IT49582: IBM STORAGE INSIGHTS SECURITY APAR FOR CVE-2026(25128,25896,26278,33036,27942,33349)

APAR status

• Closed as program error.

Error description

• CVEs: (details as of the time of ADV creation)
  CVEID: CVE-2026-25128
  Description: fast-xml-parser allows users to validate XML, parse
  XML to JS object, or build XML from JS object without C/C++
  based libraries and no callback. In versions 5.0.9 through
  5.3.3, a RangeError vulnerability exists in the numeric entity
  processing of fast-xml-parser when parsing XML with out-of-range
  entity code points (e.g., `�` or `�`). This
  causes the parser to throw an uncaught exception, crashing any
  application that processes untrusted XML input. Version 5.3.4
  fixes the issue.
  CWE: CWE-20: Improper Input Validation
  CVSS Source: security-advisories@github.com
  CVSS Base Score: 7.5
  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
  
  CVEID: CVE-2026-25896
  Description: fast-xml-parser allows users to validate XML, parse
  XML to JS object, or build XML from JS object without C/C++
  based libraries and no callback. From 4.1.3to before 5.3.5, a
  dot (.) in a DOCTYPE entity name is treated as a regex wildcard
  during entity replacement, allowing an attacker to shadow
  built-in XML entities (<, >, &, ", ') with
  arbitrary values. This bypasses entity encoding and leads to XSS
  when parsed output is rendered. This vulnerability is fixed in
  5.3.5.
  CWE: CWE-185: Incorrect Regular Expression
  CVSS Source: security-advisories@github.com
  CVSS Base Score: 9.3
  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N)
  
  CVEID: CVE-2026-26278
  Description: fast-xml-parser allows users to validate XML, parse
  XML to JS object, or build XML from JS object without C/C++
  based libraries and no callback. In versions 4.1.3 through
  5.3.5, the XML parser can be forced to do an unlimited amount of
  entity expansion. With a very small XML input, it?s possible to
  make the parser spend seconds or even minutes processing a
  single request, effectively freezing the application. Version
  5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE
  parsing by `processEntities: false` option.
  CWE: CWE-776: Improper Restriction of Recursive Entity
  References in DTDs ('XML Entity Expansion')
  CVSS Source: security-advisories@github.com
  CVSS Base Score: 7.5
  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
  
  CVEs: (details as of the time of ADV creation)
  CVEID: CVE-2026-33036
  Description: fast-xml-parser allows users to process XML from JS
  object without C/C++ based libraries or callbacks. Versions
  4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where
  numeric character references (&#NNN;, &#xHH;) and standard XML
  entities completely evade the entity expansion limits (e.g.,
  maxTotalExpansions, maxExpandedLength) added to fix
  CVE-2026-26278, enabling XML entity expansion Denial of Service.
  The root cause is that replaceEntitiesValue() in
  OrderedObjParser.js only enforces expansion counting on
  DOCTYPE-defined entities while the lastEntities loop handling
  numeric/standard entities performs no counting at all. An
  attacker supplying 1M numeric entity references like A can
  force ~147MB of memory allocation and heavy CPU usage,
  potentially crashing the process?even when developers have
  configured strict limits. This issue has been fixed in version
  5.5.6.
  CWE: CWE-776: Improper Restriction of Recursive Entity
  References in DTDs ('XML Entity Expansion')
  CVSS Source: security-advisories@github.com
  CVSS Base Score: 7.5
  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
  
  
  CVEs: (details as of the time of ADV creation)
  CVEID: CVE-2026-27942
  Description: fast-xml-parser allows users to validate XML, parse
  XML to JS object, or build XML from JS object without C/C++
  based libraries and no callback. Prior to version 5.3.8, the
  application crashes with stack overflow when user use XML
  builder with `preserveOrder:true`. Version 5.3.8 fixes the
  issue. As a workaround, use XML builder with
  `preserveOrder:false` or check the input data before passing to
  builder.
  CWE: CWE-120: Buffer Copy without Checking Size of Input
  ('Classic Buffer Overflow')
  CVSS Source: NVD
  CVSS Base Score: 7.5
  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
  
  CVEs: (details as of the time of ADV creation)
  CVEID: CVE-2026-33349
  Description: fast-xml-parser allows users to process XML from JS
  object without C/C++ based libraries or callbacks. From version
  4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in
  fast-xml-parser uses JavaScript truthy checks to evaluate
  maxEntityCount and maxEntitySize configuration limits. When a
  developer explicitly sets either limit to 0 ? intending to
  disallow all entities or restrict entity size to zero bytes ?
  the falsy nature of 0 in JavaScript causes the guard conditions
  to short-circuit, completely bypassing the limits. An attacker
  who can supply XML input to such an application can trigger
  unbounded entity expansion, leading to memory exhaustion and
  denial of service. This issue has been patched in version 5.5.7.
  CWE: CWE-1284: Improper Validation of Specified Quantity in
  Input
  CVSS Source: security-advisories@github.com
  CVSS Base Score: 5.9
  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Storage Insights users                                   *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * SECURITY APAR FOR:                                           *
  * CVE-2026-25128,CVE-2026-25896,CVE-2026-26278,                *
  * CVE-2026-33036,CVE-2026-27942,CVE-2026-33349                 *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• The fix for this APAR is contained in the following release:
  
  IBM Storage Insights 2Q26   [ 54X-IBM-SI ]
  ( release target 2Q 2026 / June )
  
  To protect IBM Storage Insights against emerging
  security vulnerabilities, the service was updated to
  protected against vulnerabilities.
  
  No action is required, there is nothing that you need
  to do following the IBM Storage Insights upgrade.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  STORAGE INSIGHT

• Fixed component ID

  5608TPCSI

Applicable component levels