Description
IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption.
Published: 2026-09-22
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

IBM Concert Software versions 1.0.0 through 3.0.0 contain a flaw where an attacker can supply a specially crafted regular expression. Executing that expression causes the system to consume excessive CPU and memory resources, ultimately resulting in a denial of service. This is a resource exhaustion vulnerability classified as CWE-770.

Affected Systems

Affected users are operating IBM Concert Software 1.0.0 or 3.0.0, as indicated by the CPE strings. All installations of these releases should confirm their version to assess exposure.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. No EPSS data is available and the vulnerability is not in the CISA KEV catalog, implying no known widespread exploits. The likely attack vector is a remote attacker sending a crafted regular expression over a network interface, leading to resource exhaustion and service disruption.

Generated by OpenCVE AI on September 22, 2026 at 22:52 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to IBM Concert Software 3.0.1.1 Download IBM Concert Software 3.0.0 from Container software library section of IBM Entitled Registry ( ICR https://myibm.ibm.com/products-services/containerlibrary ) and follow  installation instructions https://www.ibm.com/docs/en/concert  depending on the type of deployment.

OpenCVE Recommended Actions

  • Upgrade IBM Concert Software to version 3.0.1.1 as recommended by IBM.
  • If an upgrade cannot be performed immediately, implement limits on regular expression complexity or add input validation to enforce size or nesting restrictions, thereby reducing the risk of resource exhaustion.
  • Enable monitoring of CPU and memory consumption for the Concert service to detect abnormal usage early and respond before service disruption occurs.

Generated by OpenCVE AI on September 22, 2026 at 22:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption.
Title Multiple Vulnerabilities in IBM Concert Software
First Time appeared Ibm
Ibm concert
Weaknesses CWE-770
CPEs cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:3.0.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm concert
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Ibm Concert
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-22T21:20:34.808Z

Reserved: 2025-11-05T19:09:14.407Z

Link: CVE-2025-12767

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-22T22:17:05.467

Modified: 2026-09-22T22:17:05.467

Link: CVE-2025-12767

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T23:00:13Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling