DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
IBM App Connect Enterprise: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-08-02
Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Daten zu manipulieren.
01
beschreibt (13)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-59877US | high7.5 | — | ||
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching… | ||||
| CVE-2026-59869US | — | — | ||
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only… | ||||
| CVE-2026-13676US | — | — | ||
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the… | ||||
| CVE-2026-54285US | — | — | ||
opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound bag… | ||||
| CVE-2026-53550US | — | — | ||
js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by re… | ||||
| CVE-2026-9697US | — | — | ||
Impact:
undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tun… | ||||
| CVE-2026-9679US | — | — | ||
Impact:
undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equi… | ||||
| CVE-2026-9678US | — | — | ||
Impact:
Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache fi… | ||||
| CVE-2026-6734US | high8.8 | — | ||
Impact:
When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requ… | ||||
| CVE-2026-6733US | — | — | ||
Impact:
Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 r… | ||||
| CVE-2026-11525US | — | — | ||
Impact:
When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact ma… | ||||
| CVE-2026-9675US | — | — | ||
Impact:
The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can… | ||||
| CVE-2026-12151US | — | — | ||
Impact:
The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malici… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2026:49680 vom 2026-08-03external
- Red Hat Security Advisory RHSA-2026:49687 vom 2026-08-03external
- Red Hat Security Advisory RHSA-2026:49689 vom 2026-08-03external
- Red Hat Security Advisory RHSA-2026:50357 vom 2026-08-04external
- Red Hat Security Advisory RHSA-2026:50850 vom 2026-08-05external
- Red Hat Security Advisory RHSA-2026:51028 vom 2026-08-06external
- WID-SEC-W-2026-2618 - CSAF Versionself
- WID-SEC-2026-2618 - Portal Versionself
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan