CIB seven 2.0.13 EE - Release Notes

Release Date: September 8, 2026

Highlights

  • Security 46 CVEs resolved (3 Critical, 11 High, 15 Medium, 17 Low) across Apache Tomcat, curl/libcurl, openssl (libcrypto3, libssl3), Apache HttpComponents (httpcore5, httpclient5), and log4j, from the Alpine base image and JVM dependency updates below; the plexus-utils fix is test-environment only and not present in the production platform

Technical Updates

Dependency Updates

  • Update Spring Boot from 3.5.15 to 3.5.16; an inadvertent automatic upgrade to Spring Boot 4.1.1 introduced by Renovate was reverted to remain on the supported 3.x line
  • Update spring-core to a patched version
  • Update log4j from 2.25.4 to 2.25.5, fixing CVE-2026-49844
  • Update Tomcat (org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina) from 10.1.55 to 10.1.58, fixing CVE-2026-65182, CVE-2026-65905, and CVE-2026-68525
  • Update httpcore5 (org.apache.httpcomponents.core5:httpcore5, httpcore5-h2) from 5.3.6 to 5.4.3, fixing CVE-2026-54399 and CVE-2026-54428
  • Update httpclient5 (org.apache.httpcomponents.client5:httpclient5) from 5.5.2 to 5.6.3, fixing CVE-2026-64607
  • Update curl (libcurl) from 8.20.0-r0 to 8.22.0-r0 (Alpine base image), resolving multiple vulnerabilities (see Resolved CVE Vulnerabilities below)
  • Update plexus-utils to 3.6.1, fixing CVE-2025-67030 in the test environment
  • Update openssl (libcrypto3, libssl3) from 3.5.7-r0 to 3.5.8-r0 (Alpine base image), resolving multiple vulnerabilities (see Resolved CVE Vulnerabilities below)

Resolved CVE Vulnerabilities

Critical Severity
  • CVE-2026-65182 - Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. Affects org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina. - CVSS 9.1.
  • CVE-2026-65905 - Authentication Bypass by Capture-replay vulnerability in Apache Tomcat’s DIGEST authenticator. Affects org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina. - CVSS 9.8.
  • CVE-2026-68525 - Incorrect Authorization vulnerability in Apache Tomcat’s FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. Affects org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina. - CVSS 9.1.
High Severity
  • CVE-2026-11352 - An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Affects curl, libcurl. - CVSS 7.5.
  • CVE-2026-11586 - By default, curl automatically responds to WebSocket PING frames. Affects curl, libcurl. - CVSS 7.5.
  • CVE-2026-12064 - When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect occurs between the tool layer and libcurl. Affects curl, libcurl. - CVSS 7.5.
  • CVE-2026-14456 - Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. Affects libcrypto3, libssl3. - CVSS 7.5.
  • CVE-2026-54399 - Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length. Affects org.apache.httpcomponents.core5:httpcore5. - CVSS 7.5.
  • CVE-2026-54428 - Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS… Affects org.apache.httpcomponents.core5:httpcore5-h2. - CVSS 7.5.
  • CVE-2026-8286 - A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not. Affects curl, libcurl. - CVSS 8.1.
  • CVE-2026-8458 - libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different ‘services’. Affects curl, libcurl. - CVSS 6.5.
  • CVE-2026-8925 - The curl logic that works with SASL authentication could end up cleaning up the GSASL context twice without clearing the pointer in between, making it free() the same pointer twice. Affects curl, libcurl. - CVSS 9.8.
  • CVE-2026-8927 - When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Affects curl, libcurl. - CVSS 9.1.
  • CVE-2026-9547 - When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. Affects curl, libcurl. - CVSS 7.4.
Medium Severity
  • CVE-2026-10536 - A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, subsequently invokes curl_easy_reset(), and finally terminates the handle with curl_easy_cleanup(). Affects curl, libcurl. - CVSS 9.8.
  • CVE-2026-11564 - libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. Affects curl, libcurl. - CVSS 6.5.
  • CVE-2026-11856 - Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB. Affects curl, libcurl. - CVSS 9.8.
  • CVE-2026-18798 - Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. Affects libcrypto3, libssl3. - CVSS 7.5.
  • CVE-2026-49844 - * The application logs a MapMessage that contains an attacker-controlled floating-point value. Affects org.apache.logging.log4j:log4j-api. - CVSS 5.9.
  • CVE-2026-63072 - Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. Affects libcrypto3, libssl3. - CVSS 7.5.
  • CVE-2026-63076 - Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. Affects libcrypto3, libssl3. - CVSS 7.5.
  • CVE-2026-64607 - HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Affects org.apache.httpcomponents.client5:httpclient5. - CVSS 5.3.
  • CVE-2026-8924 - A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set ‘super cookies’ that bypass the Public Suffix List check. Affects curl, libcurl. - CVSS 9.1.
  • CVE-2026-8926 - When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username(without a password), like https://user@example.com/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no match for… Affects curl, libcurl. - CVSS 9.1.
  • CVE-2026-8932 - libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. Affects curl, libcurl. - CVSS 7.5.
  • CVE-2026-9079 - libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them. Affects curl, libcurl. - CVSS 9.8.
  • CVE-2026-9080 - Calling curl_easy_pause() within the event-based CURLMOPT_SOCKETFUNCTION callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer’s memory has been freed. Affects curl, libcurl. - CVSS 7.3.
  • CVE-2026-9545 - In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker’s impostor machine - without a valid certificate. Affects curl, libcurl. - CVSS 7.5.
  • CVE-2026-9546 - A vulnerability in libcurl caused the HTTP Referer: header to persist even when explicitly cleared. Affects curl, libcurl. - CVSS 7.5.
Low Severity
  • CVE-2025-67030 - A reported vulnerability in plexus-utils, addressed by upgrading to 3.6.1. Note: plexus-utils is used only for testing and is not present in the production CIB seven platform.
  • CVE-2026-13608 - [Unknown description]. Affects curl, libcurl.
  • CVE-2026-14457 - Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. Affects libcrypto3, libssl3. - CVSS 7.5.
  • CVE-2026-18924 - Description Not Available. Affects curl, libcurl.
  • CVE-2026-19931 - A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. Affects curl, libcurl.
  • CVE-2026-54874 - Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. Affects libcrypto3, libssl3. - CVSS 7.5.
  • CVE-2026-63073 - Percent characters survive the conversion, so a sender DN such as “CN=%s%n” reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. Affects libcrypto3, libssl3. - CVSS 5.9.
  • CVE-2026-63074 - This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. Affects libcrypto3, libssl3. - CVSS 7.5.
  • CVE-2026-63075 - Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. Affects libcrypto3, libssl3. - CVSS 7.5.
  • CVE-2026-75803 - Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Affects libcrypto3, libssl3.
  • CVE-2026-80229 - [Unknown description]. Affects curl, libcurl.
  • CVE-2026-80230 - Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected. Affects curl, libcurl.
  • CVE-2026-80231 - Description Not Available. Affects curl, libcurl.
  • CVE-2026-80255 - [Unknown description]. Affects curl, libcurl.
  • CVE-2026-80256 - Vulnerability fixed by upgrading the affected package. Affects curl, libcurl.
  • CVE-2026-82208 - [Unknown description]. Affects curl, libcurl.
  • CVE-2026-82209 - Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., attacker.co.uk). Affects curl, libcurl.

On this Page: