{"id":"EUVD-2026-6720","enisaUuid":"07545a60-3d2b-38c8-8d5a-1c8d7cb7359e","description":"### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?param\u003da,b,c` becomes `[\u0027a\u0027, \u0027b\u0027, \u0027c\u0027]`). However, the limit check for `arrayLimit` (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in `parseArrayValue`, enabling a bypass. This permits creation of arbitrarily large arrays from a single parameter, leading to excessive memory allocation.\n\n**Vulnerable code** (lib/parse.js: lines ~40-50):\n```js\nif (val \u0026\u0026 typeof val \u003d\u003d\u003d \u0027string\u0027 \u0026\u0026 options.comma \u0026\u0026 val.indexOf(\u0027,\u0027) \u003e -1) {\n    return val.split(\u0027,\u0027);\n}\n\nif (options.throwOnLimitExceeded \u0026\u0026 currentArrayLength \u003e\u003d options.arrayLimit) {\n    throw new RangeError(\u0027Array limit exceeded. Only \u0027 + options.arrayLimit + \u0027 element\u0027 + (options.arrayLimit \u003d\u003d\u003d 1 ? \u0027\u0027 : \u0027s\u0027) + \u0027 allowed in an array.\u0027);\n}\n\nreturn val;\n```\nThe `split(\u0027,\u0027)` returns the array immediately, skipping the subsequent limit check. Downstream merging via `utils.combine` does not prevent allocation, even if it marks overflows for sparse arrays.This discrepancy allows attackers to send a single parameter with millions of commas (e.g., `?param\u003d,,,,,,,,...`), allocating massive arrays in memory without triggering limits. It bypasses the intent of `arrayLimit`, which is enforced correctly for indexed (`a[0]\u003d`) and bracket (`a[]\u003d`) notations (the latter fixed in v6.14.1 per GHSA-6rw7-vpxm-498p).\n\n### PoC\n**Test 1 - Basic bypass:**\n```\nnpm install qs\n```\n\n```js\nconst qs \u003d require(\u0027qs\u0027);\n\nconst payload \u003d \u0027a\u003d\u0027 + \u0027,\u0027.repeat(25);  // 26 elements after split (bypasses arrayLimit: 5)\nconst options \u003d { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };\n\ntry {\n  const result \u003d qs.parse(payload, options);\n  console.log(result.a.length);  // Outputs: 26 (bypass successful)\n} catch (e) {\n  console.log(\u0027Limit enforced:\u0027, e.message);  // Not thrown\n}\n```\n**Configuration:**\n- `comma: true`\n- `arrayLimit: 5`\n- `throwOnLimitExceeded: true`\n\nExpected: Throws \"Array limit exceeded\" error.\nActual: Parses successfully, creating an array of length 26.\n\n\n### Impact\nDenial of Service (DoS) via memory exhaustion.","datePublished":"Feb 12, 2026, 4:39:42 AM","dateUpdated":"Feb 12, 2026, 5:32:05 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883\nhttps://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482\n","aliases":"CVE-2026-2391\nGHSA-w7fw-mjwx-w883\n","assigner":"harborist","epss":0.54,"enisaIdProduct":[],"enisaIdVendor":[],"enisaIdVulnerability":[{"id":"a963e1f3-d5e5-3f45-8ca3-71aebec1a674","vulnerability":{"id":"GHSA-w7fw-mjwx-w883","description":"qs\u0027s arrayLimit bypass in comma parsing allows denial of service","datePublished":"Feb 12, 2026, 5:04:39 PM","dateUpdated":"Feb 12, 2026, 8:07:59 PM","baseScore":0.0,"references":"https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-2391\nhttps://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482\nhttps://github.com/ljharb/qs\n","enisa_id":"EUVD-2026-6720\n","aliases":"CVE-2026-2391\nGHSA-w7fw-mjwx-w883\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:53:52 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"bf134aa0-5e26-3d4c-b55f-ba5efb9f1899","vulnerability":{"id":"CVE-2026-2391","description":"### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?param\u003da,b,c` becomes `[\u0027a\u0027, \u0027b\u0027, \u0027c\u0027]`). However, the limit check for `arrayLimit` (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in `parseArrayValue`, enabling a bypass. This permits creation of arbitrarily large arrays from a single parameter, leading to excessive memory allocation.\n\n**Vulnerable code** (lib/parse.js: lines ~40-50):\n```js\nif (val \u0026\u0026 typeof val \u003d\u003d\u003d \u0027string\u0027 \u0026\u0026 options.comma \u0026\u0026 val.indexOf(\u0027,\u0027) \u003e -1) {\n    return val.split(\u0027,\u0027);\n}\n\nif (options.throwOnLimitExceeded \u0026\u0026 currentArrayLength \u003e\u003d options.arrayLimit) {\n    throw new RangeError(\u0027Array limit exceeded. Only \u0027 + options.arrayLimit + \u0027 element\u0027 + (options.arrayLimit \u003d\u003d\u003d 1 ? \u0027\u0027 : \u0027s\u0027) + \u0027 allowed in an array.\u0027);\n}\n\nreturn val;\n```\nThe `split(\u0027,\u0027)` returns the array immediately, skipping the subsequent limit check. Downstream merging via `utils.combine` does not prevent allocation, even if it marks overflows for sparse arrays.This discrepancy allows attackers to send a single parameter with millions of commas (e.g., `?param\u003d,,,,,,,,...`), allocating massive arrays in memory without triggering limits. It bypasses the intent of `arrayLimit`, which is enforced correctly for indexed (`a[0]\u003d`) and bracket (`a[]\u003d`) notations (the latter fixed in v6.14.1 per GHSA-6rw7-vpxm-498p).\n\n### PoC\n**Test 1 - Basic bypass:**\n```\nnpm install qs\n```\n\n```js\nconst qs \u003d require(\u0027qs\u0027);\n\nconst payload \u003d \u0027a\u003d\u0027 + \u0027,\u0027.repeat(25);  // 26 elements after split (bypasses arrayLimit: 5)\nconst options \u003d { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };\n\ntry {\n  const result \u003d qs.parse(payload, options);\n  console.log(result.a.length);  // Outputs: 26 (bypass successful)\n} catch (e) {\n  console.log(\u0027Limit enforced:\u0027, e.message);  // Not thrown\n}\n```\n**Configuration:**\n- `comma: true`\n- `arrayLimit: 5`\n- `throwOnLimitExceeded: true`\n\nExpected: Throws \"Array limit exceeded\" error.