVE-2026-41839)
CWE-ID: CWE-384 - Session Fixation
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information and modify data associated with an authenticated user's session.
The vulnerability exists due to improper session management in the WebFlux session handling mechanism when processing requests from a compromised subdomain. A remote attacker can exchange a known session ID for that of an authenticated user to disclose sensitive information and modify data associated with an authenticated user's session.
Exploitation requires user interaction and a compromised subdomain, for example through cross-site scripting.
2) Memory leak (CVE-ID: CVE-2026-41840)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to memory leakage in multipart request processing in Spring WebFlux when processing multipart requests. A remote attacker can send malicious multipart requests to cause a denial of service.
The issue affects applications that implement a web endpoint that receives multipart requests.
3) Cross-site scripting (CVE-ID: CVE-2026-41845)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script code in the victim's browser.
The vulnerability exists due to incorrect escaping in JavaScriptUtils.javaScriptEscape() when processing input for JavaScript output. A remote attacker can supply crafted input to execute arbitrary script code in the victim's browser.
User interaction is required to load the affected content in a browser.
4) Input validation error (CVE-ID: CVE-2026-41853)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass WAF or proxy checks.
The vulnerability exists due to improper input validation in multipart request handling in Spring MVC and Spring WebFlux when processing multipart requests. A remote attacker can send a malicious multipart request to bypass WAF or proxy checks.
Exploitation requires the application to accept multipart requests and to be protected by a WAF or proxy that parses multipart requests and performs checks based on their content.
5) Input validation error (CVE-ID: CVE-2026-41854)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform server-side request forgery.
The vulnerability exists due to incorrect host parsing in uricomponentsbuilder when parsing and validating an externally provided URL string. A remote attacker can supply a crafted URL string to perform server-side request forgery.
User interaction is required.
Remediation
Install update from vendor's website.