Use of uninitialized resource in ws - CVE-2026-45736

Vulnerability identifier: #VU131249

CSH Severity: Low

CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-45736

CWE-ID: CWE-908

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to use of uninitialized resource in websocket.close() when processing a TypedArray passed as the reason argument. A remote privileged user can pass a crafted TypedArray as the close reason to disclose sensitive information.

The issue is only exploitable through misuse that is unlikely in practice.

ws
IBM Cloud Transformation Advisor
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM Maximo Application Suite - Manage Component
Bitbucket Data Center
Confluence Data Center
IBM Decision Optimization for Cloud Pak for Data
Storage Fusion Data Foundation
InfoSphere Optim Archive Viewer
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
Application Modernization Accelerator
IBM App Connect Enterprise
Red Hat OpenShift Container Platform

Install security update from vendor's website.

ws - update to 8.20.1
IBM Cloud Transformation Advisor - update to 5.0.0
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.22-sc2, 4.3.5
Storage Fusion Data Foundation - update to 4.22
IBM Maximo Application Suite - Manage Component - addressed in versions 9.0.27, 9.1.19
Bitbucket Data Center - addressed in versions 9.4.22, 10.2.5, 10.3.1
Confluence Data Center - update to 9.2.5
InfoSphere Optim Archive Viewer - update to 11.7.0.15
IBM App Connect Enterprise - addressed in versions 12.0.12.27, 13.0.8.0
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 16.1.0.26, 16.2.0
Red Hat OpenShift Container Platform - addressed in versions 4.19.40, 4.20.31, 4.21.25, 4.21.26, 4.22.6
Application Modernization Accelerator - update to 5.0.0
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6

• https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx
• https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086

• Use of uninitialized resource in ws
• Use of uninitialized resource in Confluence Data Center
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• IBM Maximo Application Suite - Manage Component update for ws
• Platform Navigator and Automation Assets in IBM Cloud Pak for Integration update for ws
• Multiple vulnerabilities in IBM Application Modernization Accelerator
• Multiple vulnerabilities in IBM Transformation Advisor
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.22
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.21
• Multiple vulnerabilities in Bitbucket Data Center
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.20
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.21
• IBM InfoSphere Optim Archive Viewer update for ws
• IBM Fusion Data Foundation update for ws