EUVD-2026-45250
GHSA-x8q4-qwvw-778r
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 17, 2026
Uncontrolled memory consumption in IBM PowerVM NovaLink lets a remote, unauthenticated attacker send a specially-crafted request that drives the server to exhaust memory resources, degrading or halting availability of the virtualization management layer. The CVSS 3.1 base score is 7.5 (High) with an availability-only impact and no confidentiality or integrity effect. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and a vendor patch is available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Powervm Novalink gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (ibm) · only source for this CVE.
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM PowerVM Novalink are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
Executive ViewAI
IBM PowerVM NovaLink faces a critical availability risk: remote, unauthenticated attackers can exploit a vulnerability to disable virtualization management services, impacting infrastructure operations and dependent workloads. Organizations using NovaLink for VM infrastructure must treat this as a high-priority patch due to the ease of exploitation and business-critical nature of virtualization management.
Within 24 hours, inventory all IBM PowerVM NovaLink deployments and verify current patch levels against the vendor advisory. Within 7 days, apply the vendor-released patch to all affected systems, prioritizing production virtualization environments, and test in a non-production environment beforehand to validate compatibility. Within 30 days, confirm patch deployment across all systems, monitor system logs for exploitation attempts, and validate that virtualization services are operating normally.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB