SB2026102328 - Multiple vulnerabilities in IBM DevOps Test Virtualization/IBM DevOps Test Integrations and APIs
Published: October 23, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 50 vulnerabilities.
1) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-12860)
CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass RSA PKCS#1 signature verification.
The vulnerability exists due to improper signature verification in RSA PKCS#1 verification when processing the NULL-omitted path. A remote attacker can provide a crafted signature to bypass RSA PKCS#1 signature verification.
2) Deserialization of Untrusted Data (CVE-ID: CVE-2026-83557)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to instantiate an unintended object and disclose, modify, or affect data handling.
The vulnerability exists due to deserialization of untrusted data in DefaultBaseTypeLimitingValidator when processing polymorphic type identifiers for @JsonTypeInfo-annotated Comparable-typed values without a custom PolymorphicTypeValidator. A remote attacker can supply a crafted type identifier to instantiate an attacker-chosen Comparable implementation to disclose, modify, or affect data handling.
Only the default, unconfigured validator path reached through bare @JsonTypeInfo usage is affected; configurations using activateDefaultTyping() with an explicit restrictive PolymorphicTypeValidator are not affected.
3) Uncontrolled Recursion (CVE-ID: CVE-2026-66142)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in policy processing when parsing policies that lack policy ids or deeply nested policy structures. A remote attacker can supply a specially crafted policy to cause a denial of service.
4) Resource exhaustion (CVE-ID: CVE-2026-54399)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the HTTP/1.1 message parser when processing messages with an excessive number of headers or excessive header length. A remote attacker can send a specially crafted HTTP message to cause a denial of service.
The issue leads to memory exhaustion.
5) CRLF injection (CVE-ID: CVE-2025-67735)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject arbitrary data in server response.
The vulnerability exists due to insufficient validation of attacker-supplied data in io.netty.handler.codec.http.HttpRequestEncoder. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior.
6) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-33870)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests within chunked transfer encoding extension values. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
7) CRLF injection (CVE-ID: CVE-2026-41417)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject additional HTTP or RTSP requests.
The vulnerability exists due to improper neutralization of CRLF sequences in DefaultHttpRequest.setUri() and DefaultFullHttpRequest.setUri() when encoding attacker-controlled URIs into request lines through HttpRequestEncoder or RtspEncoder. A remote attacker can supply a specially crafted URI containing CRLF sequences to inject additional HTTP or RTSP requests.
Exploitation requires an application to create the request object first, later modify it through setUri(), and then serialize it with HttpRequestEncoder or RtspEncoder.
8) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-42580)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject arbitrary HTTP requests.
The vulnerability exists due to inconsistent interpretation of HTTP requests in io.netty.handler.codec.http.HttpObjectDecoder#getChunkSize when parsing chunked HTTP requests. A remote attacker can send a specially crafted chunked request to inject arbitrary HTTP requests.
9) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-42581)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform request smuggling.
The vulnerability exists due to improper input validation in HttpObjectDecoder when processing HTTP/1.0 requests containing both Transfer-Encoding: chunked and Content-Length headers. A remote attacker can send a specially crafted HTTP/1.0 request to perform request smuggling.
Exploitation requires Netty to be deployed behind a downstream proxy or handler that trusts Content-Length over Transfer-Encoding.
10) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-42584)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disrupt HTTP parsing integrity and availability on the connection.
The vulnerability exists due to inconsistent interpretation of HTTP responses in HttpClientCodec when processing pipelined HTTP/1.1 responses that include a 1xx response before a GET response body and a subsequent HEAD response. A remote attacker can send a specially crafted sequence of HTTP responses to disrupt HTTP parsing integrity and availability on the connection.
Exploitation requires HTTP/1.1 pipelining, a HEAD request in the pipeline, and a server response sequence that includes a 1xx response.
11) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-42585)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject arbitrary HTTP requests.
The vulnerability exists due to inconsistent interpretation of HTTP requests in HttpRequestDecoder when parsing malformed Transfer-Encoding headers. A remote attacker can send a specially crafted HTTP request with a malformed "Transfer-Encoding: chunked, identity" header to inject arbitrary HTTP requests.
Exploitation is possible in deployments where a proxy forwards such malformed requests to Netty instead of rejecting them.
12) Resource exhaustion (CVE-ID: CVE-2026-42587)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in HttpContentDecompressor and DelegatingDecompressorFrameListener when processing compressed HTTP request bodies with Content-Encoding set to br, zstd, or snappy. A remote attacker can send a specially crafted compressed payload to cause a denial of service.
The configured maxAllocation limit is enforced for gzip and deflate, but is silently ignored for brotli, zstd, and snappy. The issue affects both HTTP/1.1 and HTTP/2 handling.
13) Resource exhaustion (CVE-ID: CVE-2026-66143)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource management in policy normalization when processing crafted policies. A remote attacker can supply a specially crafted policy to cause a denial of service.
The issue arises because the maximum number of normalized policy alternatives can be bypassed across policy computation paths.
14) Uncontrolled Recursion (CVE-ID: CVE-2026-13506)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper state management in the lazy ASN.1 sequence parser when forcing sequence evaluation that resets the nesting-depth guard. A remote attacker can supply crafted ASN.1 data to cause a denial of service.
15) Resource exhaustion (CVE-ID: CVE-2026-66144)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper resource control in the remote PolicyReference retrieval API when manually retrieving remote policy references. A remote user can retrieve a huge remote policy to cause a denial of service.
Remote policy references are not retrieved during policy normalization.
16) Insufficient verification of data authenticity (CVE-ID: CVE-2026-12802)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to tamper with decrypted data.
The vulnerability exists due to improper authentication tag validation in CMS AuthEnvelopedData decryption when processing encrypted data with an invalid tag length. A remote attacker can supply crafted encrypted content to tamper with decrypted data.
17) Resource exhaustion (CVE-ID: CVE-2026-13586)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in PKCS#12 MAC and bag-decryption KDF processing when handling an excessive iteration count from input. A remote attacker can supply crafted PKCS#12 data to cause a denial of service.
18) Resource exhaustion (CVE-ID: CVE-2026-15055)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in PKCS#8 / PBES2 decryptor KDF processing when honoring an unbounded cost from input. A remote attacker can supply crafted encrypted input to cause a denial of service.
19) Input validation error (CVE-ID: CVE-2026-59639)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass CMS signature presence checks.
The vulnerability exists due to improper input validation in CMS verifySignatures when processing SignedData with zero signers. A remote attacker can supply crafted SignedData to bypass CMS signature presence checks.
20) Insufficient verification of data authenticity (CVE-ID: CVE-2026-59642)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to tamper with CMS AuthenticatedData content.
The vulnerability exists due to improper cryptographic binding in CMS AuthenticatedData processing when authAttrs are present. A remote attacker can supply crafted CMS data to tamper with CMS AuthenticatedData content.
21) Resource exhaustion (CVE-ID: CVE-2026-59647)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in CRMF/CMP password-MAC processing when honoring an unbounded iteration count. A remote attacker can supply crafted CRMF/CMP data to cause a denial of service.
22) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-12185)
CWE-ID: CWE-789 - Uncontrolled Memory Allocation
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled memory allocation in the BKS/UBER keystore parser when allocating from untrusted lengths before integrity check. A remote attacker can supply a crafted keystore file to cause a denial of service.
23) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-12803)
CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to forge authenticated ciphertexts across nonces.
The vulnerability exists due to improper cryptographic binding in KCCMBlockCipher MAC processing when AAD is absent. A remote attacker can craft data that exploits the missing nonce binding to forge authenticated ciphertexts across nonces.
24) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-12816)
CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to forge message authentication codes.
The vulnerability exists due to improper cryptographic implementation in IESEngine stream-mode MAC processing when deriving keys through a length-dependent KDF split. A remote attacker can supply crafted input to forge message authentication codes.
25) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-77310)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to server-side request forgery (SSRF) in InetAddress deserialization in FromStringDeserializer.Std._deserialize() when parsing attacker-controlled input into an InetAddress-typed target. A remote attacker can supply a crafted hostname for deserialization to disclose sensitive information.
The issue causes eager forward DNS resolution during deserialization, enabling DNS-based out-of-band interaction and blind enumeration of whether internal hostnames resolve before application-level validation.
26) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-14682)
CWE-ID: CWE-789 - Uncontrolled Memory Allocation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled memory allocation in definite-length read processing when performing an unbounded up-front allocation. A remote attacker can supply crafted input with a large declared length to cause a denial of service.
27) Input validation error (CVE-ID: CVE-2026-61634)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in the socket inbound frame reader when processing broker-supplied AMQP frames during connection setup. A remote attacker can send a specially crafted frame larger than the negotiated frame_max to cause a denial of service.
The issue is reachable when the client connects to a malicious or compromised AMQP broker and uses a smaller negotiated frame_max than the inbound body-size limit.
28) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-58060)
CWE-ID: CWE-789 - Uncontrolled Memory Allocation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled memory allocation in HSS public-key verification when processing an unbounded level count. A remote attacker can provide a crafted public key to cause a denial of service.
29) Insufficient verification of data authenticity (CVE-ID: CVE-2026-58061)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to modify plaintext before authentication completes.
The vulnerability exists due to improper order of operations in CCM-family mode decryption when writing plaintext to the caller buffer before tag verification. A remote attacker can supply crafted ciphertext to modify plaintext before authentication completes.
30) Improper Certificate Validation (CVE-ID: CVE-2026-58062)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass certificate status validation.
The vulnerability exists due to improper certificate validation in stapled OCSP response processing when accepting a response without binding it to the checked certificate. A remote attacker can supply a crafted stapled OCSP response to bypass certificate status validation.
31) Resource exhaustion (CVE-ID: CVE-2026-58063)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in BCFKS keystore load KDF processing when honoring an unbounded cost from an untrusted file. A remote attacker can supply a crafted keystore file to cause a denial of service.
32) Resource exhaustion (CVE-ID: CVE-2026-59648)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in OpenPGP Argon2 S2K processing when honoring attacker-chosen memory and passes. A remote attacker can supply crafted OpenPGP data to cause a denial of service.
33) Input validation error (CVE-ID: CVE-2026-59650)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to weaken Diffie-Hellman key agreement security.
The vulnerability exists due to improper input validation in MTI/A0 DH agreement when processing an unvalidated peer value. A remote attacker can supply a crafted peer value to weaken Diffie-Hellman key agreement security.
34) Inadequate Encryption Strength (CVE-ID: CVE-2026-59651)
CWE-ID: CWE-326 - Inadequate Encryption Strength
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass keystore integrity protection.
The vulnerability exists due to weak cryptographic key strength in BKS keystore version handling when accepting a legacy version with a 16-bit integrity MAC key. A remote attacker can supply a crafted legacy keystore to bypass keystore integrity protection.
35) LDAP injection (CVE-ID: CVE-2026-59652)
CWE-ID: CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject arbitrary LDAP filter elements.
The vulnerability exists due to LDAP injection in the legacy jdk1.4 LDAPStoreHelper when constructing LDAP filters from untrusted input. A remote attacker can supply crafted input to inject arbitrary LDAP filter elements.
36) Improper Certificate Validation (CVE-ID: CVE-2026-8763)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass name constraints validation.
The vulnerability exists due to improper certificate validation in name constraints processing when handling rfc822Name and URI values with a trailing dot. A remote attacker can supply a crafted identifier to bypass name constraints validation.
37) Uncontrolled Recursion (CVE-ID: CVE-2026-59645)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in the OER parser when processing a self-referential IEEE 1609.2 schema without a depth limit. A remote attacker can supply crafted schema data to cause a denial of service.
The issue is triggered by self-referential IEEE 1609.2 schema content.
38) Input validation error (CVE-ID: CVE-2026-63335)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper input validation in CommandAssembler when processing malformed AMQP content header and body frames from a connected broker peer. A remote user can send a specially crafted frame sequence to cause a denial of service.
Exploitation requires a broker peer that the client has connected to and an open non-zero channel that can receive a content-bearing server-to-client method.
39) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-58059)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in X.500 distinguished name stringification when escaping strings with quadratic-time behavior. A remote attacker can supply crafted distinguished names to cause a denial of service.
40) Improper Certificate Validation (CVE-ID: CVE-2026-63336)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to intercept and modify transmitted data.
The vulnerability exists due to improper certificate validation in ConnectionFactory.useSslProtocol() and TrustEverythingTrustManager when establishing TLS connections without explicit trust configuration. A remote attacker can present a crafted certificate to perform a man-in-the-middle attack to intercept and modify transmitted data.
Hostname verification is disabled by default, which further facilitates exploitation.
