SB20261022288 - Multiple vulnerabilities in IBM OpenPages for Cloud Pak for Data

Description

This security bulletin contains information about 37 vulnerabilities.

1) CRLF injection (CVE-ID: CVE-2026-59313)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to corrupt the stream of data sent to other users.

The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in server-sent event handling in Spring MVC functional web framework when streaming plain text server-sent event messages containing attacker-controlled data. A remote user can provide crafted data that will be streamed to other users to corrupt the stream of data sent to other users.

User interaction is required, and the issue applies only when applications use Spring MVC functional web framework with RouterFunction and ServerResponse.sse() to send plain text rather than a structured format such as JSON.

2) Integer overflow (CVE-ID: CVE-2026-41849)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in the Spring Expression Language (SpEL) evaluation logic when evaluating untrusted or user-controlled SpEL expressions. A remote attacker can supply a specially crafted SpEL expression to cause a denial of service.

Applications are vulnerable only if they accept and evaluate untrusted or user-controlled SpEL expressions.

3) HTTP response splitting (CVE-ID: CVE-2026-59314)

CWE-ID: CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt HTTP headers or multipart body framing.

The vulnerability exists due to improper neutralization of carriage return and line feed sequences in Content-Disposition header handling when processing untrusted file names. A remote attacker can supply a malicious file name to corrupt HTTP headers or multipart body framing.

User interaction is required to trigger exploitation. The issue affects applications that set Content-Disposition values from untrusted input, including use in outbound multipart request parts, and the header-splitting case applies to non-default or legacy connectors that do not reject malicious header characters.

4) Input validation error (CVE-ID: CVE-2026-41853)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass WAF or proxy checks.

The vulnerability exists due to improper input validation in multipart request handling in Spring MVC and Spring WebFlux when processing multipart requests. A remote attacker can send a malicious multipart request to bypass WAF or proxy checks.

Exploitation requires the application to accept multipart requests and to be protected by a WAF or proxy that parses multipart requests and performs checks based on their content.

5) Path traversal (CVE-ID: CVE-2024-38819)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in applications that serve static resources through the functional web frameworks WebMvc.fn or WebFlux.fn. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

6) Deserialization of Untrusted Data (CVE-ID: CVE-2026-41855)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform unauthorized actions.

The vulnerability exists due to unsafe deserialization in org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter when processing messages in an untrusted JMS environment. A remote attacker can send a crafted message to perform unauthorized actions.

Exploitation can lead to arbitrary class instantiation through gadget class deserialization.

7) Path traversal (CVE-ID: CVE-2026-47884)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper path limitation in XsltView when rendering views through a catch-all "/**" mapping without an explicitly specified view name. A remote attacker can send a specially crafted request to execute arbitrary code.

The issue can also lead to server-side request forgery.

8) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-47891)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in Jaxb2Decoder when parsing XML input with the Aalto XML processor. A remote attacker can send specially crafted XML content to cause a denial of service.

The issue affects Spring WebFlux applications that rely on the Aalto XML processor for XML parsing.

9) Incorrect authorization (CVE-ID: CVE-2026-47892)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass header-based access restrictions.

The vulnerability exists due to improper access control in WebFlux functional endpoints when processing pre-flight requests with DispatcherServlet. A remote attacker can send a specially crafted pre-flight request to bypass header-based access restrictions.

Only WebFlux applications using functional endpoints and deployed with DispatcherServlet are affected.

10) Improper Control of Dynamically-Managed Code Resources (CVE-ID: CVE-2026-59283)

CWE-ID: CWE-913 - Improper Control of Dynamically-Managed Code Resources

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to improper control of dynamically-managed code resources in Spring Expression Language (SpEL) expression evaluation when evaluating expressions using SimpleEvaluationContext with the SpEL expression compiler active. A remote attacker can supply specially crafted expressions to disclose sensitive information and cause a denial of service.

The issue occurs only when expressions are evaluated with SimpleEvaluationContext and expression compilation is enabled through compiler mode settings such as IMMEDIATE or MIXED.

11) Path traversal (CVE-ID: CVE-2026-41843)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in static resource resolution in Spring MVC and WebFlux when handling requests for versioned static resources served from the file system. A remote attacker can send malicious requests to disclose sensitive information.

Exploitation requires that versioned resources support is configured and that the attacker knows or can guess metadata information for targeted resources.

12) Generation of Predictable Numbers or Identifiers (CVE-ID: CVE-2026-41838)

CWE-ID: CWE-340 - Generation of Predictable Numbers or Identifiers

CVSSv4: 5.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to the use of predictable session identifiers in the spring-websocket module when establishing WebSocket sessions. A remote user can predict session IDs to disclose sensitive information.

Exploitation may be possible in combination with inadequate authorization rules, and user interaction is required.

13) Inefficient regular expression complexity (CVE-ID: CVE-2026-41848)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to regular expression denial of service in AntPathMatcher when processing an attacker-supplied pattern in match, matchStart, or extractUriTemplateVariables. A remote attacker can provide a crafted pattern to cause a denial of service.

The issue is exposed only if attacker-controlled input is directly or indirectly supplied as the pattern argument to the affected methods.

14) Resource exhaustion (CVE-ID: CVE-2026-41851)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the SpEL expression cache when evaluating user-supplied SpEL expressions. A remote attacker can submit crafted expressions to cause a denial of service.

Exploitation requires that the application accept and evaluate untrusted SpEL expressions and cache parsed SpEL expressions. A high volume of processing is typically required, often involving millions of evaluations, including with a single expression using dynamic inputs.

15) Resource exhaustion (CVE-ID: CVE-2026-47886)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in Spring Expression Language (SpEL) expression evaluation when processing user-supplied expressions that use the power operator with a BigDecimal or BigInteger operand and a large exponent value. A remote attacker can submit a specially crafted expression to cause a denial of service.

Exploitation requires that the application accept and evaluate untrusted SpEL expressions and that a BigDecimal or BigInteger value be accessible within the evaluation context.

16) Memory leak (CVE-ID: CVE-2026-47888)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in RSocketMessageHandler when processing a malformed SETUP frame. A remote attacker can send a specially crafted SETUP frame to cause a denial of service.

17) Information Exposure Through an Error Message (CVE-ID: CVE-2026-47893)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into error messages in HandshakeWebSocketService when handling WebSocket handshake requests. A remote attacker can send a request that triggers an exception to disclose sensitive information.

18) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-59282)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in Spring data binding infrastructure when applying user-supplied property paths onto a target object. A remote attacker can supply a property path with an arbitrarily large index into a nested sub-property to cause a denial of service.

Exploitation requires the target object to contain a self-populating list implementation as a property, and the list element type must expose sub-properties.

19) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-41850)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the Spring Expression Language (SpEL) expression evaluator when processing user-supplied SpEL expressions. A remote attacker can send a specially crafted expression to cause a denial of service.

The issue affects applications that accept and evaluate untrusted or user-controlled SpEL expressions.

20) Path traversal (CVE-ID: CVE-2026-59280)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in SpringTemplateLoader when resolving a view name derived from untrusted input. A remote attacker can supply a crafted view name containing backslash sequences to disclose sensitive information.

Only applications that return a view name derived from untrusted input and use FreeMarker configured with SpringTemplateLoader are vulnerable.

21) Cross-site scripting (CVE-ID: CVE-2026-59281)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to inject arbitrary html/javascript code.

The vulnerability exists due to cross-site scripting in Errors.getFieldErrors() and Errors.getFieldError() accessors when rendering field errors from a data-binding Errors instance with HTML escaping enabled. A remote attacker can supply crafted input that is later rendered in field errors to inject arbitrary html/javascript code.

The issue can lead to reflected cross-site scripting in Spring MVC and WebFlux applications.

22) Open redirect (CVE-ID: CVE-2026-41706)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to redirect users to an attacker-controlled URL after login.

The vulnerability exists due to improper input validation in CookieRequestCache and CookieServerRequestCache when processing the REDIRECT_URI cookie for post-login redirection. A remote attacker can influence the value of the REDIRECT_URI cookie to redirect users to an attacker-controlled URL after login.

User interaction is required because the victim must successfully log in for the redirect to occur.

23) Open redirect (CVE-ID: CVE-2026-41844)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to redirect users to an arbitrary external host.

The vulnerability exists due to improper control of generation of code in Spring MVC and Spring WebFlux applications when handling requests to a configured "/**" mapping with no explicit view name. A remote attacker can craft a link using the redirect: prefix to redirect users to an arbitrary external host.

User interaction is required to open the crafted link.

24) Cross-site scripting (CVE-ID: CVE-2026-41845)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary script code in the victim's browser.

The vulnerability exists due to incorrect escaping in JavaScriptUtils.javaScriptEscape() when processing input for JavaScript output. A remote attacker can supply crafted input to execute arbitrary script code in the victim's browser.

User interaction is required to load the affected content in a browser.

25) Cross-site scripting (CVE-ID: CVE-2026-41846)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to inject arbitrary html or javascript code.