\nActual: Parses successfully, creating an array of length 26.\n\n\n### Impact\nDenial of Service (DoS) via memory exhaustion.","datePublished":"Feb 12, 2026, 4:39:42 AM","dateUpdated":"Feb 12, 2026, 5:32:05 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883\nhttps://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482\n","enisa_id":"EUVD-2026-6720\n","assigner":"harborist","epss":0.54,"dataProcessed":"Oct 29, 2026, 7:16:15 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"32e15f0c-ad46-3d74-aecf-00b4bc9dc3b9","advisory":{"id":"WID-SEC-W-2026-3623","description":"IBM DataPower Gateway: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in IBM DataPower Gateway ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen, einen Denial-of-Service-Zustand auszulösen oder Cross-Site-Scripting-Angriffe durchzuführen.","datePublished":"Sep 28, 2026, 10:00:00 PM","dateUpdated":"Oct 8, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3623.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-3623\n","aliases":"CVE-2023-53781\nCVE-2025-14087\nCVE-2025-14512\nCVE-2025-21858\nCVE-2025-22105\nCVE-2025-37980\nCVE-2025-38015\nCVE-2025-38097\nCVE-2025-38180\nCVE-2025-38400\nCVE-2025-38405\nCVE-2025-38441\nCVE-2025-38470\nCVE-2025-38653\nCVE-2025-39766\nCVE-2025-39797\nCVE-2025-39866\nCVE-2025-40134\nCVE-2025-48431\nCVE-2025-5278\nCVE-2025-68183\nCVE-2025-68211\nCVE-2025-68214\nCVE-2025-68347\nCVE-2025-68366\nCVE-2025-68724\nCVE-2025-71066\nCVE-2025-71089\nCVE-2026-12143\nCVE-2026-13257\nCVE-2026-13258\nCVE-2026-13757\nCVE-2026-14269\nCVE-2026-14273\nCVE-2026-14496\nCVE-2026-14497\nCVE-2026-14502\nCVE-2026-14507\nCVE-2026-14508\nCVE-2026-14509\nCVE-2026-14888\nCVE-2026-14905\nCVE-2026-14988\nCVE-2026-14990\nCVE-2026-14991\nCVE-2026-14992\nCVE-2026-14999\nCVE-2026-15588\nCVE-2026-15762\nCVE-2026-15781\nCVE-2026-15784\nCVE-2026-15819\nCVE-2026-15822\nCVE-2026-15824\nCVE-2026-16111\nCVE-2026-16159\nCVE-2026-16161\nCVE-2026-16163\nCVE-2026-16164\nCVE-2026-16165\nCVE-2026-16167\nCVE-2026-16169\nCVE-2026-16170\nCVE-2026-16176\nCVE-2026-16177\nCVE-2026-16178\nCVE-2026-16179\nCVE-2026-16181\nCVE-2026-16182\nCVE-2026-16340\nCVE-2026-16439\nCVE-2026-16440\nCVE-2026-16441\nCVE-2026-2100\nCVE-2026-22979\nCVE-2026-22984\nCVE-2026-22990\nCVE-2026-23002\nCVE-2026-23060\nCVE-2026-23110\nCVE-2026-23204\nCVE-2026-23209\nCVE-2026-23216\nCVE-2026-23243\nCVE-2026-23270\nCVE-2026-23392\nCVE-2026-23455\nCVE-2026-2391\nCVE-2026-31411\nCVE-2026-31419\nCVE-2026-31488\nCVE-2026-31508\nCVE-2026-31532\nCVE-2026-31581\nCVE-2026-31607\nCVE-2026-31613\nCVE-2026-31669\nCVE-2026-31677\nCVE-2026-31684\nCVE-2026-31685\nCVE-2026-33845\nCVE-2026-33846\nCVE-2026-3832\nCVE-2026-3833\nCVE-2026-4046\nCVE-2026-41254\nCVE-2026-41602\nCVE-2026-41606\nCVE-2026-41607\nCVE-2026-42009\nCVE-2026-42010\nCVE-2026-42011\nCVE-2026-42012\nCVE-2026-42013\nCVE-2026-42014\nCVE-2026-42015\nCVE-2026-43027\nCVE-2026-43037\nCVE-2026-43038\nCVE-2026-43056\nCVE-2026-43074\nCVE-2026-43116\nCVE-2026-43125\nCVE-2026-43163\nCVE-2026-43190\nCVE-2026-43198\nCVE-2026-43260\nCVE-2026-43284\nCVE-2026-43303\nCVE-2026-43329\nCVE-2026-43499\nCVE-2026-43501\nCVE-2026-43868\nCVE-2026-43870\nCVE-2026-4437\nCVE-2026-4438\nCVE-2026-45852\nCVE-2026-46054\nCVE-2026-46086\nCVE-2026-46116\nCVE-2026-46173\nCVE-2026-46181\nCVE-2026-46242\nCVE-2026-46259\nCVE-2026-46300\nCVE-2026-46331\nCVE-2026-46333\nCVE-2026-46917\nCVE-2026-46968\nCVE-2026-47010\nCVE-2026-47021\nCVE-2026-47027\nCVE-2026-47059\nCVE-2026-47063\nCVE-2026-48144\nCVE-2026-48145\nCVE-2026-5260\nCVE-2026-52923\nCVE-2026-52991\nCVE-2026-53006\nCVE-2026-53009\nCVE-2026-53131\nCVE-2026-53189\nCVE-2026-53264\nCVE-2026-53266\nCVE-2026-5419\nCVE-2026-5450\nCVE-2026-55602\nCVE-2026-55603\nCVE-2026-55968\nCVE-2026-55970\nCVE-2026-58010\nCVE-2026-58011\nCVE-2026-58012\nCVE-2026-58013\nCVE-2026-58014\nCVE-2026-58015\nCVE-2026-58016\nCVE-2026-58662\nCVE-2026-59879\nCVE-2026-59880\nCVE-2026-60147\nCVE-2026-60589\nCVE-2026-61308\nCVE-2026-63913\nCVE-2026-63952\nCVE-2026-64017\nCVE-2026-64530\nCVE-2026-64560\nCVE-2026-70906\nCVE-2026-70907\nCVE-2026-74581\nCVE-2026-82417\nCVE-2026-82562\nCVE-2026-83605\nCVE-2026-83607\nCVE-2026-83608\nCVE-2026-83613\nCVE-2026-83614\nCVE-2026-83615\nCVE-2026-83616\nCVE-2026-83619\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"4f51b592-c737-351a-8744-f31e2e3ab145","product":{"name":"DataPower Gateway","vendor":{"name":"IBM"}}},{"id":"abd32b5f-76da-3819-864b-586a12ed6650","product":{"name":"10.5.0.23","vendor":{"name":"IBM"}}},{"id":"de564b51-b49e-3b66-9cc7-d9a0a5eef659","product":{"name":"11.0.0.3","vendor":{"name":"IBM"}}},{"id":"ed864776-3ad1-3c1c-8987-f3d168573d4c","product":{"name":"10.6.0.11","vendor":{"name":"IBM"}}}]}},{"id":"95c2d7ad-c588-3eed-83b7-cb4c882a5b20","advisory":{"id":"WID-SEC-W-2026-3046","description":"IBM Concert: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in IBM Concert ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.","datePublished":"Aug 26, 2026, 10:00:00 PM","dateUpdated":"Aug 30, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3046.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-3046\n","aliases":"CVE-2019-19921\nCVE-2021-23337\nCVE-2024-3651\nCVE-2024-39338\nCVE-2024-45590\nCVE-2025-13465\nCVE-2025-15284\nCVE-2025-15599\nCVE-2025-22874\nCVE-2025-47273\nCVE-2025-47907\nCVE-2025-52881\nCVE-2025-53643\nCVE-2025-55184\nCVE-2025-58056\nCVE-2025-58188\nCVE-2025-58189\nCVE-2025-61723\nCVE-2025-61730\nCVE-2025-64649\nCVE-2025-64756\nCVE-2025-67221\nCVE-2025-68121\nCVE-2025-68146\nCVE-2026-0540\nCVE-2026-2327\nCVE-2026-23490\nCVE-2026-23897\nCVE-2026-2391\nCVE-2026-23949\nCVE-2026-24486\nCVE-2026-25528\nCVE-2026-25547\nCVE-2026-25639\nCVE