DeutschShown in its original language — a full translation is planned for a future version.
IBM App Connect Enterprise: Mehrere Schwachstellen
view advisory published 2026-08-02
Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Daten zu manipulieren.
01
describes (13)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-59877US | high7.5 | — | ||
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching… | ||||
| CVE-2026-59869US | — | — | ||
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only… | ||||
| CVE-2026-13676US | — | — | ||
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the… | ||||
| CVE-2026-54285US | — | — | ||
opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound bag… | ||||
| CVE-2026-53550US | — | — | ||
js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by re… | ||||
| CVE-2026-9697US | — | — | ||
Impact:
undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tun… | ||||
| CVE-2026-9679US | — | — | ||
Impact:
undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equi… | ||||
| CVE-2026-9678US | — | — | ||
Impact:
Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache fi… | ||||
| CVE-2026-6734US | high8.8 | — | ||
Impact:
When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requ… | ||||
| CVE-2026-6733US | — | — | ||
Impact:
Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 r… | ||||
| CVE-2026-11525US | — | — | ||
Impact:
When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact ma… | ||||
| CVE-2026-9675US | — | — | ||
Impact:
The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can… | ||||
| CVE-2026-12151US | — | — | ||
Impact:
The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malici… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:49680 vom 2026-08-03external
- Red Hat Security Advisory RHSA-2026:49687 vom 2026-08-03external
- Red Hat Security Advisory RHSA-2026:49689 vom 2026-08-03external
- Red Hat Security Advisory RHSA-2026:50357 vom 2026-08-04external
- Red Hat Security Advisory RHSA-2026:50850 vom 2026-08-05external
- Red Hat Security Advisory RHSA-2026:51028 vom 2026-08-06external
- WID-SEC-W-2026-2618 - CSAF Versionself
- WID-SEC-2026-2618 - Portal Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan