CVE-2026-78543: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') in IBM App Connect Enterprise

This vulnerability (CVE-2026-78543) affects IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7. It involves a loop with an unreachable exit condition (CWE-835) that can be triggered remotely, causing the application to enter an infinite loop and resulting in denial of service. The CVSS v3.1 base score is 5.3, indicating medium severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

An attacker can remotely cause the affected IBM products to enter an infinite loop, leading to denial of service. This impacts the availability of the service but does not affect confidentiality or integrity. The medium severity score reflects the potential disruption without direct data compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor for updates from IBM and consider implementing network-level protections to limit exposure. No official remediation or temporary fixes have been documented at this time.