SB20261111141 - Multiple vulnerabilities in IBM ApplinX
Published: November 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 vulnerabilities.
1) Improper Encoding or Escaping of Output (CVE-ID: CVE-2026-84292)
CWE-ID: CWE-116 - Improper Encoding or Escaping of Output
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to redirect URI authority to an attacker-controlled host.
The vulnerability exists due to improper encoding or escaping of output in the authority recomposition logic when serializing a URI with an unvalidated port component. A remote attacker can supply a non-digit port value containing authority delimiters to redirect URI authority to an attacker-controlled host.
The issue is reachable through the object forms of serialize(), normalize(), and equal(). A port value obtained from parse() is always digits and is not affected.
2) Cross-site scripting (CVE-ID: CVE-2026-110725)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to inject URI schemes and potentially enable cross-site scripting in applications using fast-uri.
The vulnerability exists due to missing first-segment colon escaping in fast-uri's serialize(), normalize(), and resolve() functions when processing references without an authority using reference: 'suffix'. A remote attacker can supply javascript:alert(1) or references containing data: or vbscript: schemes to make output reparse as an absolute URI when treated as a URL, while equal() can conflate scheme-bearing and relative references.
3) Improper Handling of Case Sensitivity (CVE-ID: CVE-2026-86472)
CWE-ID: CWE-178 - Improper Handling of Case Sensitivity
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass host allowlist or denylist checks.
The vulnerability exists due to improper handling of case sensitivity in the fast-uri host parsing, normalization, and equality functions when processing scheme-relative references containing percent-encoded uppercase unreserved host octets. A remote attacker can supply a crafted scheme-relative URL to bypass host allowlist or denylist checks.
The evading hostname resolves and routes to the same host intended to be restricted.
4) Improper Resolution of Path Equivalence (CVE-ID: CVE-2026-110095)
CWE-ID: CWE-41 - Improper Resolution of Path Equivalence
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause applications to resolve relative references to unintended resources or treat distinct references as equivalent.
The vulnerability exists due to improper resolution of path equivalence in fast-uri's normalize() and serialize() functions when dot-segment removal is applied to relative references before resolution. A remote attacker can supply references such as 'a/../b' or '../x', normalized to '/b' or 'x', to escape intended directories or interfere with cache, deduplication, or authorization keys.
5) Interpretation Conflict (CVE-ID: CVE-2026-110180)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass host-based policies and steer traffic to unintended destinations.
The vulnerability exists due to an interpretation conflict in fast-uri's canonicalizeHost() when adopting the WHATWG parser's hostname without verifying that the entire input was interpreted as a host. A remote attacker can supply URLs such as http://a@b@evil.example/ or hosts containing TAB, CR, or LF to trigger host rewriting and bypass applications' policies when checks and subsequent use rely on different host representations.
6) Cross-site scripting (CVE-ID: CVE-2026-110306)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to bypass scheme allowlists and execute scripts in a victim's browser through consuming applications.
The vulnerability exists due to improper decoding in fast-uri's scheme handling when unescape() decodes percent-encoded schemes before validation, turning otherwise inert input into executable URLs. A remote attacker can supply %6Aavascript:alert(1) or %u006Aavascript:alert(1) for normalization or resolution and subsequent rendering to trigger cross-site scripting upon victim interaction, or submit %68ttp://a/ to bypass equality-based allowlists through equal().
Remediation
Install update from vendor's website.