SB2026103024 - Multiple vulnerabilities in IBM BigMemory Max

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026103024

SB2026103024 - Multiple vulnerabilities in IBM BigMemory Max

Published: October 30, 2026

Security Bulletin ID SB2026103024
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-17508)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could reject it. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


2) Resource exhaustion (CVE-ID: CVE-2026-15055)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in PKCS#8 / PBES2 decryptor KDF processing when honoring an unbounded cost from input. A remote attacker can supply crafted encrypted input to cause a denial of service.


3) Information Exposure Through Timing Discrepancy (CVE-ID: CVE-2026-18036)

CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to recover information about NTRU private key material through timing measurements.

The vulnerability exists due to observable timing discrepancies in the mod3 and modQ reduction helpers in org.bouncycastle.pqc.math.ntru.Polynomial and org.bouncycastle.pqc.crypto.ntru.NTRUSampling when performing secret-dependent modular reductions during key generation, encapsulation, and decapsulation. A remote attacker can measure and analyze the latency of these operations to infer information about NTRU private key material.


Remediation

Install update from vendor's website.

References