CVE-2026-4096: A vulnerability has been identified in IBM DevOps Plan that allows a Host Header Injection attack due to improper handling of the Host header in HTTP requests.
IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking
Other sources
IBM DevOps Plan is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM DevOps Planto a version that resolves this vulnerability.Fixed in 3.0.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4096?
The severity of CVE-2026-4096 is medium with a CVSS score of 6.5.
How do I fix CVE-2026-4096?
To fix CVE-2026-4096, upgrade IBM DevOps Plan to version 3.0.7 or later.
What impacts can CVE-2026-4096 have on my system?
CVE-2026-4096 can allow for Host Header Injection attacks, potentially leading to cross-site scripting, cache poisoning, or session hijacking.
Which versions of IBM DevOps Plan are affected by CVE-2026-4096?
IBM DevOps Plan versions 3.0.0 through 3.0.6 are affected by CVE-2026-4096.
What type of vulnerability is CVE-2026-4096?
CVE-2026-4096 is an HTTP header injection vulnerability resulting from improper handling of the Host header.