SB2026092109 - Multiple vulnerabilities in IBM Event Processing

Description

This security bulletin contains information about 22 vulnerabilities.

1) Interpretation Conflict (CVE-ID: CVE-2026-44576)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause cache poisoning that results in component payloads being served instead of the expected HTML.

The vulnerability exists due to interpretation conflict in React Server Component response handling when shared caches do not correctly partition response variants. A remote attacker can cause an RSC response to be served from the original URL to cause cache poisoning that results in component payloads being served instead of the expected HTML.

The issue affects applications using React Server Components with shared caches under affected conditions.

2) Interpretation Conflict (CVE-ID: CVE-2026-13676)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to modify data on the system.

The vulnerability exists due to fast-uri fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. A remote attacker can trigger the vulnerability to modify data on the system.

3) Out-of-bounds write (CVE-ID: CVE-2026-41907)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to accepting external output buffers, but not rejecting out-of-range writes (small buf or large offset). A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.

4) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-41988)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 2 [CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N]

The vulnerability allows a local user to modify data on the system.

The vulnerability exists due to uuid can make unexpected writes when external output buffers are used. A local user can gain unauthorized access to modify data on the system.

5) Excessive Iteration (CVE-ID: CVE-2026-64641)

CWE-ID: CWE-834 - Excessive Iteration

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to excessive iteration in App Router server actions handling when processing crafted requests. A remote attacker can send crafted requests to cause a denial of service.

Only applications using App Router with at least one Server Action are vulnerable.

6) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-64643)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose internal Server Function endpoints.

The vulnerability exists due to insertion of sensitive information into sent data in publicly served client artifacts when exposing Server Action references. A remote attacker can access client artifacts containing action references to disclose internal Server Function endpoints.

This affects applications using App Router with Server Actions or use cache, and the disclosure is typically a recon or enumeration primitive.

7) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-64645)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N]

The vulnerability allows a remote attacker to perform server-side request forgery.

The vulnerability exists due to improper neutralization of user-controlled input in rewrites() and redirects() destination hostname handling when constructing an external destination hostname from request-controlled input. A remote attacker can send a specially crafted request to perform server-side request forgery.

For rewrite rules, the application proxies the request to the attacker-selected host and serves the response from the application's origin.

8) Prototype pollution (CVE-ID: CVE-2025-64718)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation. A remote attacker can pass specially crafted input to the application and perform prototype pollution attacks.

9) Acceptance of Extraneous Untrusted Data With Trusted Data (CVE-ID: CVE-2026-44572)

CWE-ID: CWE-349 - Acceptance of Extraneous Untrusted Data With Trusted Data

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to acceptance of extraneous untrusted data with trusted data in middleware / proxy redirect handling when processing a normal request with a spoofed x-nextjs-data header on a path that returns a redirect. A remote attacker can send a specially crafted request to cause a denial of service.

Exploitation requires the application to be deployed behind a caching CDN or reverse proxy that caches 3xx responses for the affected path without varying on the x-nextjs-data header.

10) Improper access control (CVE-ID: CVE-2026-44573)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in middleware authorization for Pages Router data routes when handling locale-less /_next/data//.json requests. A remote attacker can send a specially crafted request to disclose sensitive information.

Only applications using the Pages Router with i18n configured and relying on middleware or proxy-based authorization for protected page data are vulnerable.

11) Interpretation Conflict (CVE-ID: CVE-2026-16221)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass host-based policy checks and route requests to an unintended destination.

The vulnerability exists due to interpretation conflict in the fast-uri URL parser when parsing URLs containing a literal backslash in the authority section for special schemes. A remote attacker can supply a specially crafted URL to bypass host-based policy checks and route requests to an unintended destination.

This issue can occur when an application validates a URL with fast-uri and then passes the same input to Node's WHATWG URL parser or fetch-related consumers, which extract a different host from the same string.

12) Improper access control (CVE-ID: CVE-2026-44578)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in WebSocket upgrade handling in the built-in Node.js server when processing crafted WebSocket upgrade requests. A remote attacker can send a specially crafted WebSocket upgrade request to disclose sensitive information.

Only self-hosted applications using the built-in Node.js server are affected; Vercel-hosted deployments are not affected.

13) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-14257)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in expand() when processing attacker-influenced brace expansion patterns. A remote attacker can send a specially crafted input string to cause a denial of service.

The issue can terminate the Node process with an uncatchable out-of-memory error.

14) Cross-site scripting (CVE-ID: CVE-2026-44580)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary JavaScript in a visitor's browser.

The vulnerability exists due to improper neutralization of input during web page generation in beforeInteractive script content serialization when embedding untrusted content into the document. A remote attacker can supply specially crafted input to execute arbitrary JavaScript in a visitor's browser.

User interaction is required to load the affected page.

15) Cross-site scripting (CVE-ID: CVE-2026-44581)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary script in victims' browsers.

The vulnerability exists due to cross-site scripting in App Router HTML rendering when processing malformed nonce values derived from request headers behind shared caches. A remote attacker can supply a malformed nonce value to poison cached responses and execute arbitrary script in victims' browsers.

User interaction is required, and exploitation affects App Router applications that rely on CSP nonces when deployed behind shared caches.

16) Reversible One-Way Hash (CVE-ID: CVE-2026-44582)

CWE-ID: CWE-328 - Use of Weak Hash

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to poison shared cache entries and cause users to receive the wrong response variant for a given URL.

The vulnerability exists due to use of a weak hash in the React Server Component cache-busting mechanism when generating the _rsc cache-busting value for shared caches with insufficient response partitioning. A remote attacker can trigger collisions in crafted requests to poison shared cache entries and cause users to receive the wrong response variant for a given URL.

Only deployments that rely on shared caches with insufficient response partitioning are vulnerable.

17) Resource exhaustion (CVE-ID: CVE-2026-34043)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the serialize() function when serializing a specially crafted array-like object. A remote attacker can supply a crafted array-like object to cause a denial of service.

Exploitation can cause 100% CPU usage and the process may hang indefinitely.

18) Uncontrolled Recursion (CVE-ID: CVE-2026-9358)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the toString function in src/selectors/container.js of the AST serialization component when serializing a manipulated AST. A remote attacker can execute a manipulation to cause a denial of service.

User interaction is required.

19) Integer overflow (CVE-ID: CVE-2026-59879)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in List#set, List#setIn, List#updateIn, List#setSize, and the related functional set, setIn, and updateIn operations when processing a crafted index, size, or key-path segment in the range [2 ** 30, 2 ** 31). A remote attacker can send a specially crafted request to cause a denial of service.

A single small unauthenticated request can trigger an uncatchable infinite loop on an empty List or unbounded allocation leading to process abort on a populated List.

20) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-59880)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in Immutable.Map and Immutable.Set collision bucket handling when processing attacker-controlled object keys. A remote attacker can supply many crafted colliding keys to cause a denial of service.

Applications are affected when untrusted input is used as keys in Immutable structures rather than only as values under fixed keys.

21) Resource exhaustion (CVE-ID: CVE-2026-59869)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the js-yaml parser when parsing YAML documents containing chained merge keys. A remote attacker can send a specially crafted YAML document to cause a denial of service.

The issue results in quadratic CPU consumption for input whose size grows only linearly.

22) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-44577)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the Image Optimization API when handling requests to the /_next/image endpoint for large local assets matching configured local patterns. A remote attacker can request large local assets to cause a denial of service.

Only self-hosted deployments using the default image loader are vulnerable. By default, all local patterns are allowed.

Remediation

Install update from vendor's website.

References

• https://www.ibm.com/support/pages/node/7288577