CVE-2024-41742: IBM TXSeries for Multiplatforms DoS Flaw

CVE-2024-41742 Overview

CVE-2024-41742 affects IBM TXSeries for Multiplatforms 10.1. The product fails to enforce timeouts on individual read operations. Remote attackers can exploit this weakness through slowloris-type attacks to exhaust server resources. The flaw maps to [CWE-770]: Allocation of Resources Without Limits or Throttling.

A successful attack does not require authentication or user interaction. The attacker only needs network reachability to the TXSeries service. Service availability is the sole impact, with no compromise of confidentiality or integrity.

Critical Impact
A remote, unauthenticated attacker can hold open partial HTTP read operations to exhaust connection resources and cause a denial of service on TXSeries for Multiplatforms 10.1.

Affected Products

IBM TXSeries for Multiplatforms 10.1
Deployments on Linux kernel-based hosts
TXSeries CICS-compatible transaction server components exposing network listeners

Discovery Timeline

2025-01-19 - CVE-2024-41742 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-41742

Vulnerability Analysis

The vulnerability stems from improper enforcement of read-operation timeouts inside TXSeries network handling. When a client begins an HTTP read, the server does not bound how long that individual read may stall. Attackers exploit this by opening many connections and sending request bytes very slowly. Each held connection consumes a worker thread or socket slot until exhaustion.

This pattern is the classic slowloris technique. The attack does not require malformed payloads, valid credentials, or any user interaction on the target. The cost to the attacker is trivial, while the server commits significant resources to each partial request.

Legitimate clients cannot complete connections once the listener pool is saturated. The service stops processing transactions until connections time out or the process is restarted. Because TXSeries underpins transaction processing workloads, the outage propagates to dependent business applications.

Root Cause

The root cause is the absence of a per-read timeout on incoming socket data. The server measures connection or request lifecycle limits at too coarse a granularity. A connection that drips bytes below the application read threshold is treated as active rather than abusive. This violates the principle of bounded resource allocation captured by CWE-770.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker initiates many concurrent TCP sessions to the TXSeries listener, sends incomplete HTTP headers, and periodically transmits a single byte to keep the read alive. Standard slowloris and slow-read tools can be repurposed against the service. See the IBM Security Advisory for vendor-specific details on the affected component.

Detection Methods for CVE-2024-41742

Indicators of Compromise

High counts of concurrent TCP connections from a small set of source IP addresses to TXSeries listener ports.
HTTP requests that remain in a partially received state for unusually long periods.
Spikes in worker-thread or socket-pool utilization on TXSeries hosts without corresponding transaction throughput.
Connection accept queues filling while CPU usage on the TXSeries process remains low.

Detection Strategies

Monitor per-source connection counts and flag any client exceeding a defined baseline against TXSeries ports.
Inspect web tier and reverse proxy logs for requests with abnormally long time-to-first-complete-header values.
Correlate failed transaction availability checks with concurrent connection saturation on the same host.
Alert when the ratio of completed requests to opened connections drops below an established baseline.

Monitoring Recommendations

Track ESTABLISHED socket counts and half-open request states on TXSeries listener ports.
Capture and retain network flow telemetry for the TXSeries tier to support post-incident analysis.
Forward TXSeries and reverse proxy logs to a centralized analytics platform for anomaly detection.
Set alert thresholds tied to historical connection-rate baselines rather than static limits.

How to Mitigate CVE-2024-41742

Immediate Actions Required

Apply the IBM-provided fix referenced in the IBM Support Page for TXSeries for Multiplatforms 10.1.
Place TXSeries listeners behind a reverse proxy or load balancer that enforces strict read timeouts.
Restrict network exposure of the TXSeries service to known client networks where business requirements allow.
Rate-limit concurrent connections per source IP at the perimeter.

Patch Information

IBM has published remediation guidance for CVE-2024-41742 on its support portal. Administrators should consult the IBM Security Bulletin for the fix pack or interim fix that applies to TXSeries for Multiplatforms 10.1 and follow IBM's documented upgrade procedure. Validate the fix in a staging environment before production rollout.

Workarounds

Front the service with a hardened reverse proxy such as one configured with aggressive client_header_timeout and client_body_timeout values.
Enforce per-IP concurrent connection caps and slow-request detection at the load balancer or web application firewall.
Reduce the maximum keep-alive duration and idle connection lifetime on upstream network devices.
Deploy network-layer DDoS mitigation in front of internet-exposed TXSeries deployments.

bash

# Example NGINX reverse proxy hardening against slow-read attacks
http {
    client_header_timeout 10s;
    client_body_timeout   10s;
    send_timeout          10s;
    keepalive_timeout     15s;

    limit_conn_zone $binary_remote_addr zone=txconn:10m;

    server {
        listen 443 ssl;
        server_name txseries.example.com;

        limit_conn txconn 20;

        location / {
            proxy_pass http://txseries_backend;
            proxy_read_timeout 30s;
            proxy_send_timeout 30s;
        }
    }
}