Use of uninitialized resource in ws - CVE-2026-45736

Vulnerability identifier: #VU131249

CSH Severity: Low

CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-45736

CWE-ID: CWE-908

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to use of uninitialized resource in websocket.close() when processing a TypedArray passed as the reason argument. A remote privileged user can pass a crafted TypedArray as the close reason to disclose sensitive information.

The issue is only exploitable through misuse that is unlikely in practice.

ws
IBM Cloud Transformation Advisor
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM Maximo Application Suite - Manage Component
Confluence Data Center
Bitbucket Data Center
IBM Decision Optimization for Cloud Pak for Data
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
Application Modernization Accelerator
Red Hat OpenShift Container Platform

Install security update from vendor's website.

ws - update to 8.20.1
IBM Cloud Transformation Advisor - update to 5.0.0
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.22-sc2, 4.3.5
IBM Maximo Application Suite - Manage Component - addressed in versions 9.0.27, 9.1.19
Confluence Data Center - update to 9.2.5
Bitbucket Data Center - addressed in versions 9.4.22, 10.2.5, 10.3.1
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 16.1.0.26, 16.2.0
Red Hat OpenShift Container Platform - addressed in versions 4.19.40, 4.21.25, 4.22.6
Application Modernization Accelerator - update to 5.0.0
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6

• https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx
• https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086

• Use of uninitialized resource in ws
• Use of uninitialized resource in Confluence Data Center
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• IBM Maximo Application Suite - Manage Component update for ws
• Platform Navigator and Automation Assets in IBM Cloud Pak for Integration update for ws
• Multiple vulnerabilities in IBM Application Modernization Accelerator
• Multiple vulnerabilities in IBM Transformation Advisor
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.22
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.21
• Multiple vulnerabilities in Bitbucket Data Center
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19