{"id":"CVE-2026-115646","kind":"vulnerability","aliases":["CVE-2026-115646"],"related":[],"title":"HiRDB: partial string comparison flaw in database server authentication","description":"Partial String Comparison Vulnerability in HiRDB.\n\n\nThis issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-50-/F through 09-66/V; HiRDB Server Version 9(32): from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-50-/F through 09-66-/V.","summary":"HiRDB, a Hitachi relational database server, has a partial string comparison flaw, as its description names it. The sources do not say what the comparison guards, so the exact effect on an attacker is unknown, but NVD scores it critical at CVSS 9.8.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","hirdb","hitachi","other"],"not_affected_if":["version-outside-listed-ranges"],"how_to_check":"- Check the installed HiRDB Server version against the affected ranges: Version 10 before `10-12-01`, and Version 9 from `09-50-06` through `09-66-22`, plus the additional-function and Version 9(32) builds listed in the description.","fix":"- Move HiRDB Server Version 10 to `10-12-01` or later.\n- The sources do not name a fixed build for the Version 9 line.","status":"open","published_at":"2026-11-10T05:17:48+00:00","first_seen_at":"2026-11-10T05:19:58+00:00","triaged_at":"2026-11-10T05:22:09+00:00","updated_at":"2026-11-10T05:22:09+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T05:22:09Z","model":"claude-haiku-5-5","output":{"fix":"- Move HiRDB Server Version 10 to `10-12-01` or later.\n- The sources do not name a fixed build for the Version 9 line.","reach":"network","title":"HiRDB: partial string comparison flaw in database server authentication","impact":"high","summary":"HiRDB, a Hitachi relational database server, has a partial string comparison flaw, as its description names it. The sources do not say what the comparison guards, so the exact effect on an attacker is unknown, but NVD scores it critical at CVSS 9.8.","audience":"businesses","category":"other","nicknames":[],"who_cares":["hirdb","hitachi","database"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; scored critical by NVD at CVSS 9.8","analyst_note":"Find the vendor advisory or the NVD analysis to learn what the string comparison protects and whether a fix exists for the Version 9 line.","how_to_check":"- Check the installed HiRDB Server version against the affected ranges: Version 10 before `10-12-01`, and Version 9 from `09-50-06` through `09-66-22`, plus the additional-function and Version 9(32) builds listed in the description.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-listed-ranges"],"who_is_affected":"Organizations running HiRDB Server Version 10 before `10-12-01`, or Version 9 builds in the listed ranges, including the additional-function and 9(32) variants. The sources do not say what the comparison guards or which configuration makes it reachable, so the exposure of any given deployment is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000765,"input_tokens":4618,"output_tokens":607,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-00':77C '-01':81C '-06':89C,117C '-115646':12A,15A '-12':80C '-2026':11A,14A '-22':93C,121C '-50':88C,103C,116C,132C '-66':92C,107C,120C,136C '/f':104C,133C '/v':108C,137C '09':87C,91C,102C,106C,115C,119C,131C,135C '10':74C,76C,79C '32':113C,129C '9':85C,100C,112C,128C '9.8':61B 'addit':97C,125C 'affect':70C 'attack':51B 'authent':9A 'comparison':4A,29B,43B,64C 'critic':58B 'cve':10A,13A 'cvss':60B 'databas':7A,16B,23B 'descript':33B 'effect':48B 'exact':47B 'flaw':5A,30B 'function':98C,126C 'guard':44B 'hirdb':1A,17B,19B,67C,71C,82C,94C,109C,122C 'hitachi':18B,21B 'issu':69C 'name':34B 'nvd':55B 'partial':2A,27B,62C 'relat':22B 'say':40B 'score':56B 'server':8A,24B,72C,83C,95C,110C,123C 'sourc':37B 'string':3A,28B,63C 'unknown':53B 'version':73C,84C,99C,111C,127C 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Organizations running HiRDB Server Version 10 before `10-12-01`, or Version 9 builds in the listed ranges, including the additional-function and 9(32) variants. The sources do not say what the comparison guards or which configuration makes it reachable, so the exposure of any given deployment is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","database","hirdb","hitachi","other"],"campaign_type":null,"search_a":"'-115646':12A,15A '-2026':11A,14A 'authent':9A 'comparison':4A 'cve':10A,13A 'databas':7A 'flaw':5A 'hirdb':1A 'partial':2A 'server':8A 'string':3A","search_b":"'9.8':61B 'attack':51B 'comparison':29B,43B 'critic':58B 'cvss':60B 'databas':16B,23B 'descript':33B 'effect':48B 'exact':47B 'flaw':30B 'guard':44B 'hirdb':17B,19B 'hitachi':18B,21B 'name':34B 'nvd':55B 'partial':27B 'relat':22B 'say':40B 'score':56B 'server':24B 'sourc':37B 'string':28B 'unknown':53B","search_c":"'-00':77C '-01':81C '-06':89C,117C '-12':80C '-22':93C,121C '-50':88C,103C,116C,132C '-66':92C,107C,120C,136C '/f':104C,133C '/v':108C,137C '09':87C,91C,102C,106C,115C,119C,131C,135C '10':74C,76C,79C '32':113C,129C '9':85C,100C,112C,128C 'addit':97C,125C 'affect':70C 'comparison':64C 'function':98C,126C 'hirdb':67C,71C,82C,94C,109C,122C 'issu':69C 'partial':62C 'server':72C,83C,95C,110C,123C 'string':63C 'version':73C,84C,99C,111C,127C 'vulner':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T05:17:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"hirt@hitachi.co.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115646","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115646","severity":null,"published_at":"2026-11-10T05:17:48+00:00","modified_at":"2026-11-10T05:17:48+00:00","first_seen_at":"2026-11-10T05:19:58+00:00","fetched_at":"2026-11-10T05:19:58+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}