CVE-2024-41766 IBM Engineering Lifecycle Optimization - Publishing denial of service

High 7.5 Published 4 Jan 2025 Updated 6 Jan 2025

A remote attacker can cause a denial of service in IBM Engineering Lifecycle Optimization - Publishing by submitting a complex regular expression.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-41766?

CVE-2024-41766 is a high-severity denial of service vulnerability in IBM Engineering Lifecycle Optimization Publishing, published on 4 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause a denial of service using a complex regular expression.

Weakness: CWE-1333

Which versions are affected by CVE-2024-41766?

It affects 1 product.

Products include Ibm Engineering Lifecycle Optimization Publishing.

How do I fix CVE-2024-41766?

No fix has been published for CVE-2024-41766 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-41766 being exploited?

There is no known exploitation of CVE-2024-41766 in the wild and no public exploit code.

Sources

Also known as GHSA-vp3x-9qpg-q385.