CVE-2026-14979: IBM Engineering Lifecycle DoS Vulnerability

CVE-2026-14979 Overview

CVE-2026-14979 is a denial of service vulnerability in IBM Engineering Lifecycle Management (ELM) DOORS. The flaw stems from improper handling of XML entity expansion [CWE-776] in the DOORS component. A remote, unauthenticated attacker can submit crafted XML payloads that force the parser to expand nested entities, exhausting server resources. Affected releases include IBM ELM 7.0.3 Interim Fix 001 through Interim Fix 021, 7.1.0 Interim Fix 001 through Interim Fix 009, and 7.2.0 including Interim Fix 001. The issue is exploitable over the network with low attack complexity and no privileges required.

Critical Impact

Unauthenticated remote attackers can degrade or disable IBM ELM DOORS availability by triggering runaway XML entity expansion.

Affected Products

• IBM Engineering Lifecycle Management 7.0.3 (Interim Fix 001 through Interim Fix 021)
• IBM Engineering Lifecycle Management 7.1.0 (Interim Fix 001 through Interim Fix 009)
• IBM Engineering Lifecycle Management 7.2.0 and 7.2.0 Interim Fix 001 (DOORS)

Discovery Timeline

• 2026-07-17 - CVE-2026-14979 published to NVD
• 2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-14979

Vulnerability Analysis

The vulnerability affects the XML parsing logic within the DOORS component of IBM Engineering Lifecycle Management. The parser processes XML input without enforcing limits on entity expansion depth or size. An attacker submits an XML document that declares nested entities referencing each other, causing exponential expansion when the parser dereferences them. This classic Billion Laughs style attack consumes CPU cycles and memory until the service becomes unresponsive or terminates. Because the endpoint accepts XML from unauthenticated network clients, exploitation requires only network reachability to the affected instance.

Root Cause

The root cause is improper restriction of recursive entity references [CWE-776] in the XML parser configuration. The parser does not cap total expanded entity size, expansion depth, or resolve external references safely. Without these controls, a small XML payload can produce gigabytes of expanded content in memory.

Attack Vector

Exploitation occurs over the network. The attacker sends a crafted XML request to an exposed DOORS interface. The payload uses stacked internal entity definitions, each referencing the previous entity multiple times. When the parser resolves the outermost entity, expansion cascades and exhausts available memory or CPU. No authentication, user interaction, or prior access is required. The confidentiality and integrity of data are not directly affected; the impact is limited to availability.

No verified exploit code is publicly available. See the IBM Support Page for vendor technical details.

Detection Methods for CVE-2026-14979

Indicators of Compromise

• Sudden spikes in CPU or memory utilization on IBM ELM DOORS application servers coinciding with inbound HTTP requests containing XML payloads.
• HTTP requests to DOORS endpoints with Content-Type: application/xml or text/xml containing multiple <!ENTITY> declarations.
• Application logs showing XML parser errors, out-of-memory exceptions, or thread pool exhaustion.

Detection Strategies

• Inspect inbound XML request bodies at the web application firewall or reverse proxy for nested entity declarations and unusually deep entity chains.
• Correlate application server resource exhaustion events with the source IP addresses of recent XML POST requests to DOORS.
• Baseline normal XML payload sizes for DOORS endpoints and alert on outliers or payloads containing DOCTYPE declarations with internal entity subsets.

Monitoring Recommendations

• Enable verbose XML parser logging to capture entity expansion failures and parser timeouts.
• Monitor JVM heap usage and garbage collection frequency on ELM application servers for sustained pressure.
• Track HTTP 5xx response rates and request latency on DOORS API paths as early indicators of resource exhaustion.

How to Mitigate CVE-2026-14979

Immediate Actions Required

• Apply the interim fix published by IBM for the affected 7.0.3, 7.1.0, and 7.2.0 release lines as documented on the vendor advisory.
• Restrict network access to DOORS interfaces to trusted networks and authenticated users where operationally feasible.
• Deploy WAF rules that block inbound XML containing DOCTYPE declarations with internal entity subsets to the ELM application.

Patch Information

IBM has published guidance and remediation details on the IBM Support Page. Administrators should upgrade to a fixed interim fix level beyond those listed as affected. Consult the vendor advisory for the specific fix identifiers matching each release line.

Workarounds

• Configure the XML parser to disable DOCTYPE processing (FEATURE_SECURE_PROCESSING enabled and disallow-doctype-decl set to true) at the application server level if supported.
• Place a reverse proxy in front of DOORS that strips or rejects requests containing XML DTD subsets.
• Enforce request size limits and connection rate limits on DOORS-facing load balancers to reduce exploitation impact.

# Example WAF rule concept to block XML entity expansion payloads (ModSecurity)
SecRule REQUEST_HEADERS:Content-Type "@rx (application|text)/xml" \
    "chain,id:1002601,phase:2,deny,status:400,msg:'Blocked XML with DTD/entity subset'"
  SecRule REQUEST_BODY "@rx (?i)<!DOCTYPE[^>]+\[|<!ENTITY\s" \
    "t:none"