IBM Guardium Data Protection Vulnerabilities: JSON Bypass, SQLi, DoS, Unauthorized Access (CVE-2026-59888, CVE-2026-84209, CVE-2026-84272)

Vulnerability Overview IBM Guardium Data Protection contains multiple security vulnerabilities that may impact its data protection capabilities. Detailed information regarding key vulnerabilities is as follows: 1. CVE-2026-59888 - Description: The annotation in Jackson-databind can be bypassed, leading to sensitive data leakage. - Impact: Attackers can bypass the annotation by crafting malicious JSON data to access ignored fields. - Fix: Upgrade to version 2.18.0 or higher. 2. CVE-2026-59889 - Description: The annotation in Jackson-databind can be bypassed, leading to sensitive data leakage. - Impact: Attackers can bypass the annotation by crafting malicious JSON data to access ignored fields. - Fix: Upgrade to version 2.18.0 or higher. 3. CVE-2026-18401 - Description: A resource exhaustion vulnerability exists in the non-blocking JSON parser in Jackson-core. - Impact: Attackers can cause the parser to exhaust resources by sending large amounts of small JSON data chunks, resulting in a Denial of Service (DoS). - Fix: Upgrade to version 2.18.0 or higher. 4. CVE-2026-68494 - Description: A resource exhaustion vulnerability exists in the non-blocking JSON parser in Jackson-core. - Impact: Attackers can cause the parser to exhaust resources by sending large amounts of small JSON data chunks, resulting in a Denial of Service (DoS). - Fix: Upgrade to version 2.18.0 or higher. 5. CVE-2026-84209 - Description: A SQL injection vulnerability exists in IBM Guardium Data Protection. - Impact: Attackers can execute arbitrary SQL operations by crafting malicious SQL commands. - Fix: Upgrade to the latest version. 6. CVE-2026-59901 - Description: An infinite loop vulnerability exists in the event-driven network application framework in Netty. - Impact: Attackers can cause an infinite loop by crafting malicious data, resulting in a Denial of Service (DoS). - Fix: Upgrade to version 4.1.136.Final or higher. 7. CVE-2026-59900 - Description: An inconsistency interpretation vulnerability exists in the HTTP/2 translation layer in Netty. - Impact: Attackers can cause inconsistent interpretation by crafting malicious HTTP/2 requests, resulting in a Denial of Service (DoS). - Fix: Upgrade to version 4.1.136.Final or higher. 8. CVE-2026-84272 - Description: An unauthorized access vulnerability exists in the edge controller component of IBM Guardium Data Protection. - Impact: Attackers can execute arbitrary container images and control managed edge clusters through unauthorized access. - Fix: Upgrade to the latest version. 9. CVE-2026-56819 - Description: A resource exhaustion vulnerability exists in the HTTP/2 translation layer in Netty. - Impact: Attackers can cause resource exhaustion by crafting malicious HTTP/2 requests, resulting in a Denial of Service (DoS). - Fix: Upgrade to version 4.1.136.Final or higher. 10. CVE-2026-55831 - Description: A resource exhaustion vulnerability exists in the SPDY settings decoder in Netty. - Impact: Attackers can cause resource exhaustion by crafting malicious SPDY settings, resulting in a Denial of Service (DoS). - Fix: Upgrade to version 4.1.136.Final or higher. 11. CVE-2026-55833 - Description: A resource exhaustion vulnerability exists in the SPDY headers decoder in Netty. - Impact: Attackers can cause resource exhaustion by crafting malicious SPDY headers, resulting in a Denial of Service (DoS). - Fix: Upgrade to version 4.1.136.Final or higher. 12. CVE-2026-56745 - Description: A memory exhaustion vulnerability exists in the SPDY-to-HTTP decoder in Netty. - Impact: Attackers can cause memory exhaustion by crafting malicious SPDY-to-HTTP requests, resulting in a Denial of Service (DoS). - Fix: Upgrade to version 4.1.136.Final or higher. 13. CVE-2026-56746 - Description: A security control bypass vulnerability exists in the CORS handler in Netty. - Impact: Attackers can bypass security controls by crafting malicious requests, allowing unauthorized operations. - Fix: Upgrade to version 4.1.136.Final or higher. 14. CVE-2026-59898 - Description: A protocol confusion vulnerability exists in the WebSocket upgrade handler in Netty. - Impact: Attackers can cause protocol confusion by crafting malicious WebSocket upgrade requests, resulting in a Denial of Service (DoS). - Fix: Upgrade to version 4.1.136.Final or higher. 15. CVE-2026-59899 - Description: A resource exhaustion vulnerability exists in the HTTP content encoder in Netty. - Impact: Attackers can cause resource exhaustion by crafting malicious HTTP requests, resulting in a Denial of Service (DoS). - Fix: Upgrade to version 4.1.136.Final or higher. 16. CVE-2026-59921 - Description: A CRLF injection vulnerability exists in the HTTP request encoder in Netty. - Impact: Attackers can cause CRLF injection by crafting malicious HTTP requests, resulting in a Denial of Service (DoS). - Fix: Upgrade to version 4.1.136.Final or higher. 17. CVE-2026-82900 - Description: A path traversal vulnerability exists in IBM Guardium Data Protection. - Impact:

Goal Reached Thanks to every supporter — we hit 100%!

IBM Guardium Data Protection Vulnerabilities: JSON Bypass, SQLi, DoS, Unauthorized Access (CVE-2026-59888, CVE-2026-84209, CVE-2026-84272)

More from this source