EUVD-2026-41871
GHSA-7469-8h9r-c5xc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Unauthenticated network-reachable throttling endpoint (AV:N/PR:N/AC:L), no user interaction, availability-only impact with scope change since one component's input takes down the separate Gateway (S:C/A:H).
Primary rating from Vendor (WSO2).
CVSS VectorVendor: WSO2
Lifecycle Timeline
2DescriptionCVE.org
The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition.
Successful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate API traffic from being processed and impacting complete service availability. The denial of service is persistent, requiring manual intervention to restore normal operations.
AnalysisAI
Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffic Manager, and WSO2 API Control Plane - allows an unauthenticated remote attacker to send malicious JSON payloads to the throttling event handling mechanism, crashing or corrupting API Gateway state so that legitimate API traffic can no longer be processed. Because the outage is persistent and requires manual intervention to restore service, and the CVSS scope is changed (S:C), a single request can take down the entire API Gateway tier. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Technical ContextAI
The affected component is WSO2's distributed throttling subsystem, which coordinates rate-limiting decisions across the API Gateway and Traffic Manager by exchanging throttling event messages. These products deserialize user-influenced JSON payloads representing throttling events but fail to sufficiently validate their structure and content before processing, which is the CWE-707 (Improper Neutralization / improper enforcement of message integrity) root cause: untrusted input is accepted into an internal control channel that assumes well-formed data. The CPE data confirms the affected products are wso2:wso2_api_manager, wso2:wso2_universal_gateway, wso2:wso2_traffic_manager, and wso2:wso2_api_control_plane (all versions per the wildcard CPEs), reflecting that the throttling event handler is shared code across WSO2's API management stack. The CVSS scope change (S:C) reflects that a request handled by one component (the vulnerable authorization/throttling context) impacts the availability of a separate downstream component - the Gateway serving all API traffic.
RemediationAI
Apply the fix described in the WSO2 vendor advisory WSO2-2026-5236 (https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5236/); a patch is available per the vendor advisory, but an exact fixed version string is not present in the provided data and should be taken directly from that advisory or the corresponding WSO2 update level / WUM patch for your product version. As a compensating control until patched, restrict network access to the throttling event handling interface and the Traffic Manager messaging channel so only trusted Gateway and Traffic Manager nodes can reach it (via firewall rules or network segmentation), which removes unauthenticated external reachability at the cost of requiring accurate inventory of legitimate inter-node traffic. Additionally, place the API Gateway behind a WAF or reverse proxy that validates and constrains inbound JSON payload structure to the throttling endpoints, accepting that overly strict filtering could reject legitimate throttling events; if distributed throttling is not required, consider disabling the Traffic Manager integration, noting this removes centralized rate-limiting capability.
More in Wso2 Api Manager
View allAuthentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,
Server-side request forgery in WSO2 API Manager lets unauthenticated remote attackers coerce the gateway into making ser
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly
Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM,
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administr
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the
Role-based access control bypass in WSO2 API Manager 3.x allows authenticated users with the 'Internal/Everyone' role to
Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, AP
The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response.
Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthentic
WSO2 API Manager and API Control Plane use a non-cryptographic PRNG in the API Publisher component to generate shared se
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing opera
Same weakness CWE-707 – Improper Neutralization
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today