Threats tagged 'ghsa-254c-53h8-vpf6'

IBM ContextForge MCP Gateway versions 1.0.8 through 1.0.11 and 1.1.0 contain a denial of service vulnerability due to an incomplete denylist in the jq filter guard module. An authenticated remote attacker can exploit this by supplying a crafted jsonpath_filter value that bypasses safety checks, causing worker process termination or resource exhaustion. The vulnerability is identified as CWE-184 and has a CVSS 3.1 score of 6.5 (medium severity). No patch or remediation information is currently provided.