Skip to content
OpenAdvisories
High WID-SEC-2026-1407 29 CVEs

IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen

Published May 6, 2026 · Updated Aug 3, 2026 · Revision 19 · de-DE

Vendor: Fedora Vendor: IBM Vendor: Red Hat Vendor: SUSE Product: App Connect Enterprise Product: Business Automation Workflow Product: Enterprise Linux Product: Linux Product: Linux Product: Maximo Asset Management Product: MQ Product: openshift Product: Planning Analytics Product: QRadar SIEM Product: SPSS Product: Sterling Connect:Direct Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise Certified Container ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Product

IBM App Connect Enterprise kombiniert die branchenbewährten Technologien des IBM Integration Bus mit Cloud-nativen Technologien.

Vulnerabilities 29

  • High 8.7
    CVE-2026-33151

    socket.io allows an unbounded number of binary attachments

    Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, whi…

    socketio socket.io katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm
  • High 8.7
    CVE-2026-35469

    SpdyStream: DOS on CRI

    spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTING…

    moby spdystream kubescape kots Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 8.6
    CVE-2026-39983 Public exploit

    FTP Command Injection via CRLF in basic-ftp

    basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir…

    patrickjuchli basic-ftp langfuse-3-worker code-server Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-33891

    Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() func…

    Digital Bazaar forge katib-suggestion-hyperopt katib-earlystopping Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-33894

    Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can forge signatur…

    Digital Bazaar forge katib-suggestion-hyperopt katib-earlystopping Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-33895

    Forge has signature forgery in Ed25519 due to missing S > L check

    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S …

    Digital Bazaar forge katib-suggestion-hyperopt katib-earlystopping Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-34601

    xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion

    xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing…

    xmldom xmldom sqlpad saf Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-4926

    path-to-regexp vulnerable to Denial of Service via sequential optional groups

    Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in ve…

    path-to-regexp path-to-regexp langfuse-3-worker vitess-23 Debian Wolfi npm
  • High 7.4
    CVE-2026-33896

    Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both t…

    Digital Bazaar forge katib-suggestion-hyperopt katib-earlystopping Ubuntu Wolfi npm
  • Medium 6.9
    CVE-2026-40895

    follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

    follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authoriza…

    follow-redirects follow-redirects langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  • Medium 6.9
    CVE-2026-41238

    DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

    DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses `DOMPurify.sanitize()` with the default configuration (no `CUSTOM…

    cure53 DOMPurify opensearch-dashboards-3 nextcloud-server-33 Debian Ubuntu Wolfi npm
  • Medium 6.8
    CVE-2026-28277

    LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading

    LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects du…

    langchain-ai langgraph langgraph PyPI
  • Medium 6.8
    CVE-2026-41239

    DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

    DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES` strips `{{...}}` expressions from untrusted HTML. This works in string mode but not with `RETURN_DOM`…

    cure53 DOMPurify opensearch-dashboards-3 nextcloud-server-33 Debian Ubuntu Wolfi npm
  • Medium 6.6
    CVE-2026-28684

    python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback

    python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite ar…

    theskumar python-dotenv kserve-storage-controller superset-6.0 Debian Ubuntu Wolfi PyPI
  • Medium 6.3
    CVE-2026-39409

    Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction() does not canonicalize IPv4-mapped IPv6 client addresses (e.g. ::ffff:127.0.0.1) before applying IPv4 allow or deny rules. In environments s…

    honojs hono langfuse-3-worker hono Wolfi npm
  • Medium 6.1
    CVE-2026-27142

    URLs in meta content attribute actions are not escaped in html/template

    Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be …

    Go standard library html/template langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.0
    CVE-2026-41240

    DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

    DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early exit for FORBID_AT…

    cure53 DOMPurify opensearch-dashboards-3 nextcloud-server-33 Debian Ubuntu Wolfi npm
  • Medium 5.9
    CVE-2026-33349

    fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation

    fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEnti…

    NaturalIntelligence fast-xml-parser langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • Medium 5.9
    CVE-2026-39408

    Hono has a path traversal in toSSG() allows writing files outside the output directory

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic rout…

    honojs hono langfuse-3-worker hono Wolfi npm
  • Medium 5.9
    CVE-2026-4923

    path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards

    Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. Unsafe…

    path-to-regexp path-to-regexp langfuse-3-worker vitess-23 Debian Wolfi npm
  • Medium 5.5
    CVE-2026-32288

    Unbounded allocation for old GNU sparse in archive/tar

    tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.

    Go standard library archive/tar golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.3
    CVE-2026-39406

    @hono/node-server has a middleware bypass via repeated slashes in serveStatic

    @hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g.…

    honojs node-server langfuse-3-worker langfuse-3 Wolfi npm
  • Medium 5.3
    CVE-2026-39407

    Hono has a middleware bypass via repeated slashes in serveStatic

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-ba…

    honojs hono langfuse-3-worker hono Wolfi npm
  • Medium 5.3
    CVE-2026-40347

    Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data

    Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, whic…

    Kludex python-multipart airflow-3 kserve-storage-controller Debian Ubuntu Wolfi PyPI
  • Medium 4.8
    CVE-2026-39410

    Hono has a non-breaking space prefix bypass in cookie name handling in getCookie()

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a discrepancy between browser cookie parsing and parse() handling allows cookie prefix protections to be bypassed. Cookie names that are treated as distinc…

    honojs hono langfuse-3-worker hono Wolfi npm
  • Medium 4.8
    CVE-2026-40175 Public exploit

    Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

    Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header …

    axios axios langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  • Medium 4.7
    CVE-2026-33916

    Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection

    Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prot…

    handlebars-lang handlebars.js prism opensearch-dashboards-3 Debian Ubuntu Wolfi npm
  • Medium 4.3
    CVE-2026-33532 Public exploit

    yaml is vulnerable to Stack Overflow via deeply nested YAML collections

    `yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase…

    eemeli yaml langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  • Low 3.7
    CVE-2026-26013

    LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages

    LangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_tokens_from_messages() method fetches arbitrary image_url values without validation when computing token counts for vision-enabled models. This …

    langchain-ai langchain open-webui langchain-core Wolfi PyPI

Revision history

  1. #19

    Neue Updates von IBM aufgenommen

  2. #18

    Neue Updates von Red Hat aufgenommen

  3. #17

    Neue Updates von IBM aufgenommen

  4. #16

    Neue Updates von Red Hat aufgenommen

  5. #15

    Neue Updates von SUSE aufgenommen

  6. #14

    Neue Updates von IBM aufgenommen

  7. #13

    Neue Updates von IBM aufgenommen

  8. #12

    Neue Updates von Red Hat aufgenommen

  9. #11

    Neue Updates von IBM und IBM-APAR aufgenommen

  10. #10

    Neue Updates von IBM und IBM-APAR aufgenommen

  11. #9

    Neue Updates von IBM aufgenommen

  12. #8

    Neue Updates von IBM aufgenommen

  13. #7

    Neue Updates von IBM aufgenommen

  14. #6

    Neue Updates von IBM aufgenommen

  15. #5

    Neue Updates von IBM und IBM-APAR aufgenommen

  16. #4

    Neue Updates von Red Hat aufgenommen

  17. #3

    Neue Updates von Red Hat aufgenommen

  18. #2

    Neue Updates von Fedora aufgenommen

  19. #1

    Initiale Fassung

References