SB2026092115 - Multiple vulnerabilities in IBM Db2 Developer Extension
Published: September 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2026-41841)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper access control in the static resource cache in Spring MVC and Spring WebFlux when resolving static resources. A remote attacker can request a publicly available resource with the same name as a protected resource to disclose sensitive information.
Exploitation requires several resource handlers using different resource locations, at least one protected resource handler, and a shared cache across these configurations.
2) Resource exhaustion (CVE-ID: CVE-2026-41842)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in static resource resolution in Spring MVC and Spring WebFlux when resolving versioned resources served from the file system. A remote attacker can send malicious requests that are slow to resolve to cause a denial of service.
Only applications that serve static resources from the file system and have versioned resources support configured are vulnerable.
3) Path traversal (CVE-ID: CVE-2026-41843)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to path traversal in static resource resolution in Spring MVC and WebFlux when handling requests for versioned static resources served from the file system. A remote attacker can send malicious requests to disclose sensitive information.
Exploitation requires that versioned resources support is configured and that the attacker knows or can guess metadata information for targeted resources.
4) Open redirect (CVE-ID: CVE-2026-41844)
CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to redirect users to an arbitrary external host.
The vulnerability exists due to improper control of generation of code in Spring MVC and Spring WebFlux applications when handling requests to a configured "/**" mapping with no explicit view name. A remote attacker can craft a link using the redirect: prefix to redirect users to an arbitrary external host.
User interaction is required to open the crafted link.
5) Cross-site scripting (CVE-ID: CVE-2026-41846)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to inject arbitrary html or javascript code.
The vulnerability exists due to cross-site scripting in JSP <form:*> tags when processing user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes. A remote attacker can supply crafted attribute values to inject arbitrary html or javascript code.
User interaction is required to trigger the injected content.
Remediation
Install update from vendor's website.