SB2025091750 - Multiple vulnerabilities in IBM Fusion
Published: September 17, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 secuirty vulnerabilities.
1) Heap-based buffer overflow (CVE-ID: CVE-2025-48379)
The vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error on BCn encoding. A local user can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
2) Path traversal (CVE-ID: CVE-2025-48050)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to scripts/server.js does not ensure that a pathname is located under the current working directory. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2025-32386)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed (e.g., >800x difference). A remote attacker can trick the victim into opening this specially crafted chart to cause memory exhaustion and the application to be terminated.
4) Stack-based buffer overflow (CVE-ID: CVE-2025-32387)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error. A remote unauthenticated attacker can craft a JSON Schema file within a chart with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow.
5) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2025-53643)
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to not parsing trailer sections of an HTTP request. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
6) Missing Encryption of Sensitive Data (CVE-ID: CVE-2025-45768)
The vulnerability allows a remote attacker to gain unauthorized access to the system.
The vulnerability exists due to weak encryption. A remote attacker can gain unauthorized access to the system.
7) Cryptographic issues (CVE-ID: CVE-2025-47278)
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to the way fallback key configuration was handled. The application used the last fallback key for signing, rather than the current signing key, which could potentially lead to data tampering.
8) Race condition (CVE-ID: CVE-2023-45286)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a race condition. A remote attacker can exploit the race by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs, and gain unauthorized access to sensitive information on the system.
9) Insufficiently protected credentials (CVE-ID: CVE-2024-47081)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the library leaks .netrc credentials to third parties for specific maliciously-crafted URLs. A remote attacker can gain access to sensitive information.
10) Deserialization of Untrusted Data (CVE-ID: CVE-2025-27818)
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data. A remote user can set the sasl.jaas.config property for connector's Kafka clients to 'com.sun.security.auth.module.LdapLoginModule' through various override properties (producer.override.sasl.jaas.config, consumer.override.sasl.jaas.config, or admin.override.sasl.jaas.config). This configuration enables the server to connect to an attacker's LDAP server and deserialize the LDAP response, potentially leading to the execution of java deserialization gadget chains on the Kafka connect server.
11) Information disclosure (CVE-ID: CVE-2024-31141)
The vulnerability allows a remote user to escalate privileges within the application.
The vulnerability exists due to the way Apache Kafka Clients handles custom configurations. A remote user with access to REST API can read arbitrary files and variables on the system and escalate their privileges filesystem/environment access.
12) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2025-27817)
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input in Apache Kafka Client. The application accepts configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
13) Input validation error (CVE-ID: CVE-2025-22870)
The vulnerability allows a remote attacker to alter application's behavior.
The vulnerability exists due to insufficient validation of an IPv6 zone ID as a hostname component, when matching hosts against proxy patterns. For instance the NO_PROXY environment variable is set to "*.example.com", a request to
"[::1%25.example.com]:80` will incorrectly match and not be proxied. A remote attacker can alter application behavior and potentially gain access to sensitive information or functionality.
14) Cross-site scripting (CVE-ID: CVE-2025-26791)
The disclosed vulnerability allows a remote attacker to perform mutation cross-site scripting (XSS) attacks.
The vulnerability exists due to DOMPurify has an incorrect template literal regular expression. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
15) Insecure Default Initialization of Resource (CVE-ID: CVE-2025-36222)
The vulnerability allows a remote attacker to gain access to perform unauthorized action.
The vulnerability exists due to the application uses insecure default configurations that could expose AMQStreams without client authentication. A remote attacker can trigger the vulnerability to perform unauthorized action.
Remediation
Install update from vendor's website.