CVE-2026-108767: Multiple vulnerabilities that affects IBM Db2 Genius Hub

Published Nov 4, 2026

Updated

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HTTP headers.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Db2 Genius Hub to a version that resolves this vulnerability.
Fixed in 1.1.6

Event History

Nov 4, 2026

CVE Published

via MITRE·08:58 PM

Data Sourced

via MITRE·08:58 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

IBM Db2 Genius Hub versions 1.1.2, 1.1.3, 1.1.4, and 1.1.5 are identified as affected.

What access does an attacker need?

Exploitation requires remote authenticated access. The attacker must be able to interact with the affected application over the network using valid credentials.

What is the potential impact?

The vulnerability could allow HTTP response splitting through improperly neutralized HTTP headers. The stated CVSS vector indicates an integrity impact but no confidentiality or availability impact.