Skip to content
OpenAdvisories
Medium WID-SEC-2026-0328 7 CVEs

IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen

Published Feb 5, 2026 · Updated Feb 5, 2026 · de-DE

Vendor: IBM Product: App Connect Enterprise Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise Certified Container ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Zustand zu verursachen, die Authentifizierung zu umgehen, vertrauliche Informationen zu manipulieren oder offenzulegen.

Product

IBM App Connect Enterprise kombiniert die branchenbewährten Technologien des IBM Integration Bus mit Cloud-nativen Technologien.

Vulnerabilities 7

  • High 8.7
    CVE-2026-0621

    MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS

    Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression use…

    Anthropic MCP TypeScript SDK langfuse-3-worker langfuse-3 Wolfi npm
  • High 8.2
    CVE-2026-22817

    JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the JWT header’s alg value to influence signature verification when the selected JWK …

    honojs hono langfuse-3-worker hono Wolfi npm
  • High 8.2
    CVE-2026-22818

    JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when th…

    honojs hono langfuse-3-worker hono Wolfi npm
  • High 7.5
    CVE-2025-61729

    Excessive resource consumption when printing error string for host certificate validation in crypto/x509

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certi…

    Go standard library crypto/x509 katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-21226

    Azure Core shared client library for Python Remote Code Execution Vulnerability

    Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network.

    Microsoft Azure Core shared client library for Python open-webui airflow-3 Wolfi PyPI
  • Medium 6.5
    CVE-2025-61727

    Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

    An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.exa…

    Go standard library crypto/x509 katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.1
    CVE-2025-13491

    IBM App Connect Enterprise Certified Container Information Disclosure

    IBM App Connect Enterprise Certified Container CD: 11.2.0 through 11.6.0, 12.1.0 through 12.19.0 and 12.0 LTS: 12.0.0 through 12.0.19 could allow an attacker to access sensitive files or modify configurations due to an untrusted search path.

    IBM App Connect Enterprise Certified Container

Revision history

  1. #1

    Initiale Fassung

References