IBM Maximo Application Suite IoT Component Third-Party Dependency Vulnerability Advisory (CVE List)

IBM Maximo Application Suite - IoT Component Vulnerability Summary Vulnerability Overview The IBM Maximo Application Suite - IoT Component utilizes multiple third-party dependencies, several of which contain vulnerabilities. Specifically: CVE-2026-10723: BIND may accept invalid NSEC3 records for sub-zones as valid, allowing attackers to forge AUTHORITY responses. CVE-2026-11331: An attacker can guess that a resolver uses RPZ and wildcard CNAME policies, triggering a NAMETOOLONG error condition and causing unexpected termination of BIND 9 software. CVE-2026-11622: DNSSEC validating resolvers may experience memory exhaustion under random subdomain attacks. CVE-2026-11721: An attacker can respond with RRSETs containing fewer labels, leading to cache poisoning. CVE-2026-13204: If a trusted zone is covered by both NSEC and NSEC3 records, BIND may terminate unexpectedly. CVE-2026-13321: The BIND resolver accepts validly signed NSEC records from outside the signing zone. CVE-2026-69247: The cryptography package has observable timing differences during decryption. CVE-2026-69248: The cryptography package has issues with invalid certificate chains during certificate verification. CVE-2026-69249: The python-cryptography package risks resource exhaustion when processing certificate chains. CVE-2026-75881: IBM Maximo Application Suite - IoT Component may suffer denial of service due to infinite resolution loops. CVE-2026-14164: The libarchive RAR5 reader contains a double-free vulnerability. CVE-2023-47038: Perl contains a heap overflow vulnerability. CVE-2025-40909: Perl contains an uncontrolled search path vulnerability. CVE-2026-92876: IBM Maximo Application Suite - IoT Component may suffer denial of service due to uncontrolled recursion. GHSA-537c-gmf6-5ccf: The pyca/cryptography wheels contain a statically linked copy of OpenSSL with an out-of-bounds read vulnerability. Scope of Impact Affected Product: IBM Maximo Application Suite - IoT Component Affected Versions: 9.2.0, 9.1.0, 9.0.0 Operating System: RedHat OpenShift Remediation Recommended Actions: IBM strongly recommends immediate remediation via upgrade. Fixed Versions: - IBM Maximo Application Suite - IoT Component version 9.2.3 or later (available via Catalog under Update Available) - IBM Maximo Application Suite - IoT Component version 9.1.15 or later (available via Catalog under Update Available) - IBM Maximo Application Suite - IoT Component version 9.0.24 or later (available via Catalog under Update Available) Additional Information Workarounds: None References: - Complete CVSS v3 Guide - On-line Calculator v3 Related Resources: - IBM Secure Engineering Web Portal - IBM Product Security Incident Response Blog

Goal Reached Thanks to every supporter — we hit 100%!

IBM Maximo Application Suite IoT Component Third-Party Dependency Vulnerability Advisory (CVE List)

More from this source