SB2026110412 - Multiple vulnerabilities in IBM Platform Navigator in IBM Integration
Published: November 4, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 vulnerabilities.
1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-18149)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service by accumulating pending promises and streams in applications using undici.
The vulnerability exists due to missing release of response body resources in undici's RetryHandler when a retried request receives a non-retryable response after a truncated response. A remote attacker can operate a malicious server that repeatedly returns this response sequence to leave the application's original response body pending indefinitely and cause a denial of service.
Reads such as response.body.text() hang, and bodyTimeout does not fire for the orphaned response body.
2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-84890)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the interceptors.decompress() interceptor when decompressing HTTP response bodies according to an untrusted Content-Encoding header. A remote attacker can return a compression bomb as a compressed HTTP response to cause a denial of service.
Exploitation requires an application to use the decompress interceptor to read responses from an untrusted or compromised upstream.
3) Use of cache containing sensitive information (CVE-ID: CVE-2026-84933)
CWE-ID: CWE-524 - Use of Cache Containing Sensitive Information
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose cookies belonging to other users and inject cookies into cached responses.
The vulnerability exists due to improper handling of sensitive cookies in undici's interceptors.cache() when handling cacheable responses containing Set-Cookie headers in shared-cache mode. A remote attacker can provide a cacheable response containing a Set-Cookie header to disclose cookies belonging to other users and inject cookies into cached responses.
Private-cache mode is not affected.
4) Input validation error (CVE-ID: CVE-2026-84947)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause response truncation.
The vulnerability exists due to improper input validation in the dump interceptor when processing oversized chunked responses without a Content-Length header. A remote attacker can send an oversized chunked response to cause response truncation.
Exploitation requires the application to use the dump interceptor with an untrusted or misbehaving upstream.
5) Improper Certificate Validation (CVE-ID: CVE-2026-84961)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass custom TLS certificate validation.
The vulnerability exists due to improper certificate validation in undici BalancedPool when forwarding function-valued connect or tls options to per-upstream pools. A remote attacker can present a TLS certificate that is rejected by a configured custom checkServerIdentity callback but accepted by Node.js default hostname and chain validation to bypass custom TLS certificate validation.
Only applications using BalancedPool with a function-valued connect or tls option, such as a custom checkServerIdentity callback or connector, are affected.
6) Insufficient verification of data authenticity (CVE-ID: CVE-2026-85008)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause unsafe HTTP requests to be served from the cache instead of reaching the origin.
The vulnerability exists due to insufficient verification of response authenticity in the undici cache interceptor when processing cacheable responses to unsafe HTTP methods. A remote attacker can return a heuristically cacheable response with an explicit Cache-Control max-age directive to an unsafe HTTP request to cause unsafe HTTP requests to be served from the cache instead of reaching the origin.
The issue occurs with the default methods: ['GET'] configuration.
7) Uncaught Exception (CVE-ID: CVE-2026-85014)
CWE-ID: CWE-248 - Uncaught Exception
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an uncaught exception in the WebSocketStream socket-close handler when handling an abrupt WebSocket connection closure while a writer lock is held. A remote attacker can abruptly close a WebSocket connection to cause a denial of service.
Exploitation requires an application to use the WebSocketStream API and write through a writer.
Remediation
Install update from vendor's website.