SB2026092908 - Multiple vulnerabilities in IBM InfoSphere Optim Archive Viewer
Published: September 29, 2026 Updated: September 30, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2026-67312)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in formDataToJSON when parsing attacker-controlled FormData field names with deeply nested bracket segments. A remote attacker can send crafted FormData input to cause a denial of service.
The issue affects direct use of axios.formToJSON() and JSON serialization of FormData when the Content-Type contains application/json.
2) Uncontrolled Recursion (CVE-ID: CVE-2026-67313)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in formDataToJSON when processing attacker-controlled FormData field names during FormData-to-JSON conversion. A remote attacker can supply a crafted FormData field name with deeply nested bracket segments to cause a denial of service.
The vulnerable request-transform path is reached when FormData is sent with an application/json content type, and direct use of formToJSON() throws synchronously.
3) Prototype pollution (CVE-ID: CVE-2026-67316)
CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to alter request semantics.
The vulnerability exists due to improperly controlled modification of object prototype attributes in bodyless method aliases in lib/core/Axios.js when processing requests after Object.prototype has already been polluted. A remote user can pollute Object.prototype.data to alter request semantics.
Exploitation requires chaining with a separate prototype pollution condition in the same process.
4) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-67317)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause resource consumption and exhaust upstream quotas or bandwidth.
The vulnerability exists due to allocation of resources without limits or throttling in the fetch adapter when processing attacker-controlled unknown-length WHATWG ReadableStream request bodies. A remote attacker can supply a specially crafted streamed request body to cause resource consumption and exhaust upstream quotas or bandwidth.
Exploitation requires an application to use the fetch adapter, set a finite maxBodyLength value, and pass attacker-controlled stream data without a reliable Content-Length.
5) Prototype pollution (CVE-ID: CVE-2026-67319)
CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to tamper with outbound requests and disclose sensitive information.
The vulnerability exists due to improperly controlled modification of object prototype attributes in nested axios request option objects when processing placeholder nested option objects in a JavaScript process with a polluted Object.prototype. A remote user can pollute inherited username, password, encode, or serialize properties to tamper with outbound requests and disclose sensitive information.
Exploitation requires a separate prototype-pollution primitive in the same process, and affected cases include auth or paramsSerializer objects that omit their own relevant properties.
Remediation
Install update from vendor's website.