EUVD-2026-97899
GHSA-pqhr-v66j-j5cq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach IoT component over network
-
DeliverySend crafted malformed input
-
ExploitTrigger infinite parsing loop
-
ExecutionExhaust CPU/thread resources
-
ImpactDenial of service for IoT component
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the IBM Maximo Application Suite IoT Component (versions 9.0.0, 9.1.0, or 9.2.0) and the ability to submit the 'certain inputs' that drive the parser into an infinite loop; the description does not name a specific protocol, endpoint, or non-default feature, so it appears to affect the component's standard input-processing path. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is needed. The limiting factors are deployment-specific: the attacker must be able to reach the IoT component's parsing interface (often internal or segmented in Maximo deployments), and impact is confined to availability - no data exposure or code execution results. |
| Impact | All signals point to a moderate-priority availability issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with impact confined entirely to availability - no confidentiality or integrity loss, consistent with the CWE-400 infinite-parsing-loop (uncontrolled resource consumption) root cause. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so there is no public evidence of active exploitation: exploitation status is 'no public exploit identified at time of analysis.' The gap between a high 7.5 CVSS and the absence of any exploitation signal suggests this is a genuine but non-urgent DoS to patch on a normal cycle, not a KEV-driven drop-everything item. One point to verify: the single reference is an IBM support node page that was not retrievable in this analysis, so fixed-version and remediation specifics are not independently confirmed. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends specially crafted input to the IoT component's parsing interface within IBM Maximo Application Suite. The malformed input triggers an infinite parsing loop (CWE-400), pinning CPU/thread resources and rendering the IoT component unresponsive to legitimate traffic. No POC or active exploitation is known at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Unauthenticated remote attackers can force the IoT Component of IBM Maximo Application Suite 9.0.0, 9.1.0, and 9.2.0 into an infinite parsing loop by submitting crafted input, hanging the parser and degrading or denying availability of the affected service. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so per the vector no credentials or user interaction are required, but the impact is confined to availability with no data exposure or code execution; the practical exposure depends on whether the IoT parsing interface is reachable from the attacker's network position. There is no indication of confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, and our independent assessment rates this a moderate-priority availability issue rather than a top-tier emergency.
RemediationAI
No vendor-released patch identified at time of analysis; IBM's advisory at https://www.ibm.com/support/pages/node/7290173 should be monitored for an interim fix or fix pack covering the IoT Component for 9.0.0, 9.1.0, and 9.2.0, and the exact fixed version should be taken from that advisory rather than assumed. Until a fix is published, apply compensating controls aimed at the availability-only attack path: place the IoT parsing interface behind network segmentation and firewall rules so only known device gateways and management hosts can reach it (trade-off: overly tight rules will silently drop legitimate telemetry from roaming or unregistered devices); front the service with a reverse proxy or API gateway that enforces request size, payload-complexity, and response-time limits so a pathological message is rejected or killed instead of hanging a worker (trade-off: aggressive size and timeout limits can truncate or abort legitimate large batch payloads); add rate limiting per source so a single sender cannot occupy all parser threads (trade-off: legitimate high-volume device bursts may be throttled). Operationally, enforce container CPU/memory limits and liveness/readiness probes on the IoT Component so a stuck parser is detected and the pod restarted rather than slowly starving the node, and alert on sustained CPU saturation with flat ingestion throughput as a detection signal for this loop pattern. Deploying a WAF or input-sanitization filter is only partially effective here, because IBM has not disclosed the specific input pattern that triggers the loop and no signature can be written reliably from the available information.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an instance of CWE-400 (Uncontrolled Resource Consumption) in the IoT Component shipped with IBM Maximo Application Suite, the module that ingests and parses device/telemetry input. The root cause class is unbounded resource consumption during parsing: certain inputs cause the parser to enter an infinite loop, consuming CPU and/or a worker thread indefinitely rather than terminating or erroring out. IBM's description does not specify the protocol, endpoint, or message format involved, so the affected surface appears to be the component's standard input-processing path rather than a non-default feature. Because the CVSS vector carries PR:N and UI:N, the attack path is reachable without authentication and without tricking a user, and therefore the only meaningful preconditions are network reachability to the parsing interface and delivery of the triggering payload. Impact is strictly availability (C:N/I:N/A:H) - a hung parser can stall ingestion and, depending on threading and process model, exhaust worker capacity and cascade into broader service degradation, but there is no memory-corruption or injection primitive and no path to code execution or data disclosure.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated crafted input (AV:N/AC:L/PR:N/UI:N) causing an infinite loop yields availability-only impact (A:H, C:N/I:N) within one component (S:U).
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop when processing certain inputs.
Executive ViewAI
IBM Maximo Application Suite 9.0.0, 9.1.0, and 9.2.0 contain an unauthenticated remote availability flaw in the IoT Component that can force the parser into an infinite loop, degrading or denying service for business users and dependent asset-monitoring workflows. Leadership should care because this can disrupt Maximo IoT service availability, though there is no data exposure or code execution, no vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include network segmentation and ACLs to limit access to the IoT parsing interface, WAF/IPS rules to reject malformed input, rate limiting, continuous monitoring for parser hangs, and automated failover or restart procedures to maintain availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB