The vulnerability exists in IBM Aspera Console versions 3.3.0 through 3.4.8. An authenticated user can repeatedly trigger the email notification service, leading to exhaustion of resources and a denial of service. The weakness is classified as CWE-799, indicating improper control of interaction frequency that disrupts normal operation. The impact is the inability of the console to send or process email notifications for users until the service is restarted.

The affected vendor is IBM, product Aspera Console. All deployments running versions 3.3.0 up to but not including 3.4.9 are vulnerable. This includes both Linux and Windows installations as indicated by the Common Platform Enumeration entries for IBM Aspera Console and the underlying operating systems.

The CVSS v3 score is 5.3, indicating a medium risk with potential service disruption. EPSS score is less than 1%, implying a very low probability of exploitation in the wild. It is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires authenticated access to the console, so attackers would typically need valid credentials or compromised administrative accounts. Once authorized, they can repeatedly invoke the email function to exhaust resources and cause a denial of service.