SB2026102326 - Multiple vulnerabilities in IBM App Connect Enterprise
Published: October 23, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-84363)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass filtering or cache unsafe responses.
The vulnerability exists due to inconsistent interpretation of HTTP requests in the query parser and cache middleware when processing request targets containing a literal fragment followed by query parameters. A remote attacker can send a specially crafted request to bypass filtering or cache unsafe responses.
Only deployments where a literal # reaches the application are affected; runtimes or intermediaries that normalize or strip the fragment are not affected.
2) Resource exhaustion (CVE-ID: CVE-2026-84364)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in parseBody() when processing request bodies with dot-notation enabled. A remote attacker can send specially crafted requests to cause a denial of service.
Only applications that explicitly enable dot-notation parsing are affected. Concurrent requests can exhaust the JavaScript heap and terminate the server process.
3) Path traversal (CVE-ID: CVE-2026-84365)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to overwrite files outside the intended output directory.
The vulnerability exists due to path traversal in the toSSG() static site generation function when processing route parameter values supplied through ssgParams during static site generation. A remote attacker can supply crafted route parameter values containing consecutive parent-directory segments to overwrite files outside the intended output directory.
This issue affects build-time static site generation only, and applications whose ssgParams values are entirely developer-controlled are not affected. User interaction is required to generate the static site from untrusted route parameter values.
4) Cross-site scripting (CVE-ID: CVE-2026-93981)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to inject arbitrary HTML and execute cross-site scripting in the application's origin.
The vulnerability exists due to improper neutralization of input during web page generation in hono/jsx server-side rendering boundary components when rendering an attacker-controlled plain string directly in an affected position. A remote attacker can supply a crafted string that is emitted as markup to inject arbitrary HTML and execute cross-site scripting in the application's origin.
User interaction is required to view the server-rendered page containing the crafted string.
5) Path traversal (CVE-ID: CVE-2026-39408)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to write files outside the intended output directory.
The vulnerability exists due to path traversal in toSSG() when constructing output file paths from dynamic route parameters provided via ssgParams. A remote attacker can supply specially crafted parameter values containing traversal sequences to write files outside the intended output directory.
This issue is limited to build-time static site generation and does not affect request-time routing.
Remediation
Install update from vendor's website.