-2026-25990\nCVE-2026-26007\nCVE-2026-26019\nCVE-2026-26996\nCVE-2026-27142\nCVE-2026-27212\nCVE-2026-27699\nCVE-2026-27903\nCVE-2026-27904\nCVE-2026-28684\nCVE-2026-29063\nCVE-2026-29181\nCVE-2026-2950\nCVE-2026-31808\nCVE-2026-31900\nCVE-2026-32274\nCVE-2026-32288\nCVE-2026-32597\nCVE-2026-32630\nCVE-2026-32887\nCVE-2026-32952\nCVE-2026-33186\nCVE-2026-33532\nCVE-2026-33750\nCVE-2026-33814\nCVE-2026-33816\nCVE-2026-33916\nCVE-2026-34043\nCVE-2026-34073\nCVE-2026-34077\nCVE-2026-3520\nCVE-2026-35469\nCVE-2026-35515\nCVE-2026-3627\nCVE-2026-39823\nCVE-2026-39825\nCVE-2026-39826\nCVE-2026-39892\nCVE-2026-39984\nCVE-2026-40175\nCVE-2026-40179\nCVE-2026-40181\nCVE-2026-40190\nCVE-2026-40347\nCVE-2026-41066\nCVE-2026-41182\nCVE-2026-41238\nCVE-2026-41239\nCVE-2026-41240\nCVE-2026-41305\nCVE-2026-41324\nCVE-2026-41425\nCVE-2026-41481\nCVE-2026-41488\nCVE-2026-41602\nCVE-2026-41636\nCVE-2026-42151\nCVE-2026-42154\nCVE-2026-42198\nCVE-2026-42211\nCVE-2026-42338\nCVE-2026-42342\nCVE-2026-42561\nCVE-2026-42577\nCVE-2026-43870\nCVE-2026-44405\nCVE-2026-44431\nCVE-2026-44432\nCVE-2026-44486\nCVE-2026-44487\nCVE-2026-44488\nCVE-2026-44492\nCVE-2026-44494\nCVE-2026-44496\nCVE-2026-44728\nCVE-2026-4539\nCVE-2026-45409\nCVE-2026-45736\nCVE-2026-46625\nCVE-2026-4800\nCVE-2026-4923\nCVE-2026-4926\nCVE-2026-7246\nCVE-2026-8723\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"76a90dbd-da59-3443-a232-e3bd24181126","product":{"name":"Concert","vendor":{"name":"IBM"}}},{"id":"cc1d243a-3c05-3835-99df-7ead0933e4bb","product":{"name":"3.0.0","vendor":{"name":"ECOVACS"}}}]}},{"id":"e72cd63a-d850-3b3b-a574-ffaae9d3fd4a","advisory":{"id":"NCSC-2026-0431","description":"Kwetsbaarheden verholpen in IBM DataPower Gateway en onderliggende componenten","datePublished":"Oct 16, 2026, 6:16:13 AM","dateUpdated":"Oct 16, 2026, 6:16:13 AM","baseScore":0.0,"references":"","aliases":"CVE-2023-53781\nCVE-2025-14087\nCVE-2025-14512\nCVE-2025-21858\nCVE-2025-22105\nCVE-2025-37980\nCVE-2025-38015\nCVE-2025-38097\nCVE-2025-38180\nCVE-2025-38400\nCVE-2025-38405\nCVE-2025-38441\nCVE-2025-38470\nCVE-2025-38653\nCVE-2025-39766\nCVE-2025-39797\nCVE-2025-39866\nCVE-2025-40134\nCVE-2025-48431\nCVE-2025-5278\nCVE-2025-68183\nCVE-2025-68211\nCVE-2025-68214\nCVE-2025-68347\nCVE-2025-68366\nCVE-2025-68724\nCVE-2025-71066\nCVE-2025-71089\nCVE-2026-12143\nCVE-2026-13257\nCVE-2026-13258\nCVE-2026-13757\nCVE-2026-14269\nCVE-2026-14273\nCVE-2026-14496\nCVE-2026-14497\nCVE-2026-14502\nCVE-2026-14507\nCVE-2026-14508\nCVE-2026-14509\nCVE-2026-14888\nCVE-2026-14905\nCVE-2026-14988\nCVE-2026-14990\nCVE-2026-14991\nCVE-2026-14992\nCVE-2026-14999\nCVE-2026-15588\nCVE-2026-15762\nCVE-2026-15781\nCVE-2026-15784\nCVE-2026-15819\nCVE-2026-15822\nCVE-2026-15824\nCVE-2026-16111\nCVE-2026-16159\nCVE-2026-16161\nCVE-2026-16163\nCVE-2026-16164\nCVE-2026-16165\nCVE-2026-16167\nCVE-2026-16169\nCVE-2026-16170\nCVE-2026-16176\nCVE-2026-16177\nCVE-2026-16178\nCVE-2026-16179\nCVE-2026-16181\nCVE-2026-16182\nCVE-2026-16340\nCVE-2026-16439\nCVE-2026-16440\nCVE-2026-16441\nCVE-2026-2100\nCVE-2026-22979\nCVE-2026-22984\nCVE-2026-22990\nCVE-2026-23002\nCVE-2026-23060\nCVE-2026-23110\nCVE-2026-23204\nCVE-2026-23209\nCVE-2026-23216\nCVE-2026-23243\nCVE-2026-23270\nCVE-2026-23392\nCVE-2026-23455\nCVE-2026-2391\nCVE-2026-31411\nCVE-2026-31419\nCVE-2026-31488\nCVE-2026-31508\nCVE-2026-31532\nCVE-2026-31581\nCVE-2026-31607\nCVE-2026-31613\nCVE-2026-31669\nCVE-2026-31677\nCVE-2026-31684\nCVE-2026-31685\nCVE-2026-33845\nCVE-2026-33846\nCVE-2026-3832\nCVE-2026-3833\nCVE-2026-4046\nCVE-2026-41254\nCVE-2026-41602\nCVE-2026-41606\nCVE-2026-41607\nCVE-2026-42009\nCVE-2026-42010\nCVE-2026-42011\nCVE-2026-42012\nCVE-2026-42013\nCVE-2026-42014\nCVE-2026-42015\nCVE-2026-43027\nCVE-2026-43037\nCVE-2026-43038\nCVE-2026-43056\nCVE-2026-43074\nCVE-2026-43116\nCVE-2026-43125\nCVE-2026-43163\nCVE-2026-43190\nCVE-2026-43198\nCVE-2026-43260\nCVE-2026-43284\nCVE-2026-43303\nCVE-2026-43329\nCVE-2026-43499\nCVE-2026-43501\nCVE-2026-43868\nCVE-2026-43870\nCVE-2026-4437\nCVE-2026-4438\nCVE-2026-45852\nCVE-2026-46054\nCVE-2026-46086\nCVE-2026-46116\nCVE-2026-46173\nCVE-2026-46181\nCVE-2026-46242\nCVE-2026-46259\nCVE-2026-46300\nCVE-2026-46331\nCVE-2026-46333\nCVE-2026-46917\nCVE-2026-46968\nCVE-2026-47010\nCVE-2026-47021\nCVE-2026-47027\nCVE-2026-47059\nCVE-2026-47063\nCVE-2026-48144\nCVE-2026-48145\nCVE-2026-5260\nCVE-2026-52923\nCVE-2026-52991\nCVE-2026-53006\nCVE-2026-53009\nCVE-2026-53131\nCVE-2026-53189\nCVE-2026-53264\nCVE-2026-53266\nCVE-2026-5419\nCVE-2026-5450\nCVE-2026-55602\nCVE-2026-55603\nCVE-2026-55968\nCVE-2026-55970\nCVE-2026-58010\nCVE-2026-58011\nCVE-2026-58012\nCVE-2026-58013\nCVE-2026-58014\nCVE-2026-58015\nCVE-2026-58016\nCVE-2026-58662\nCVE-2026-59879\nCVE-2026-59880\nCVE-2026-60147\nCVE-2026-60589\nCVE-2026-61308\nCVE-2026-63913\nCVE-2026-63952\nCVE-2026-64017\nCVE-2026-64530\nCVE-2026-64560\nCVE-2026-70906\nCVE-2026-70907\nCVE-2026-74581\nCVE-2026-82417\nCVE-2026-82562\nCVE-2026-83605\nCVE-2026-83607\nCVE-2026-83608\nCVE-2026-83613\nCVE-2026-83614\nCVE-2026-83615\nCVE-2026-83616\nCVE-2026-83619\n","source":{"id":19,"name":"csaf_ncscnl"},"advisoryProduct":[{"id":"19c5ee39-359c-33c2-b8e0-5b394f0e00a6","product":{"name":"DataPower Gateway 10.5.0","vendor":{"name":"IBM"}}},{"id":"4e15d7b1-11ca-3801-a88d-5758d5e86cbb","product":{"name":"DataPower Gateway","vendor":{"name":"IBM"}}},{"id":"8b3d501c-9655-36b9-878b-0ec9062258ad","product":{"name":"DataPower Gateway 10.6.0","vendor":{"name":"IBM"}}},{"id":"93894416-810e-330b-a54c-f475b4347d3f","product":{"name":"DataPower Gateway 10.6CD","vendor":{"name":"IBM"}}},{"id":"a57c4a82-e533-34af-afe4-24a6da4b361c","product":{"name":"DataPower Gateway 11.0.0","vendor":{"name":"IBM"}}}]}}]}