CIB seven 2.2.3 CE+ - Release Notes

Release Date: September 8, 2026

Highlights

  • Security 46 CVEs resolved (3 Critical, 11 High, 16 Medium, 16 Low) across Apache Tomcat, curl/libcurl, openssl (libcrypto3, libssl3), Apache HttpComponents (httpcore5, httpclient5), netty, and log4j, from the Alpine base image and JVM dependency updates below; wildfly also updated to 41.0.1
  • Authorization Fixed a case-insensitive user id query bug that silently ignored additional query criteria and bypassed the READ permission check when looking up users by id
  • Engine Fixed a GraalJS polyglot Context leak in JavaScript script tasks that could exhaust memory under sustained load
  • Decision (DMN) DMN diagram viewport, panel size, and sidebar state are now persisted and restored across views

New Features

Decision (DMN) Diagrams

  • The DMN diagram viewport, panel size, and sidebar state are now persisted and restored across views

User Experience Improvements

Process Definitions

Execution Metrics

  • Added a copy button for each annual statistics item, and a total row for “last 12 months” statistics, in the Process Engine Metrics dashboard widget

Bug Fixes

Authorization

  • Fixed a case-insensitive user id query (RES.ID_ = ? OR LOWER(RES.ID_) = LOWER(?)) that was missing parentheses around the OR, causing it to silently ignore additional query criteria and to bypass the READ permission check when a user was looked up by id (e.g. GET /user?id=...)

Engine

  • Fixed a GraalJS polyglot Context leak in JavaScript script tasks (e.g. Spin/JSON transformations) that grew memory towards OutOfMemoryError under sustained load, by reusing non-cachable engines’ native bindings and closing contexts and buffered HTTP responses after evaluation

Tasklist

  • Fixed the task filter fetching more variables than configured and unnecessarily re-enriching them on auto-refresh
  • Fixed the task list failing to scroll to a task that had fallen outside the current filtered results

Execution Metrics

  • Fixed Process Engine Metrics chart data losing its month alignment when switching language
  • Fixed chart data labels, y-axis, and tooltip values not using the active locale’s number formatting

Process Instances

  • Fixed historic activity statistics not loading unless a specific tab was active
  • Fixed called process instances for a selected process instance appearing empty when the history level is none

Variables

  • Fixed finished-scope variables depending on the history level being available, which could leave the Variables tab empty even though runtime variables existed

Technical Updates

Dependency Updates

  • Update Spring Boot 4 from 4.0.7 to 4.0.8
  • Update Spring Boot from 3.5.15 to 3.5.16
  • Update log4j from 2.25.4 to 2.25.5, fixing CVE-2026-49844
  • Update wildfly from 41.0.0 to 41.0.1
  • Update Tomcat (tomcat10, org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina) from 10.1.55 to 10.1.59, fixing CVE-2026-65182, CVE-2026-65905, and CVE-2026-68525
  • Update httpcore5 (org.apache.httpcomponents.core5:httpcore5) from 5.3.4 to 5.4.3, fixing CVE-2026-54399 and CVE-2026-54428
  • Update httpclient5 (org.apache.httpcomponents.client5:httpclient5) from 5.5 to 5.6.4, fixing CVE-2026-64607
  • Update curl (libcurl) from 8.20.0-r0 to 8.22.0-r0 (Alpine base image), resolving multiple vulnerabilities (see Resolved CVE Vulnerabilities below)
  • Update netty (netty-codec-http) to a patched version, fixing CVE-2026-59903
  • Update postgresql (JDBC driver) to 42.7.13
  • Update graal.js to 21.3.19.1
  • Update resteasy to 6.2.17.Final
  • Update openssl (libcrypto3, libssl3) from 3.5.7-r0 to 3.5.8-r0 (Alpine base image), resolving multiple vulnerabilities (see Resolved CVE Vulnerabilities below)

Build & Configuration

  • Webjar dependencies are now marked optional to prevent transitive inclusion in downstream builds
  • Updated the wildfly and wildfly28 module templates to expose jdk.net for the new httpcore5/httpclient5 versions

