IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to cause a denial of service via uncontrolled resource consumption. When the attacker sends certain requests, internal processing stalls, causing the service to become unavailable. This vulnerability impacts availability only and requires the attacker to have valid authenticated credentials to trigger the resource exhaustion.

The affected systems are IBM API Connect deployments running any of the following versions: 10.0.8.0 to 10.0.8.12 inclusive, and 12.1.0.0 to 12.1.1.2 inclusive. IBM advises customers to upgrade to the latest releases, 10.0.8.13 for the 10.x line and 12.1.1.3 for the 12.x line, which contain the necessary fixes.

The CVSS score of 7.7 indicates a high severity impact on availability. While the EPSS score is not available, the lack of a KEV listing suggests no known large‑scale exploitation yet, but the vulnerability remains actionable. Externally reachable API endpoints that accept authenticated requests are the likely attack vector, and the need for authentication limits the potential attacker pool but still poses a serious risk to service continuity.