CVE-2025-27901

The record

IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 IBM Db2 Recovery Expert for Linux, UNIX and Windows is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.  This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.

Affected packages

Related vulnerabilities

• CVE-2026-67179 Genkit does not properly validate host request headers. CWE-644
• CVE-2026-66778 SAP Approuter does not sufficiently sanitize certain request headers before forwarding… CWE-644
• CVE-2026-72574 A host header injection vulnerability in picocms/Pico through 2.1.4 allows an… CWE-644
• CVE-2026-0516 A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS… CWE-644
• CVE-2026-48061 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. CWE-644
• CVE-2026-21762 HCL DevOps Loop is affected by missing HTTP security headers. CWE-644
• CVE-2026-54477 The admin panel lacks standard security headers, enabling clickjacking and cross-site… CWE-644
• CVE-2024-51454 IBM Engineering Workflow Management 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through… CWE-644