CVE-2026-18535

Summary

IBM API Connect contains a Regular Expression Denial of Service (ReDoS) vulnerability and improper neutralization of wildcard query operators in its API management functionality, allowing authenticated attackers to exhaust server resources or cause unexpected query behavior through malicious input.

Exploitability

Exploitation requires low-privilege authentication and no user interaction; network access to the affected API endpoints is sufficient.

Blast radius

Successful exploitation could cause service degradation or unavailability for legitimate users, especially during high-load periods, and may allow unauthorized manipulation of query results via wildcard injection.

Detection

Look for repeated requests with unusually long or complex regular expression patterns or wildcard queries (e.g., excessive use of *, ?, or nested quantifiers) in API gateway logs, especially when accompanied by increased CPU usage or delayed responses on the backend services.

Prioritized remediation

Upgrade to IBM API Connect 10.0.8.13 or later for the 10.0.8.x branch, or to 12.1.1.3 or later for the 12.1.x branch.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.