Description

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote attacker to cause a denial of service due to an infinite loop.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T16:17:59.690Z",
  "pubdate": "2026-09-04T16:17:59.690Z",
  "executiveSummary": "A remote denial of service (DoS) vulnerability exists within IBM App Connect Enterprise and IBM Integration Bus for z/OS. The affected versions include IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, IBM App Connect Enterprise 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7. An unauthenticated remote attacker can exploit this vulnerability to trigger an infinite loop state within the affected software components. This condition leads to resource exhaustion, specifically targeting the system's central processing unit (CPU), which ultimately crashes the application or renders the integration engine unresponsive to legitimate requests.\nGiven the critical role of these systems in enterprise application integration and data transit, successful exploitation can disrupt business-critical workflows, stop messaging queues, and sever communication channels between interconnected enterprise systems. Exploitation does not require local access or system privileges, making it a high-priority risk for organizations deploying these integration suites in network-accessible environments. Mitigating this risk requires applying the necessary patches from the vendor or restricting access to the affected network interfaces.",
  "technicalDetails": "The vulnerability lies within the input processing or message parsing architecture of IBM App Connect Enterprise and IBM Integration Bus for z/OS. During normal operations, the integration engine receives, parses, and routes messages using predefined message flows and parsers (such as those handling XML, JSON, or custom data formats). When a remote attacker transmits a specifically crafted network payload to an exposed endpoint, the application's parsing engine or execution thread encounters an unexpected sequence, malformed structure, or boundary condition that is improperly handled by the internal logic.\nInstead of gracefully rejecting the malformed input or throwing a standard parsing exception, the processing thread enters an infinite loop state. Within this loop, the termination condition is never met, causing the execution thread to repeatedly run the same block of code without yielding. Because the affected systems are designed to process complex integration workflows, a single thread trapped in an infinite loop will consume 100% of its assigned CPU core capacity.\nThe systematic attack flow is executed as follows: First, the remote attacker identifies an active listener port or network interface bound to the IBM App Connect Enterprise or IBM Integration Bus engine. Second, the attacker constructs a payload designed to trigger the logical flaw in the message parser or processing engine. Third, the payload is transmitted over standard network protocols (such as HTTP, HTTPS, or MQ protocols) directly to the vulnerable endpoint. Fourth, the target system ingests the data and passes it to the vulnerable parser component. Fifth, the parsing logic fails to exit its loop, resulting in immediate thread-level CPU saturation.\nAs CPU resources are consumed by the spinning thread, the overall throughput of the integration broker degrades. If the system is configured to process requests concurrently across multiple threads, successive malicious requests can saturate all available execution threads, leading to complete CPU starvation across the entire host or container. This state prevents legitimate transactions from being processed, causes connection timeouts, breaks message routing, and eventually leads to a complete denial of service. The affected versions include IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7. No authentication or elevated privileges are required to initiate this attack, making it highly exploitable over exposed network interfaces."
}