Medium WID-SEC-2026-0759 6 CVEs

IBM Planning Analytics: Mehrere Schwachstellen

Published Mar 17, 2026 · Updated Mar 17, 2026 · de-DE

Vendor: IBM Product: Planning Analytics Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM Planning Analytics ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.

Product

IBM Planning Analytics ist eine Softwarelösung für Unternehmensplanung und -analyse, die Budgetierung, Forecasting und Reporting unterstützt.

Vulnerabilities 6

High 7.5

CVE-2025-14874

Nodemailer: nodemailer: denial of service via crafted email address header

A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.

Red Hat nodemailer Red Hat Advanced Cluster Management for Kubernetes 2 nodemailer Debian Ubuntu Wolfi npm Maven

Dec 18, 2025
High 7.5

CVE-2025-61729

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certi…

Go standard library crypto/x509 katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Dec 2, 2025
Medium 6.5

CVE-2025-61727

Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.exa…

Go standard library crypto/x509 katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Dec 3, 2025
Medium 6.5

CVE-2026-1267

IBM Planning Analytics Information Disclosure

IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data and administrative functionalities due to lack of proper access controls.

IBM Planning Analytics Local

Mar 17, 2026
Medium 5.7

CVE-2025-14806

IBM Planning Analytics Information Disclosure

IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources.

IBM Planning Analytics Local

Mar 17, 2026
Low 3.7

CVE-2025-15284

arrayLimit bypass in bracket notation allows DoS via memory exhaustion

Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consist…

langfuse-3-worker katib-suggestion-hyperopt katib-earlystopping katib-suggestion-skopt-enas Debian Ubuntu Azure Linux Wolfi npm

Dec 29, 2025

Revision history

2026-03-17 #1
Initiale Fassung

References

IBM Security Bulletin vom 2026-03-17
https://www.ibm.com/support/pages/node/7263581
Github Advisory vom 2025-11-27 mit PoC
https://github.com/advisories/GHSA-rcmh-qjqh-p98v