IBM Planning Analytics Multiple Vulnerabilities (CSRF/Resource Consumption)

Vulnerability Overview IBM Planning Analytics Local is affected by security vulnerabilities, specifically the following four CVEs: 1. CVE-2026-47244 - Description: The Netty network application framework contains a vulnerability when developing protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, was not correctly initializing and , allowing TCP connections to create a large number of long-lived stream objects. - CWE: CWE-400: Uncontrolled Resource Consumption - CVSS Base Score: 5.3 - CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) 2. CVE-2026-48043 - Description: The Netty network application framework contains a vulnerability when developing protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the class orchestrates HTTP/2 decompression by embedding an pseudo-stream , which may lead to resource leaks. - CWE: CWE-400: Uncontrolled Resource Consumption - CVSS Base Score: 7.5 - CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) 3. CVE-2026-13365 - Description: IBM Planning Analytics Local contains a cross-site request forgery (CSRF) vulnerability that allows attackers to perform malicious and unauthorized actions. - CWE: CWE-352: Cross-Site Request Forgery (CSRF) - CVSS Base Score: 7.1 - CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L) 4. CVE-2026-50020 - Description: The Netty network application framework contains a vulnerability when developing protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, exhibited significant leniency beyond RFC 9112 §2.2 in handling non-CRLF control characters during HTTP/1.0 POST requests, which may lead to request boundary confusion. - CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ("HTTP Request/Response Smuggling") - CVSS Base Score: 5.3 - CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) Affected Products Affected Products: - IBM Planning Analytics 2.0 - IBM Planning Analytics 2.1 Remediation Fixed Versions: - IBM Planning Analytics Local 2.1.20 - 2.1.22 - IBM Planning Analytics Cloud environment is fixed Fix Source: - IBM Planning Analytics Local 2.1.23 is now available from Fix Central Additional Information Release Date: August 12, 2026 Initial Release Date: August 12, 2026 Document Number: 7283486 Software Version: 2.0 References Complete CVSS v3 Guide On-line Calculator v3 Disclaimer The Common Vulnerability Scoring System (CVSS) is an industry open standard designed to communicate vulnerability severity and help determine response urgency and priority, as defined by the Forum of Incident Response and Security Teams (FIRST). IBM provides CVSS scores "as is" without any express or implied warranties. Customers are responsible for assessing the impact of vulnerabilities on their environments. IBM does not guarantee that all vulnerabilities have been fixed or that all vulnerabilities have been disclosed. The "Affected Products and Versions" cited in IBM security bulletins refer only to products and versions supported and maintained by IBM. Therefore, products and versions not cited here, which are unsupported or under extended support, are not considered by IBM to be free of vulnerabilities in this security bulletin. The citation of one or more unsupported or extended support products or versions in this security bulletin does not impose an obligation on IBM to fix any unsupported or extended support products or versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Planning Analytics Multiple Vulnerabilities (CSRF/Resource Consumption)

More from this source