SB2026101334 - Multiple vulnerabilities in IBM Netezza Performance Server
Published: October 13, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-59282)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in Spring data binding infrastructure when applying user-supplied property paths onto a target object. A remote attacker can supply a property path with an arbitrarily large index into a nested sub-property to cause a denial of service.
Exploitation requires the target object to contain a self-populating list implementation as a property, and the list element type must expose sub-properties.
2) Resource exhaustion (CVE-ID: CVE-2026-47886)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in Spring Expression Language (SpEL) expression evaluation when processing user-supplied expressions that use the power operator with a BigDecimal or BigInteger operand and a large exponent value. A remote attacker can submit a specially crafted expression to cause a denial of service.
Exploitation requires that the application accept and evaluate untrusted SpEL expressions and that a BigDecimal or BigInteger value be accessible within the evaluation context.
3) Improper Control of Dynamically-Managed Code Resources (CVE-ID: CVE-2026-59283)
CWE-ID: CWE-913 - Improper Control of Dynamically-Managed Code Resources
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.
The vulnerability exists due to improper control of dynamically-managed code resources in Spring Expression Language (SpEL) expression evaluation when evaluating expressions using SimpleEvaluationContext with the SpEL expression compiler active. A remote attacker can supply specially crafted expressions to disclose sensitive information and cause a denial of service.
The issue occurs only when expressions are evaluated with SimpleEvaluationContext and expression compilation is enabled through compiler mode settings such as IMMEDIATE or MIXED.
Remediation
Install update from vendor's website.