CVE-2026-108767
Undergoing Analysis Undergoing Analysis - In Progress

HTTP Response Splitting in IBM Db2 Genius Hub

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: IBM Corporation

Description
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HTTP headers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-05
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-108767
EUVD
EUVD-2026-117109

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
IBM Db2 Genius Hub 1.1.2
IBM Db2 Genius Hub 1.1.3
IBM Db2 Genius Hub 1.1.4
IBM Db2 Genius Hub 1.1.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-113 The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in IBM Db2 Genius Hub 1.1.2 to 1.1.5 allows a remote authenticated attacker to perform HTTP response splitting. This occurs due to improper neutralization of HTTP headers, which could let the attacker manipulate responses sent to users.

Impact Analysis

An attacker could exploit this to inject malicious content into responses, potentially leading to phishing attacks, session hijacking, or misleading users into disclosing sensitive information.

Compliance Impact

This vulnerability could compromise data integrity and confidentiality, potentially violating GDPR (data protection) and HIPAA (health data security) requirements for secure data handling.

Mitigation Strategies

Apply the latest IBM Db2 Genius Hub patch or update to address HTTP response splitting. Ensure input validation is enforced for HTTP headers. Monitor network traffic for unusual HTTP responses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108767. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...