SB2026102931 - Multiple vulnerabilities in IBM Db2 Developer Extension
Published: October 29, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-101910)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass network trust boundaries and conduct server-side request forgery.
The vulnerability exists due to improper address classification in the Address6 classifier when processing NAT64 local-use IPv6 addresses in the 64:ff9b:1::/48 range. A remote attacker can supply a specially crafted address that is classified as a global address to bypass network trust boundaries and conduct server-side request forgery.
Exploitation requires the server network to run a NAT64 translator on a prefix inside 64:ff9b:1::/48, and the attacker must know or guess the deployed prefix length.
2) Incorrect Comparison (CVE-ID: CVE-2026-101913)
CWE-ID: CWE-697 - Incorrect Comparison
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass network trust boundaries and perform server-side request forgery against on-link hosts.
The vulnerability exists due to incorrect comparison in Address6.isLinkLocal() in src/ipv6.ts when classifying IPv6 link-local addresses. A remote attacker can supply a crafted link-local IPv6 address outside fe80::/64 but within fe80::/10 to bypass network trust boundaries and perform server-side request forgery against on-link hosts.
The issue affects applications that rely on this method for security decisions, and reachable targets are generally limited to hosts on the server's own network segment.
Remediation
Install update from vendor's website.