The vulnerability exists due to cross-site scripting in JSP <form:*> tags when processing user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes. A remote attacker can supply crafted attribute values to inject arbitrary html or javascript code.

User interaction is required to trigger the injected content.

26) Protection mechanism failure (CVE-ID: CVE-2026-41847)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass security-related request handling.

The vulnerability exists due to improper implementation in the WebFlux Kotlin Router DSL when processing requests through a filter that passes a modified or replaced ServerRequest to the next handler function. A remote attacker can send a request to bypass security-related request handling.

The issue occurs only when a filter applies security-related concerns by modifying or replacing the ServerRequest, because the downstream handler receives the original unmodified request instead.

27) Protection mechanism failure (CVE-ID: CVE-2026-41852)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to invoke unintended application logic.

The vulnerability exists due to improper restriction of operations within the Spring Expression Language evaluation logic in SpEL expression evaluation when evaluating untrusted or user-controlled expressions. A remote attacker can supply a crafted expression to invoke unintended application logic.

Arbitrary zero-argument method invocation is possible even within restricted or read-only contexts.

28) Open redirect (CVE-ID: CVE-2026-47887)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to redirect users to an arbitrary URL.

The vulnerability exists due to an open redirect in UrlFileNameViewController when processing requests in applications where it is mapped with an end-of-path and no prefix is configured. A remote attacker can send a specially crafted request to redirect users to an arbitrary URL.

29) Resource exhaustion (CVE-ID: CVE-2026-22745)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in static resource handling when resolving static resources from the file system on Windows platforms. A remote attacker can send malicious requests that are slow to resolve to cause a denial of service.

The issue affects applications using Spring MVC or Spring WebFlux that serve static resources from the file system on Windows platforms.

30) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2026-22735)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to corrupt data streams sent to other users.

The vulnerability exists due to improper neutralization of special elements in Server-Sent Events handling in Spring MVC and Spring WebFlux when streaming plain text Server-Sent Events to clients. A remote user can control data that is streamed to other users to corrupt data streams sent to other users.

The issue is exposed only when plain text messages are used instead of a structured format such as JSON, and user interaction is required.

31) Path traversal (CVE-ID: CVE-2026-22737)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper path limitation in script view templates when rendering views with Java scripting engine enabled and the view name is not explicitly specified. A remote attacker can send a specially crafted request to disclose sensitive information.

Exploitation requires a mapping for "/**" that results in view rendering.

32) Improper Resource Shutdown or Release (CVE-ID: CVE-2026-22740)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper resource management in multipart request handling in WebFlux when processing multipart requests. A remote user can send a series of multipart requests to consume available disk space.

Temp files created for parts larger than 10 K may remain undeleted after request processing under some circumstances.

33) Acceptance of Extraneous Untrusted Data With Trusted Data (CVE-ID: CVE-2026-22741)

CWE-ID: CWE-349 - Acceptance of Extraneous Untrusted Data With Trusted Data

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper cache control in static resource resolution when handling malicious requests for encoded resources. A remote attacker can send malicious requests to cause a denial of service.

Exploitation requires resource chain support with caching enabled, encoded resource resolution enabled, and an empty resource cache.

34) Session Fixation (CVE-ID: CVE-2026-41839)

CWE-ID: CWE-384 - Session Fixation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and modify data associated with an authenticated user's session.

The vulnerability exists due to improper session management in the WebFlux session handling mechanism when processing requests from a compromised subdomain. A remote attacker can exchange a known session ID for that of an authenticated user to disclose sensitive information and modify data associated with an authenticated user's session.

Exploitation requires user interaction and a compromised subdomain, for example through cross-site scripting.

35) Memory leak (CVE-ID: CVE-2026-41840)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to memory leakage in multipart request processing in Spring WebFlux when processing multipart requests. A remote attacker can send malicious multipart requests to cause a denial of service.

The issue affects applications that implement a web endpoint that receives multipart requests.

36) Improper access control (CVE-ID: CVE-2026-41841)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in the static resource cache in Spring MVC and Spring WebFlux when resolving static resources. A remote attacker can request a publicly available resource with the same name as a protected resource to disclose sensitive information.

Exploitation requires several resource handlers using different resource locations, at least one protected resource handler, and a shared cache across these configurations.

37) Resource exhaustion (CVE-ID: CVE-2026-41842)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in static resource resolution in Spring MVC and Spring WebFlux when resolving versioned resources served from the file system. A remote attacker can send malicious requests that are slow to resolve to cause a denial of service.

Only applications that serve static resources from the file system and have versioned resources support configured are vulnerable.

Remediation

Install update from vendor's website.

References

• https://www.ibm.com/support/pages/node/7293436