Description
IBM Semeru Runtime 8.0.302.0 through 8.0.442.0, 11.0.12.0 through 11.0.26.0, 17.0.0.0 through 17.0.14.0, and 21.0.0.0 through 12.0.6.0 is vulnerable to a denial of service caused by a buffer overflow and subsequent crash, due to a defect in its native AES/CBC encryption implementation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| IBM | Semeru Runtime | 8.0.302.0 – ≤ 8.0.442.0, 11.0.12.0 – ≤ 11.0.26.0, 17.0.0.0 – ≤ 17.0.14.0, 21.0.0.0 – ≤ 21.0.6.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | java-21-ibm-semeru-certified-jdk +4 | 1:21.0.7.0.6-1.el10_0 | RHSA-2025:8063 |
Advisories 3
- RHSA-2025:8063 Red Hat Security Advisory: java-21-ibm-semeru-certified-jdk bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- WID-SEC-2025-1056 IBM Semeru Runtime: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · May 12, 2026
- NCSC-2025-0269 Kwetsbaarheden verholpen in IBM Cognos Command Center NCSC-NL (Netherlands) · Aug 27, 2025
References
- https://www.ibm.com/support/pages/node/7233415 vendor-advisory patch