SB2026111307 - Multiple vulnerabilities in IBM watsonx.data
Published: November 13, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 23 vulnerabilities.
1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-59873)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the Unpack stream in src/extract.ts when extracting crafted compressed tar archives. A remote attacker can send a specially crafted archive to cause a denial of service.
The issue can exhaust disk space and CPU through decompression and parsing of highly compressible input.
2) Integer overflow (CVE-ID: CVE-2026-59879)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer overflow in List#set, List#setIn, List#updateIn, List#setSize, and the related functional set, setIn, and updateIn operations when processing a crafted index, size, or key-path segment in the range [2 ** 30, 2 ** 31). A remote attacker can send a specially crafted request to cause a denial of service.
A single small unauthenticated request can trigger an uncatchable infinite loop on an empty List or unbounded allocation leading to process abort on a populated List.
3) Incorrect authorization (CVE-ID: CVE-2026-41115)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive group metadata.
The vulnerability exists due to improper access control in the CONSUMER_GROUP_DESCRIBE API when handling consumer group describe requests. A remote user can send a request to the API with DESCRIBE permission on the GROUP resource to disclose sensitive group metadata.
The issue stems from a discrepancy between the documented permission model and the implemented authorization check, which can lead to misconfigured ACLs.
4) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-59887)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in the mailto: schema validator scan loop when processing user-supplied text containing repeated mailto: sequences. A remote attacker can send specially crafted input to cause a denial of service.
The issue is reachable through the documented .test() and .match() API and through markdown rendering with linkification enabled.
5) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-69243)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests within WebSocket upgrade. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
6) Resource exhaustion (CVE-ID: CVE-2026-69244)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in C HTTP response parser. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
7) Resource exhaustion (CVE-ID: CVE-2026-45409)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to degrade the availability of applications that process untrusted domain names using idna.
The vulnerability exists due to costly contextual validation occurring before oversized Unicode inputs are rejected by idna.encode(). An unauthenticated remote attacker can submit specially crafted, arbitrarily long domain names to an application without preliminary input length validation, causing excessive processing time and resource consumption.
8) Resource exhaustion (CVE-ID: CVE-2024-3651)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources within the idna.encode() function. A remote attacker can pass an overly long domain name to the application and perform a denial of service (DoS) attack.
9) Resource exhaustion (CVE-ID: CVE-2026-69152)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the expand() function when processing attacker-controlled brace patterns. A remote attacker can send a specially crafted input to cause a denial of service.
The issue can terminate the Node process with an uncatchable out-of-memory error or block the event loop for an extended period.
10) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-14257)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in expand() when processing attacker-influenced brace expansion patterns. A remote attacker can send a specially crafted input string to cause a denial of service.
The issue can terminate the Node process with an uncatchable out-of-memory error.
11) Type conversion (CVE-ID: CVE-2026-59871)
CWE-ID: CWE-704 - Type conversion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to incorrect type conversion or cast in the PAX header parser when parsing a crafted tar archive with an all-digit path value. A remote attacker can supply a specially crafted tar archive to cause a denial of service.
The crash occurs as an uncaught TypeError during extraction and bypasses application-level error handling, including error and warning handlers.
12) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-59880)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in Immutable.Map and Immutable.Set collision bucket handling when processing attacker-controlled object keys. A remote attacker can supply many crafted colliding keys to cause a denial of service.
Applications are affected when untrusted input is used as keys in Immutable structures rather than only as values under fixed keys.
13) Uncaught Exception (CVE-ID: CVE-2026-59875)
CWE-ID: CWE-248 - Uncaught Exception
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an uncaught exception in the PAX extended header parser when processing attacker-supplied tarballs containing NUL bytes in path or linkpath records. A remote attacker can supply a specially crafted tarball to cause a denial of service.
The exception is triggered after the crafted value reaches filesystem operations and can bypass the consumer's await/try-catch error handling boundary.
14) Improper Output Neutralization for Logs (CVE-ID: CVE-2026-5078)
CWE-ID: CWE-117 - Improper Output Neutralization for Logs
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to forge log entries.
The vulnerability exists due to improper output neutralization for logs in the :remote-user token when processing a crafted Authorization header. A remote attacker can send a crafted Authorization: Basic header containing CR/LF characters to forge log entries.
The built-in combined, common, default, and short formats are affected, as well as custom formats that include :remote-user.
15) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-52869)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a low-privileged remote attacker to inject JSON-RPC messages into another client's session.
The vulnerability exists due to missing principal verification when the MCP Python SDK's SSE and stateful Streamable HTTP transports route requests by session identifier with built-in bearer-token authentication enabled. A low-privileged remote attacker can use a session identifier obtained out of band with their own bearer token to bypass client isolation.
16) Missing Authorization (CVE-ID: CVE-2026-52870)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a low-privileged remote attacker to read other clients' task results and cancel their tasks.
The vulnerability exists due to missing session ownership checks in the MCP Python SDK's default task handlers when a multi-client server calls server.experimental.enable_tasks(). A low-privileged remote attacker can enumerate tasks and retrieve queued elicitation payloads, preventing intended recipients from receiving those messages.
17) Origin validation error (CVE-ID: CVE-2026-59950)
CWE-ID: CWE-346 - Origin Validation Error
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to origin validation error. A remote attacker can invoke the server's tools and read its resources
18) Resource exhaustion (CVE-ID: CVE-2026-59869)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the js-yaml parser when parsing YAML documents containing chained merge keys. A remote attacker can send a specially crafted YAML document to cause a denial of service.
The issue results in quadratic CPU consumption for input whose size grows only linearly.
19) Improper handling of highly compressed data (CVE-ID: CVE-2026-59939)
CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of highly compressed data in the _decompressContent() function when processing HTTP responses with Content-Encoding: gzip or deflate. A remote attacker can send a specially crafted compressed HTTP response to cause a denial of service.
The issue is triggered automatically during httplib2.Http().request() and requires no user interaction.
20) Improper access control (CVE-ID: CVE-2026-65898)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass attribute sanitization restrictions.
The vulnerability exists due to improper access control in setConfig() when modifying sanitizer configuration. A remote user can invoke setConfig() to bypass attribute sanitization restrictions.
21) Protection Mechanism Failure (CVE-ID: CVE-2026-65899)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary script in the context of a Trusted Types sink.
The vulnerability exists due to a protection mechanism failure in the Trusted Types policy handling in DOMPurify when reusing a DOMPurify instance across trust boundaries after calling clearConfig() and requesting RETURN_TRUSTED_TYPE. A remote user can influence a previously supplied trusted types policy on the reused instance to execute arbitrary script in the context of a Trusted Types sink.
Exploitation requires a shared DOMPurify instance, a previously retained unsafe or less-trusted policy, and a later sanitize call that requests RETURN_TRUSTED_TYPE.
22) Information disclosure (CVE-ID: CVE-2026-41715)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose credentials.
The vulnerability exists due to improper handling of credential forwarding in the Reactor Netty HTTP client redirect handling when following redirects from a secure endpoint to an insecure endpoint. A remote attacker can trigger a protocol downgrade redirect to disclose credentials.
The HTTP client must be explicitly configured to follow redirects, and user interaction is required.
23) Infinite loop (CVE-ID: CVE-2026-59874)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to loop with an unreachable exit condition in tar.replace() when scanning an attacker-controlled existing archive. A remote attacker can supply a specially crafted tar archive with a negative base-256 encoded entry size to cause a denial of service.
Only applications that call the replace API on an existing attacker-controlled archive are affected; plain extraction-only workflows are not affected.
Remediation
Install update from vendor's website.