IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a type conversion flaw that an authenticated remote attacker can exploit to cause the system to convert a value incorrectly between two different types, resulting in invalid responses or complete service unavailability. The vulnerability directly impacts availability; it does not expose confidentiality or integrity of data.

IBM’s API Connect platform is affected. Any installation running IBM API Connect 10.0.8.0 up to and including 10.0.8.12, or 12.1.0.0 up to and including 12.1.1.2, is vulnerable. The flaw spans both the 10.x and 12.x product lines within the IBM API Connect family.

The CVSS score of 4.3 places this issue in the low‑medium severity range. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, indicating limited evidence of exploitation. An attacker must have valid credentials and remote access to API Connect to exploit the flaw, confining risk to systems that expose authenticated API endpoints. Overall the threat is moderate: a legitimate user or attacker with known credentials could cause a denial of service, but without such access the vulnerability offers limited value.