SB2026102049 - Multiple vulnerabilities in IBM Guardium Data Protection
Published: October 20, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-66053)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass hostname verification in TLS certificate validation.
The vulnerability exists due to improper validation of certificate with host mismatch in the Python TSSLSocket hostname matcher import in Apache Thrift Python bindings when establishing TLS connections. A remote attacker can present a certificate with a mismatched hostname to bypass hostname verification in TLS certificate validation.
2) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-41603)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to impersonate a trusted host.
The vulnerability exists due to improper validation of certificate with host mismatch in Java TSSLTransportFactory when establishing TLS connections. A remote attacker can present a certificate with a mismatched hostname to impersonate a trusted host.
3) Infinite loop (CVE-ID: CVE-2026-43871)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an infinite loop in TCompactProtocol varint handling when parsing input. A remote attacker can send specially crafted serialized data to cause a denial of service.
4) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-45112)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in Apache Thrift Java bindings when processing input. A remote attacker can send specially crafted input to cause a denial of service.
5) Improper handling of highly compressed data (CVE-ID: CVE-2026-48586)
CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of highly compressed data in TZlibTransport when processing compressed input. A remote attacker can send specially crafted compressed data to cause a denial of service.
Remediation
Install update from vendor's website.