IBM App Connect 12/13 & Integration Bus z/OS: Recursion DoS (13.0.8.1)
CVE-2026-17440 Published on September 4, 2026
IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to cause a denial of service due to uncontrolled recursion.
Vulnerability Analysis
CVE-2026-17440 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
What is a Stack Exhaustion Vulnerability?
The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.
CVE-2026-17440 has been classified to as a Stack Exhaustion vulnerability or weakness.
Products Associated with CVE-2026-17440
stack.watch emails you whenever new vulnerabilities are published in IBM App Connect Enterprise or IBM Integration Bus For Zos. Just hit a watch button to start following.
Affected Versions
IBM App Connect Enterprise:- Version 13.0.1.0, <= 13.0.8.1 is affected.
- Version 12.0.1.0, <= 12.0.12.28 is affected.
- Version 10.1.0.0, <= 10.1.0.7 is affected.