A malformed TimeProfile in ManageIQ can trigger timeouts on both the user interface and subsequent API calls, effectively freezing the platform and preventing legitimate users from accessing services. The vulnerability stems from improper input validation, allowing an attacker to craft a TimeProfile that causes the system to hang during processing. If the fault is exploited repeatedly, overall availability of the management platform is degraded, potentially impacting multiple applications that depend on it for configuration and monitoring.

The issue applies to the ManageIQ open‑source management platform in all releases prior to the radjabov-2 branch, which introduced the necessary guardrails. The affected versions are the default releases until radjabov-2 is deployed, while radjabov-2 and later releases contain a patch that deletes the vulnerability.

The vulnerability has a CVSS score of 7.1, indicating high severity, but its EPSS score is reported as under one percent, implying exploitation is currently unlikely. The weakness is identified as CWE‑20 (Improper Input Validation). Because the flaw is triggered through the public API, an attacker only needs to send a crafted TimeProfile payload, with no additional system privilege required. The KEV status is not listed, meaning no known commercial exploits have been reported yet, though the impact on availability makes it a high‑risk issue for exposed installations.