CIB seven 2.1.8 EE - Release Notes

Release Date: August 7, 2026

Highlights

  • LDAP Configurable authentication cache backported to this line, reducing redundant directory lookups and improving login performance for large directories
  • Security 23 CVEs resolved: seven High across openjdk17, postgresql, c-ares, and curl/libcurl; fourteen Medium in curl/libcurl, openjdk17, and jackson-databind; two Low in openjdk17. axios and vite were also upgraded to resolve reported npm vulnerabilities, and swagger-ui was pinned to resolve a reported dependency vulnerability, without an assigned CVE ID.
  • Variables (EE exclusive) Fixed historic variable history values being merged by variable name instead of by historic detail id

New Features

LDAP Configurable Cache

  • LDAP authentication now supports a configurable cache to reduce redundant directory lookups and improve performance under load
  • Cache parameters are configurable in the distribution YAML configuration files

Bug Fixes

Variables (EE exclusive)

  • Fixed historic variable history values being merged by variable name instead of by historic detail id

Technical Updates

Dependency Updates

  • Update jackson from 2.21.4 to 2.21.5, fixing CVE-2026-54515, CVE-2026-59889, and GHSA-mhm7-754m-9p8w
  • Update postgresql (JDBC driver) from 42.7.11 to 42.7.12, fixing CVE-2026-54291
  • Update swagger-ui to a patched version, resolving a reported dependency vulnerability
  • Update axios from 1.13.2 to 1.18.1, resolving reported npm vulnerabilities (EE exclusive)
  • Update vite from 6.4.1 to 6.4.3, resolving reported npm vulnerabilities (EE exclusive)
  • Update openjdk17 (openjdk17-jre-headless) from 17.0.19_p10-r0 to 17.0.20_p8-r0 (Alpine base image)
  • Update c-ares from 1.34.6-r0 to 1.34.8-r0 (Alpine base image), fixing CVE-2026-33630
  • Update curl (libcurl) from 8.19.0-r0 to 8.20.0-r0 (Alpine base image)

Resolved CVE Vulnerabilities

High Severity
  • CVE-2026-33630 - Vulnerability fixed by upgrading the affected package. Affects c-ares.
  • CVE-2026-41254 - Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication. Affects openjdk17-jre-headless. - CVSS 7.5.
  • CVE-2026-47063 - Easily exploitable vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Affects openjdk17-jre-headless. - CVSS 7.5.
  • CVE-2026-54291 - Channel-binding downgrade vulnerability in pgjdbc, allowing an on-path attacker to bypass SCRAM channel binding. Affects org.postgresql:postgresql. - CVSS 5.9.
  • CVE-2026-5773 - A logical error in the connection reuse mechanism for SMB transfers could lead libcurl to reuse an existing SMB connection with a different share than intended. Affects curl, libcurl. - CVSS 6.5.
  • CVE-2026-62574 - Easily exploitable vulnerability allows a low-privileged attacker with logon access to the infrastructure to compromise Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Affects openjdk17-jre-headless. - CVSS 7.8.
  • CVE-2026-6276 - A custom Host: header used in an initial HTTP request could leak to a second host when the connection is reused without a new Host: header, resulting in a cookie leak. Affects curl, libcurl. - CVSS 3.7.
Medium Severity
  • CVE-2026-46917 - Easily exploitable vulnerability allows an unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Affects openjdk17-jre-headless. - CVSS 5.3.
  • CVE-2026-46968 - Difficult to exploit vulnerability allows an unauthenticated attacker with network access via TLS to compromise Oracle Java SE. Affects openjdk17-jre-headless. - CVSS 5.9.
  • CVE-2026-47021 - Easily exploitable vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Affects openjdk17-jre-headless. - CVSS 5.3.
  • CVE-2026-47027 - Easily exploitable vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Affects openjdk17-jre-headless. - CVSS 5.3.
  • CVE-2026-4873 - An unencrypted connection followed by a subsequent request requiring TLS to the same host could bypass the TLS requirement due to incorrect connection reuse, leaking data in cleartext. Affects curl, libcurl. - CVSS 5.3.
  • CVE-2026-54515 - Per-property @JsonIgnoreProperties exclusions combined with @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES) could restore properties that were meant to stay ignored, making them writable again. Affects com.fasterxml.jackson.core:jackson-databind. - CVSS 5.3.
  • CVE-2026-5545 - An authenticated HTTP(S) request following a Negotiate-authenticated one to the same host may incorrectly reuse the previous connection, letting the second request run under different credentials. Affects curl, libcurl. - CVSS 6.5.
  • CVE-2026-59889 - A property annotated with both @JsonView and @JsonUnwrapped could be written from attacker JSON under a less-privileged active view. Affects com.fasterxml.jackson.core:jackson-databind. - CVSS 6.5.
  • CVE-2026-60147 - Easily exploitable vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Affects openjdk17-jre-headless. - CVSS 6.5.
  • CVE-2026-6253 - Redirecting from an authenticated proxy to an unauthenticated one when using distinct proxies per URL scheme could inadvertently expose the initial proxy’s credentials. Affects curl, libcurl. - CVSS 5.3.
  • CVE-2026-6429 - Following an HTTP redirect while using a .netrc file for credentials could send the password from the initial connection to the redirected host. Affects curl, libcurl. - CVSS 6.5.
  • CVE-2026-7009 - Vulnerability fixed by upgrading the affected package. Affects curl, libcurl.
  • CVE-2026-7168 - Vulnerability fixed by upgrading the affected package. Affects curl, libcurl.
  • GHSA-mhm7-754m-9p8w - A creator parameter annotated with both @JsonView(RestrictedView.class) and an external-type-id @JsonTypeInfo could be populated from attacker JSON even when a more restrictive view was active. Affects com.fasterxml.jackson.core:jackson-databind. - CVSS 6.5.
Low Severity
  • CVE-2026-47010 - Difficult to exploit vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Affects openjdk17-jre-headless. - CVSS 3.7.
  • CVE-2026-47059 - Difficult to exploit vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Affects openjdk17-jre-headless. - CVSS 3.7.

On this Page: