SB2026101332 - Multiple vulnerabilities in IBM Netezza Performance Server

Description

This security bulletin contains information about 7 vulnerabilities.

1) Unsafe reflection (CVE-ID: CVE-2026-19032)

CWE-ID: CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use of externally controlled input to select classes or code in JDKFromStringDeserializer.NioPathHelper.deserialize when deserializing untrusted JSON into a java.nio.file.Path field. A remote attacker can supply a specially crafted URI scheme to drive FileSystemProvider resolution and cause a denial of service.

Exploitation occurs during readValue, and meaningful side effects beyond the reported availability impact depend on the presence of a side-effecting third-party FileSystemProvider on the classpath.

2) Resource exhaustion (CVE-ID: CVE-2026-68497)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in CoreXMLDeserializers when deserializing JSON string values into javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar fields. A remote attacker can send a specially crafted request to cause a denial of service.

The issue is reachable with the default mapper configuration and does not require polymorphic typing or special configuration.

3) Deserialization of Untrusted Data (CVE-ID: CVE-2026-83557)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to instantiate an unintended object and disclose, modify, or affect data handling.

The vulnerability exists due to deserialization of untrusted data in DefaultBaseTypeLimitingValidator when processing polymorphic type identifiers for @JsonTypeInfo-annotated Comparable-typed values without a custom PolymorphicTypeValidator. A remote attacker can supply a crafted type identifier to instantiate an attacker-chosen Comparable implementation to disclose, modify, or affect data handling.

Only the default, unconfigured validator path reached through bare @JsonTypeInfo usage is affected; configurations using activateDefaultTyping() with an explicit restrictive PolymorphicTypeValidator are not affected.

4) Resource exhaustion (CVE-ID: CVE-2026-91776)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in TypeDeserializerBase._findDeserializer() and its _deserializers cache when processing attacker-influenced unknown type IDs with name-based polymorphism and a configured fallback implementation. A remote attacker can supply distinct unknown type IDs to cause a denial of service.

Exploitation requires reuse of a long-lived mapper or type deserializer across requests.

5) Resource exhaustion (CVE-ID: CVE-2026-91777)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in forward-reference completion in CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the corresponding map implementation when resolving reverse-order object-ID references during deserialization. A remote attacker can submit JSON containing unresolved identity references followed by definitions of the same IDs in reverse order to cause a denial of service.

Exploitation requires the application to deserialize JSON into an identity-enabled collection or map.

6) Inefficient regular expression complexity (CVE-ID: CVE-2026-89407)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in the NumberInput.PATTERN_FLOAT regular expression when processing attacker-controlled numeric-looking strings through looksLikeValidNumber(). A remote attacker can submit a crafted numeric-looking string to cause a denial of service.

Applications that coerce String-typed JSON fields to numbers can invoke the affected validation path.

7) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-89425)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in UTF8DataInputJsonParser._reportInvalidToken() when processing malformed JSON tokens through a DataInput-backed parser. A remote attacker can supply a malformed token to cause a denial of service.

Remediation

Install update from vendor's website.

References

• https://www.ibm.com/support/pages/node/7292038