SB2026110546 - Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
Published: November 5, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 vulnerabilities.
1) Improper Encoding or Escaping of Output (CVE-ID: CVE-2026-84292)
CWE-ID: CWE-116 - Improper Encoding or Escaping of Output
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to redirect URI authority to an attacker-controlled host.
The vulnerability exists due to improper encoding or escaping of output in the authority recomposition logic when serializing a URI with an unvalidated port component. A remote attacker can supply a non-digit port value containing authority delimiters to redirect URI authority to an attacker-controlled host.
The issue is reachable through the object forms of serialize(), normalize(), and equal(). A port value obtained from parse() is always digits and is not affected.
2) Improper Handling of URL Encoding (Hex Encoding) (CVE-ID: CVE-2026-76172)
CWE-ID: CWE-177 - Improper Handling of URL Encoding (Hex Encoding)
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass host validation and inject carriage return and line feed characters into output.
The vulnerability exists due to improper handling of url encoding in the scheme component normalization logic when normalizing or resolving untrusted URLs. A remote attacker can supply a specially crafted percent-encoded scheme to bypass host validation and inject carriage return and line feed characters into output.
Applications that treat a missing authority as same-origin during redirect checks, host allowlist enforcement, or outbound request decisions are particularly exposed.
3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-54428)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the HTTP/2 HPACK decoder when processing compressed header blocks before the HTTP/2 SETTINGS acknowledgement. A remote attacker can send oversized compressed header blocks to cause a denial of service.
The issue can lead to memory exhaustion before the configured header list size limit is applied.
4) Resource exhaustion (CVE-ID: CVE-2026-54399)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the HTTP/1.1 message parser when processing messages with an excessive number of headers or excessive header length. A remote attacker can send a specially crafted HTTP message to cause a denial of service.
The issue leads to memory exhaustion.
5) Uncaught Exception (CVE-ID: CVE-2026-73088)
CWE-ID: CWE-248 - Uncaught Exception
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
6) Incorrect Control Flow Scoping (CVE-ID: CVE-2026-45819)
CWE-ID: CWE-705 - Incorrect Control Flow Scoping
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to baseline-browser-mapping calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
7) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-73089)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `--` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
8) Interpretation Conflict (CVE-ID: CVE-2026-6322)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass host-based security checks and route requests to an unintended authority.
The vulnerability exists due to interpretation conflict in the URI host component when processing percent-encoded authority delimiters. A remote attacker can supply a specially crafted URL to bypass host-based security checks and route requests to an unintended authority.
This issue can affect applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing.
9) Interpretation Conflict (CVE-ID: CVE-2026-84394)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass host-based security decisions.
The vulnerability exists due to interpretation conflict in URI authority host parsing when processing a URL containing an unclosed or misplaced bracket in the authority. A remote attacker can supply a specially crafted URL to bypass host-based security decisions.
This issue can occur when an application evaluates policy using the parsed host value and then sends the original URL through an HTTP client that resolves the host differently.
10) Double Decoding of the Same Data (CVE-ID: CVE-2026-75899)
CWE-ID: CWE-174 - Double Decoding of the Same Data
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform server-side request forgery.
The vulnerability exists due to double decoding of the same data in the fast-uri normalize() and resolve() hostname handling logic when processing a URI with a nested percent-encoded host. A remote attacker can supply a specially crafted URI to perform server-side request forgery.
The issue can cause the hostname to be interpreted as a different destination than the input appears to contain, including internal addresses such as loopback or a cloud metadata endpoint.
11) Interpretation Conflict (CVE-ID: CVE-2026-75931)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass host-based policy checks.
The vulnerability exists due to interpretation conflict in the resolve() host canonicalization logic when resolving scheme-relative references against a scheme-bearing base. A remote attacker can supply a specially crafted scheme-relative reference to bypass host-based policy checks.
Re-parsing the resolved URI can yield a different host than the one returned by resolve().
12) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-75975)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass host-policy checks and perform server-side request forgery.
The vulnerability exists due to improper input validation in the IPv6 literal normalization logic of fast-uri when normalizing untrusted URLs containing malformed bracketed IPv6 literals. A remote attacker can supply a specially crafted URL to bypass host-policy checks and perform server-side request forgery.
Malformed bracketed IPv6 literals with invalid trailing text are silently truncated to different valid IPv6 addresses, and parse().error is not set for these inputs.
Remediation
Install update from vendor's website.