SB2026101910 - Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101910

SB2026101910 - Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition

Published: October 19, 2026

Security Bulletin ID SB2026101910
CSH Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Double free (CVE-ID: CVE-2026-108104)

CWE-ID: CWE-415 - Double Free

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose and modify decompressed data from another stream.

The vulnerability exists due to a double free in SnappyFramedInputStream when allocating larger buffers for a declared chunk length. A remote attacker can cause an allocation failure after pooled buffers have been released to cause buffers to be shared across streams.

The default CachingBufferPool does not detect duplicate buffer releases.


2) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-108106)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to memory allocation with an excessive size value in snappy-java decompression paths when processing compressed data with an attacker-declared uncompressed length. A remote attacker can provide crafted compressed data to cause a denial of service.


3) Out-of-bounds write (CVE-ID: CVE-2026-90559)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in Snappy.uncompress(ByteBuffer, ByteBuffer) when processing a crafted compressed input with a declared decompressed size larger than the destination buffer's remaining capacity. A remote attacker can supply a crafted compressed input to cause a denial of service.

The native decompressor can write past the end of a direct buffer's off-heap allocation.


Remediation

Install update from vendor's website.

References