Resolved CVE Vulnerabilities

Critical Severity
  • CVE-2026-65182 - Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. Affects org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina. - CVSS 9.1.
  • CVE-2026-65905 - Authentication Bypass by Capture-replay vulnerability in Apache Tomcat’s DIGEST authenticator. Affects org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina. - CVSS 9.8.
  • CVE-2026-68525 - Incorrect Authorization vulnerability in Apache Tomcat’s FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. Affects org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina. - CVSS 9.1.
High Severity
  • CVE-2026-11352 - An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Affects curl, libcurl. - CVSS 7.5.
  • CVE-2026-11586 - By default, curl automatically responds to WebSocket PING frames. Affects curl, libcurl. - CVSS 7.5.
  • CVE-2026-12064 - When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect occurs between the tool layer and libcurl. Affects curl, libcurl. - CVSS 7.5.
  • CVE-2026-14456 - Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. Affects libcrypto3, libssl3. - CVSS 7.5.
  • CVE-2026-54399 - Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length. Affects org.apache.httpcomponents.core5:httpcore5. - CVSS 7.5.
  • CVE-2026-54428 - Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS… Affects org.apache.httpcomponents.core5:httpcore5-h2. - CVSS 7.5.
  • CVE-2026-8286 - A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not. Affects curl, libcurl. - CVSS 8.1.
  • CVE-2026-8458 - libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different ‘services’. Affects curl, libcurl. - CVSS 6.5.
  • CVE-2026-8925 - The curl logic that works with SASL authentication could end up cleaning up the GSASL context twice without clearing the pointer in between, making it free() the same pointer twice. Affects curl, libcurl. - CVSS 9.8.
  • CVE-2026-8927 - When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Affects curl, libcurl. - CVSS 9.1.
  • CVE-2026-9547 - When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. Affects curl, libcurl. - CVSS 7.4.
Medium Severity
  • CVE-2026-10536 - A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, subsequently invokes curl_easy_reset(), and finally terminates the handle with curl_easy_cleanup(). Affects curl, libcurl. - CVSS 9.8.
  • CVE-2026-11564 - libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. Affects curl, libcurl. - CVSS 6.5.
  • CVE-2026-11856 - Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB. Affects curl, libcurl. - CVSS 9.8.
  • CVE-2026-18798 - Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. Affects libcrypto3, libssl3. - CVSS 7.5.
  • CVE-2026-49844 - * The application logs a MapMessage that contains an attacker-controlled floating-point value. Affects org.apache.logging.log4j:log4j-api. - CVSS 5.9.
  • CVE-2026-59903 - Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. Affects io.netty:netty-codec-http. - CVSS 6.5.
  • CVE-2026-63072 - Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. Affects libcrypto3, libssl3. - CVSS 7.5.
  • CVE-2026-63076 - Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. Affects libcrypto3, libssl3. - CVSS 7.5.
  • CVE-2026-64607 - HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Affects org.apache.httpcomponents.client5:httpclient5. - CVSS 5.3.
  • CVE-2026-8924 - A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set ‘super cookies’ that bypass the Public Suffix List check. Affects curl, libcurl. - CVSS 9.1.
  • CVE-2026-8926 - When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username(without a password), like https://user@example.com/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no match for… Affects curl, libcurl. - CVSS 9.1.
  • CVE-2026-8932 - libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. Affects curl, libcurl. - CVSS 7.5.
  • CVE-2026-9079 - libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them. Affects curl, libcurl. - CVSS 9.8.
  • CVE-2026-9080 - Calling curl_easy_pause() within the event-based CURLMOPT_SOCKETFUNCTION callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer’s memory has been freed. Affects curl, libcurl. - CVSS 7.3.
  • CVE-2026-9545 - In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker’s impostor machine - without a valid certificate. Affects curl, libcurl. - CVSS 7.5.
  • CVE-2026-9546 - A vulnerability in libcurl caused the HTTP Referer: header to persist even when explicitly cleared. Affects curl, libcurl. - CVSS 7.5.
Low Severity
  • CVE-2026-13608 - [Unknown description]. Affects curl, libcurl.
  • CVE-2026-14457 - Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. Affects libcrypto3, libssl3. - CVSS 7.5.
  • CVE-2026-18924 - Description Not Available. Affects curl, libcurl.
  • CVE-2026-19931 - A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. Affects curl, libcurl.
  • CVE-2026-54874 - Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. Affects libcrypto3, libssl3. - CVSS 7.5.
  • CVE-2026-63073 - Percent characters survive the conversion, so a sender DN such as “CN=%s%n” reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. Affects libcrypto3, libssl3. - CVSS 5.9.
  • CVE-2026-63074 - This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. Affects libcrypto3, libssl3. - CVSS 7.5.
  • CVE-2026-63075 - Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. Affects libcrypto3, libssl3. - CVSS 7.5.
  • CVE-2026-75803 - Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Affects libcrypto3, libssl3.
  • CVE-2026-80229 - [Unknown description]. Affects curl, libcurl.
  • CVE-2026-80230 - Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected. Affects curl, libcurl.
  • CVE-2026-80231 - Description Not Available. Affects curl, libcurl.
  • CVE-2026-80255 - [Unknown description]. Affects curl, libcurl.
  • CVE-2026-80256 - Vulnerability fixed by upgrading the affected package. Affects curl, libcurl.
  • CVE-2026-82208 - [Unknown description]. Affects curl, libcurl.
  • CVE-2026-82209 - Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., attacker.co.uk). Affects curl, libcurl.

On this Page: