Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T20:17:19.267Z",
  "pubdate": "2026-08-13T20:17:19.267Z",
  "executiveSummary": "An infinite loop vulnerability exists in IBM i versions 7.6, 7.5, 7.4, and 7.3, potentially allowing a remote attacker to cause a denial of service.\nThe vulnerability directly impacts system availability by inducing resource exhaustion through unhandled execution paths.\nAttack capabilities involve remote triggering of the condition, leading to severe performance degradation or complete service unresponsiveness.\nRisk implications include operational disruption of critical business systems relying on the affected IBM i platform.\nExploitation requirements are limited to network connectivity to the vulnerable service capable of triggering the logic flaw resulting in the infinite loop state.",
  "technicalDetails": "The vulnerability stems from a logical flaw in the affected software components of IBM i versions 7.6, 7.5, 7.4, and 7.3, which fails to properly validate or bound iterative execution paths.\nWhen a remote attacker interacts with the vulnerable component using specifically crafted network input, the application enters an unrecoverable infinite loop.\nThis execution anomaly traps system threads, consuming maximal CPU cycles and exhausting critical processing resources.\nThe attack flow proceeds as follows: the attacker establishes a network connection to the target service, transmits a malicious payload designed to trigger the flawed parsing or processing logic, and the application subsequently fails to break out of the iterative cycle.\nAuthentication and privilege requirements depend on the specific exposed service handling the request, but the capability is exposed to remote threat actors.\nThe post-exploitation impact is strictly confined to a denial of service, preventing legitimate users and administrators from accessing system services until manual intervention, such as process termination or system reboot, is performed."
}