SB2026101452 - Multiple vulnerabilities in Automation Assets in IBM Cloud Pak for Integration (CP4I)
Published: October 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Incomplete cleanup (CVE-ID: CVE-2026-77037)
CWE-ID: CWE-459 - Incomplete cleanup
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to incomplete cleanup in diskStorage when handling aborted or truncated multipart uploads. A remote attacker can abort or truncate multipart upload requests to cause a denial of service.
Each failed request can leak an open file descriptor and retain its disk blocks until the process exits. Only applications using disk storage are vulnerable.
2) Race condition (CVE-ID: CVE-2026-77063)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass file size restrictions on uploaded files.
The vulnerability exists due to a race condition in the asynchronous fileFilter handling in multer when processing file uploads with an asynchronous fileFilter. A remote attacker can upload an oversized file to bypass file size restrictions on uploaded files.
Only uploads using an asynchronous fileFilter are affected; uploads using a synchronous fileFilter are not affected.
3) Uncaught Exception (CVE-ID: CVE-2026-77078)
CWE-ID: CWE-248 - Uncaught Exception
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an uncaught exception in multer field parsing when processing a crafted multipart/form-data request. A remote attacker can send specially crafted text field names to cause a denial of service.
A single multipart/form-data request can trigger a RangeError: Invalid array length that terminates the Node.js process instead of being routed to the application error handler.
4) Resource exhaustion (CVE-ID: CVE-2026-82333)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the append-field dependency used by multer when parsing multipart field names with crafted bracket notation. A remote attacker can send a specially crafted HTTP request with an oversized array index in a field name to cause a denial of service.
A single crafted multipart request is sufficient to trigger synchronous CPU consumption that prevents the process from handling other requests.
Remediation
Install update from vendor's website.