41) Unsafe reflection (CVE-ID: CVE-2026-63337)
CWE-ID: CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to use of externally-controlled input to select classes or code in ProcedureDescription in com.rabbitmq.tools.jsonrpc when processing a crafted JSON-RPC service description from untrusted AMQP messages. A remote attacker can send a crafted system.describe response with attacker-controlled javaReturnType values to execute arbitrary code.
The issue is triggered when a JsonRpcClient connects to a JSON-RPC service, and the selected class may also be used as the expected type for reply parsing.
42) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-69219)
CWE-ID: CWE-789 - Uncontrolled Memory Allocation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to memory allocation with excessive size value in ValueReader.readBytes() when processing a LongString or bytes field from an AMQP peer. A remote attacker can send a specially crafted AMQP field with an oversized declared length to cause a denial of service.
The issue can be triggered pre-authentication during connection.start, and successful exploitation can crash the entire JVM with an OutOfMemoryError.
43) Uncontrolled Recursion (CVE-ID: CVE-2026-69220)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in ValueReader.readTable(), readArray(), and readFieldValue() when parsing AMQP table and array values from server frames. A remote attacker can send a specially crafted deeply nested table structure to cause a denial of service.
Exploitation is possible before authentication via the initial connection.start frame, and a machine-in-the-middle can also trigger the issue.
44) Unsafe reflection (CVE-ID: CVE-2026-19032)
CWE-ID: CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use of externally controlled input to select classes or code in JDKFromStringDeserializer.NioPathHelper.deserialize when deserializing untrusted JSON into a java.nio.file.Path field. A remote attacker can supply a specially crafted URI scheme to drive FileSystemProvider resolution and cause a denial of service.
Exploitation occurs during readValue, and meaningful side effects beyond the reported availability impact depend on the presence of a side-effecting third-party FileSystemProvider on the classpath.
45) Resource exhaustion (CVE-ID: CVE-2026-50193)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in JsonNode.toString() when serializing deeply nested JsonNode content created from user-supplied JSON. A remote attacker can send deeply nested JSON input to cause a denial of service.
Exploitation requires the service to read the input as JsonNode using ObjectMapper.readTree() and then serialize the same or modified node using JsonNode.toString().
46) Deserialization of Untrusted Data (CVE-ID: CVE-2026-54512)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to instantiate arbitrary classes.
The vulnerability exists due to deserialization of untrusted data in DatabindContext._resolveAndValidateGeneric() and PolymorphicTypeValidator handling when processing polymorphic type identifiers with generic parameters during deserialization. A remote attacker can supply a specially crafted type identifier and JSON data to instantiate arbitrary classes.
Only applications that accept untrusted JSON and have polymorphic typing enabled while relying on a configured PolymorphicTypeValidator allow-list are affected.
47) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-54513)
CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to instantiate non-allowlisted types.
The vulnerability exists due to incomplete list of disallowed inputs in BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() when deserializing attacker-controlled JSON containing array subtypes. A remote attacker can supply a crafted array wrapper to instantiate non-allowlisted types.
The issue occurs because array types are allowlisted based only on whether the class is an array, without validating the array component type against the configured allowlist, and no further validator check occurs for elements when per-element type IDs are absent.
48) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-54514)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause outbound DNS requests and disclose limited network information.
The vulnerability exists due to server-side request forgery in JDKFromStringDeserializer when deserializing untrusted JSON into a type containing an InetSocketAddress field. A remote attacker can supply a crafted hostname value to cause outbound DNS requests and disclose limited network information.
The DNS lookup occurs during readValue before application-level validation or explicit connection logic.
CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to modify otherwise ignored object attributes.
The vulnerability exists due to improper control of dynamically determined object attributes in BeanDeserializerBase.createContextual() when processing case-insensitive deserialization with per-property @JsonIgnoreProperties exclusions. A remote attacker can send crafted JSON input to modify otherwise ignored object attributes.
Only applications that enable case-insensitive property matching and rely on per-property @JsonIgnoreProperties to keep a field unwritable are vulnerable.
50) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-75516)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in frame handling logic in AMQConnection.java, Utils.java, and Frame.java when processing Connection.Tune negotiation and subsequent crafted frame size fields. A remote attacker can send a malicious Connection.Tune message with frameMax set to 0 and then send an oversized frame to cause a denial of service.
A malicious AMQP server or a machine-in-the-middle position can trigger the issue, and the crafted frame does not need to be a body frame.
Remediation
Install update from vendor's website.