SB2026110541 - Multiple vulnerabilities in IBM Db2

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110541

SB2026110541 - Multiple vulnerabilities in IBM Db2

Published: November 5, 2026

Security Bulletin ID SB2026110541
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Insufficient verification of data authenticity (CVE-ID: CVE-2026-32597)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass security policy enforcement.

The vulnerability exists due to insufficient verification of data authenticity in the PyJWT token header validation logic when processing JWS tokens with unknown critical header extensions. A remote attacker can send a specially crafted token to bypass security policy enforcement.

This can cause split-brain verification in mixed-library deployments, where other RFC-compliant libraries reject the same token.


2) Uncontrolled Recursion (CVE-ID: CVE-2026-30922)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the pyasn1 BER decoder when decoding deeply nested ASN.1 data with indefinite-length constructed types. A remote attacker can supply a specially crafted payload containing nested SEQUENCE or SET tags to cause a denial of service.

Services that parse untrusted ASN.1 data may terminate with a RecursionError or exhaust available memory.


3) Resource exhaustion (CVE-ID: CVE-2026-23490)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling RELATIVE-OID with excessive continuation octets. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Remediation

Install update from vendor's website.

References