SB2026110918 - Multiple vulnerabilities in IBM Sterling Secure Proxy
Published: November 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-50734)
CWE-ID: CWE-789 - Uncontrolled Memory Allocation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to memory allocation with excessive size value in OpenWire wire format negotiation when processing a WireFormatInfo frame during pre-authentication negotiation. A remote attacker can send a crafted WireFormatInfo frame with a malicious large size value to cause a denial of service.
The issue can trigger out-of-memory conditions and crash the broker.
2) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-53917)
CWE-ID: CWE-789 - Uncontrolled Memory Allocation
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to memory allocation with excessive size value in OpenWire message property map unmarshalling when processing a crafted OpenWire message with a large encoded map size value. A remote user can send a specially crafted OpenWire message to cause a denial of service.
The issue can trigger out-of-memory conditions and crash the broker.
3) Improper Handling of Alternate Encoding (CVE-ID: CVE-2026-10050)
CWE-ID: CWE-173 - Improper Handling of Alternate Encoding
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication.
The vulnerability exists due to improper handling of alternate encoding in DigestAuthentication.apply() when computing Digest authentication response hashes using ISO-8859-1 encoding. A remote attacker can use a password variant in which non-Latin-1 characters are replaced with '?' characters to bypass authentication.
Successful exploitation requires knowledge of the target username and a password containing characters outside the U+00FF range.
4) Information disclosure (CVE-ID: CVE-2026-10051)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper state management in HttpConnection._trailers when processing consecutive HTTP/1.1 keep-alive requests with trailers. A remote attacker can send a request with crafted trailers followed by another request on the same connection to disclose sensitive information.
The issue is limited to reuse of stale trailer data across requests on the same keep-alive connection and is not cross-connection.
5) Input validation error (CVE-ID: CVE-2026-6790)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass host-based access controls and interfere with hostname-based security decisions.
The vulnerability exists due to improper input validation in HTTP/2 and HTTP/3 server-side request handling when processing requests with mismatched :authority and Host values. A remote attacker can send a specially crafted request containing conflicting host identities to bypass host-based access controls and interfere with hostname-based security decisions.
Different layers may interpret different host values from the same request, which can affect virtual host isolation, multi-tenant routing, redirect or callback URL construction, proxy trust chains, and logging.
Remediation
Install update from vendor's website.