Skip to content
OpenAdvisories
Medium 1 exploited CVE WID-SEC-2026-3047 5 CVEs

IBM Planning Analytics: Mehrere Schwachstellen

Published Aug 26, 2026 · Updated Aug 26, 2026 · de-DE

Vendor: IBM Product: Planning Analytics Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Planning Analytics ausnutzen, um einen Denial of Service Angriff durchzuführen oder Daten zu manipulieren.

Product

IBM Planning Analytics ist eine Softwarelösung für Unternehmensplanung und -analyse, die Budgetierung, Forecasting und Reporting unterstützt.

Vulnerabilities 5

  • High 7.5
    CVE-2023-44487 Exploited Public exploit EPSS 100%

    HTTP/2 Stream Cancellation Attack

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

    nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
    KEV Oct 10, 2023
  • High 7.1
    CVE-2026-13365

    IBM Planning Analytics Local is affected by security vulnerabilities

    IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

    IBM Planning Analytics
  • Medium 5.3
    CVE-2026-47244

    Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings …

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2026-48043

    netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

    Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a p…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2026-50020

    Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before reading the first request-line, `HttpObjectDecoder` skips every byte for which `Character.isISOControl(b)` is `t…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

Revision history

  1. #1

    Initiale Fassung

References