{"id":"CVE-2026-18535","published":"2026-11-07T05:18:59.120","lastModified":"2026-11-08T02:17:04.583","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H","cwes":["CWE-1333"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7291753","tags":[]},{"url":"https://www.ibm.com/support/pages/node/7292434","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect contains a Regular Expression Denial of Service (ReDoS) vulnerability and improper neutralization of wildcard query operators in its API management functionality, allowing authenticated attackers to exhaust server resources or cause unexpected query behavior through malicious input.","exploitability":"Exploitation requires low-privilege authentication and no user interaction; network access to the affected API endpoints is sufficient.","blast_radius":"Successful exploitation could cause service degradation or unavailability for legitimate users, especially during high-load periods, and may allow unauthorized manipulation of query results via wildcard injection.","remediation":"Upgrade to IBM API Connect 10.0.8.13 or later for the 10.0.8.x branch, or to 12.1.1.3 or later for the 12.1.x branch.","detection":"Look for repeated requests with unusually long or complex regular expression patterns or wildcard queries (e.g., excessive use of *, ?, or nested quantifiers) in API gateway logs, especially when accompanied by increased CPU usage or delayed responses on the backend services.","tags":["redos","wildcard-injection","api-security","denial-of-service","ibm"],"model":"garnet-coder","analyzedAt":"2026-11-07T09:59:54.099Z"}}