{"id":"CVE-2026-108767","kind":"vulnerability","aliases":["CVE-2026-108767"],"related":[],"title":"IBM Db2 Genius Hub: HTTP response splitting by authenticated remote attacker","description":"IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HTTP headers.","summary":"IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 do not neutralize HTTP headers properly, which allows HTTP response splitting. A remote attacker with a valid login can inject headers or content into server responses, which can be used to poison caches or trick users' browsers.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["db2-genius-hub","ibm","self-hosted","vendor"],"not_affected_if":["unauthenticated-access-only"],"how_to_check":"- Check the installed Db2 Genius Hub version against the affected range 1.1.2, 1.1.3, 1.1.4, 1.1.5 in the vendor's admin console or installation files","fix":null,"status":"open","published_at":"2026-11-04T21:17:47+00:00","first_seen_at":"2026-11-04T21:49:17+00:00","triaged_at":"2026-11-04T21:51:32+00:00","updated_at":"2026-11-04T21:51:32+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-04T21:51:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM Db2 Genius Hub: HTTP response splitting by authenticated remote attacker","impact":"medium","summary":"IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 do not neutralize HTTP headers properly, which allows HTTP response splitting. A remote attacker with a valid login can inject headers or content into server responses, which can be used to poison caches or trick users' browsers.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["db2-genius-hub","ibm","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker injects headers into responses, enabling cache poisoning or session tricks","analyst_note":"Check the IBM security bulletin for fixed versions and the affected configuration; the NVD entry alone gives no fix.","how_to_check":"- Check the installed Db2 Genius Hub version against the affected range 1.1.2, 1.1.3, 1.1.4, 1.1.5 in the vendor's admin console or installation files\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unauthenticated-access-only"],"who_is_affected":"Teams running IBM Db2 Genius Hub in the affected versions 1.1.2 through 1.1.5 where users with accounts can reach the web interface. The sources do not describe a default configuration or specific exposure beyond the authenticated remote requirement. unknown for anything beyond that.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000708,"input_tokens":4134,"output_tokens":590,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-108767':14A,17A '-2026':13A,16A '1.1.2':32B,76C '1.1.3':77C '1.1.4':78C '1.1.5':34B,79C 'allow':42B,81C 'attack':11A,48B,85C 'authent':9A,84C 'browser':71B 'cach':67B 'conduct':87C 'content':57B 'could':80C 'cve':12A,15A 'db2':2A,19B,28B,73C 'db2-genius-hub':18B 'due':91C 'genius':3A,20B,29B,74C 'header':39B,55B,97C 'host':25B 'http':5A,38B,43B,88C,96C 'hub':4A,21B,30B,75C 'ibm':1A,22B,27B,72C 'improp':93C 'inject':54B 'login':52B 'neutral':37B,94C 'poison':66B 'proper':40B 'remot':10A,47B,83C 'respons':6A,44B,60B,89C 'self':24B 'self-host':23B 'server':59B 'split':7A,45B,90C 'trick':69B 'use':64B 'user':70B 'valid':51B 'vendor':26B 'version':31B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Db2 Genius Hub in the affected versions 1.1.2 through 1.1.5 where users with accounts can reach the web interface. The sources do not describe a default configuration or specific exposure beyond the authenticated remote requirement. unknown for anything beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["db2geniushub","ibm","medium","selfhosted","vendor"],"campaign_type":null,"first_public_at":"2026-11-04T21:17:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108767","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108767","severity":null,"published_at":"2026-11-04T21:17:47+00:00","modified_at":"2026-11-04T21:17:47+00:00","first_seen_at":"2026-11-04T21:49:17+00:00","fetched_at":"2026-11-04T21:49:17+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}