Description

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to cause a denial of service due to uncontrolled recursion.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-04T17:16:53.870Z",
  "pubdate": "2026-09-04T17:16:53.870Z",
  "executiveSummary": "This vulnerability involves an uncontrolled recursion flaw present in IBM App Connect Enterprise and IBM Integration Bus for z/OS, which can be leveraged by a local attacker to trigger a denial of service (DoS).\nThe vulnerability stems from improper handling of recursive calls within the affected software components, potentially leading to stack exhaustion or uncontrolled memory consumption when processing specifically crafted input.\nAffected products include IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28, alongside IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7.\nThe risk is categorized as a service availability threat. Exploitation requires local access to the system where the application is running. Successful exploitation results in the abnormal termination or hang of the integration process, effectively halting service availability for business-critical integrations.\nThis issue does not involve remote network-based exploitation vectors, as the attacker must already possess local access to interact with the vulnerable process or configuration environment.",
  "technicalDetails": "The identified vulnerability is classified as an uncontrolled recursion defect. This occurs when a software process invokes itself without an adequate termination condition or sufficient depth limitation, leading to rapid consumption of stack memory space.\nThe root cause is likely located within the internal processing logic responsible for parsing or traversing complex data structures or message flows. When the software encounters a recursive pattern that exceeds the pre-allocated stack depth, it results in a stack overflow exception.\nIn the context of IBM App Connect Enterprise and IBM Integration Bus for z/OS, this behavior can be triggered by a local attacker who can influence the input data processed by the integration engine. Because the application logic fails to validate the depth of nested structures, the recursion continues until the thread stack is exhausted.\nThe attack flow initiates when an attacker with local access provides a maliciously crafted input—potentially through an local API, a file-based injection point, or a locally accessible message queue—that contains excessively nested elements. As the engine attempts to process this structure recursively, the execution context consumes stack frames exponentially.\nThe vulnerability manifests at the runtime level. Once the thread reaches the maximum allowable stack size, the application process typically suffers a fatal segmentation fault or an unhandled exception, causing the specific integration process or the entire integration node to crash.\nBecause the vulnerability requires local access, the attacker must have authorization or existing access to the underlying operating system environment where the IBM App Connect or IBM Integration Bus instance resides. Privilege requirements are limited to those necessary to submit or inject data into the vulnerable process or interface.\nThe post-exploitation impact is strictly centered on the availability of the integration service. By inducing a crash, the attacker effectively interrupts the flow of data through the enterprise service bus (ESB) architecture, which can cause cascading failures in downstream applications that depend on the availability of the integration runtime.\nThe vulnerability affects versions 13.0.1.0 to 13.0.8.1 and 12.0.1.0 to 12.0.12.28 for App Connect Enterprise, and versions 10.1.0.0 to 10.1.0.7 for IBM Integration Bus for z/OS. No remote network exposure is inherent to this flaw, though it remains a significant risk for environments utilizing shared hosting or multi-tenant server configurations."
}