Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-11-07T05:18:59.120Z",
  "pubdate": "2026-11-07T05:18:59.120Z",
  "executiveSummary": "IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to two distinct security flaws: a Regular Expression Denial of Service (ReDoS) vulnerability and a vulnerability involving the improper neutralization of wildcard query operators.\nThe ReDoS flaw allows an unauthenticated attacker to supply specially crafted regular expressions or input strings that cause excessive computational consumption, leading to service degradation or complete denial of service. The improper neutralization of wildcard query operators poses a risk of unauthorized data access or unintended query execution within the API management layer.\nThese vulnerabilities threaten the availability and integrity of the API infrastructure. Successful exploitation of the ReDoS component effectively halts the processing of legitimate API requests, while the query operator flaw could potentially bypass security filters or expose underlying database logic. There are no requirements for specific administrative privileges, making the surface area for exploitation significant for internet-facing instances of IBM API Connect. Organizations are advised to assess their exposure and apply relevant security updates provided by IBM to remediate these flaws.",
  "technicalDetails": "The vulnerabilities identified in IBM API Connect stem from insufficient validation of user-supplied input during request processing. The ReDoS vulnerability originates from the utilization of poorly constructed regular expressions in the API Connect engine. When the engine processes complex input strings against these vulnerable patterns, the backtracking algorithm can enter an exponential time complexity state. This behavior consumes excessive CPU cycles and memory, effectively exhausting system resources and preventing the application from responding to concurrent legitimate traffic.\nThe second vulnerability involves the improper neutralization of wildcard query operators. In specific API configurations, the system fails to sanitize input parameters before passing them to backend query engines or internal data processing modules. By injecting wildcard characters (such as '*' or '%') into parameters, an attacker may force the application to perform overly broad searches or trigger unintended database operations. This behavior can be exploited to bypass security constraints that rely on strict parameter matching or to gain visibility into API resources that the attacker is not authorized to access.\nExploitation flow for ReDoS: 1. The attacker identifies an API endpoint that utilizes server-side regex evaluation for input validation or routing. 2. The attacker crafts an input string containing deeply nested repetition or overlapping patterns designed to trigger catastrophic backtracking. 3. The payload is sent to the target IBM API Connect instance. 4. The regex engine stalls as it attempts to validate the string, locking the thread and resulting in a denial of service.\nExploitation flow for wildcard injection: 1. The attacker probes API parameters used for filtering or querying. 2. The attacker injects wildcard operators into these parameters to determine if the backend engine expands the scope of the request. 3. If the backend fails to sanitize these inputs, the attacker receives broader datasets than intended, potentially leading to information disclosure or unauthorized traversal of resource hierarchies.\nThese flaws are located within the core request handling components of IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2. Both vulnerabilities are network-exploitable and generally do not require prior authentication, significantly lowering the barrier for potential adversaries."
}