CVE-2026-9171 is a denial of service vulnerability in IBM PowerVM Novalink caused by uncontrolled resource consumption (CWE-400). An unauthenticated remote attacker can exploit this by sending specially crafted requests that cause the server to consume excessive memory resources, leading to service disruption. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts availability only. Affected versions include 2.2.02.2.12.2.1.1 and 2.3.02.3.0.12.3.12.3.2. No vendor advisory or patch information is currently available.

Exploitation results in denial of service due to excessive memory consumption on the affected IBM PowerVM Novalink servers. This impacts availability but does not affect confidentiality or integrity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting exposure of the affected service to untrusted networks and monitor for unusual memory usage patterns related to incoming requests.