Skip to content
OpenAdvisories
Medium WID-SEC-2026-3204 3 CVEs

IBM App Connect Enterprise: Mehrere Schwachstellen

Published Sep 6, 2026 · Updated Sep 6, 2026 · de-DE

Vendor: IBM Product: App Connect Enterprise Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um einen Denial of Service Angriff durchzuführen oder Daten zu manipulieren.

Product

IBM App Connect Enterprise kombiniert die branchenbewährten Technologien des IBM Integration Bus mit Cloud-nativen Technologien.

Vulnerabilities 3

  • Critical 9.2
    CVE-2026-54466

    websocket-driver: Message corruption via abuse of protocol length headers

    websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the h…

    faye websocket-driver-node argo-workflows-ui-4.0 websocket-driver Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-39244

    adm-zip: Crafted ZIP file triggers 4GB memory allocation

    adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates memory based on the declared uncompressed size from the ZIP…

    sqlpad saf adm-zip Wolfi npm
  • Medium 6.3
    CVE-2026-54490

    websocket-driver: Resource limit bypass via message compression

    websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message…

    faye websocket-driver-node argo-workflows-ui-4.0 node-websocket-driver Debian Ubuntu Wolfi npm

Revision history

  1. #1

    Initiale Fassung

References