An infinite parsing loop in IBM Maximo Application Suite – IoT Component can be triggered by specially crafted input, causing the component to consume excessive CPU cycles and eventually halt or become unresponsive. The weakness is classified as CWE‑400, an uncontrolled resource consumption flaw that leads to a denial of service for users of the impacted service. This attack does not disclose data or alter system state beyond the service outage, but it can disrupt business processes, negatively affect availability, and potentially cascade to related components if the IoT data pipeline is interrupted.

The vulnerability affects IBM Maximo Application Suite – IoT Component versions 9.0.0, 9.1.0, and 9.2.0. IBM recommends upgrading to at least 9.0.24, 9.1.15, or 9.2.3 – the latest available builds listed in the IBM catalog.

The CVSS score of 7.5 indicates a high severity denial of service risk. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, so the current exploitation probability is uncertain. However, the vulnerability can be activated remotely by sending crafted input to the component; attackers do not need elevated privileges. Because denial of service can severely affect operational continuity, the risk is considered significant for exposed deployments.