PT-2026-24407 · Ibm · Aspera Faspex

Published 2026-03-10 · Updated 2026-03-10 · CVE-2025-36227

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM Aspera Faspex 5 versions 5.0.0 through 5.0.14.3

Description The software is susceptible to HTTP header injection due to inadequate validation of input received through the HOST headers. This could enable an attacker to perform various attacks against the system, including cross-site scripting, cache poisoning, or session hijacking. The vulnerable component is the handling of the HOST header.

Recommendations Update to a version beyond 5.0.14.3.

Fix

Weakness Enumeration

CWE-644

Related Identifiers

CVE-2025-36227

Affected Products

Aspera Faspex

References · 4

• https://osv.dev/vulnerability/CVE-2025-36227 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-36227 · Security Note
• https://ibm.com/support/pages/node/7262816 · Vendor Advisory, Patch
• https://twitter.com/CVEnew/status/2031504137867633022 · Twitter Post