CVE-2026-17271: IBM i Denial of Service Vulnerability

CVE-2026-17271 Overview

CVE-2026-17271 affects IBM i versions 7.6, 7.5, 7.4, and 7.3. A remote attacker can trigger a denial of service condition by sending input that bypasses size validation checks. The flaw stems from improper validation of input size [CWE-770: Allocation of Resources Without Limits or Throttling], which enables uncontrolled resource consumption on the target system.

Critical Impact
A remote, unauthenticated attacker can cause a denial of service against IBM i systems across all currently supported releases (7.3 through 7.6) without user interaction.

Affected Products

IBM i 7.6
IBM i 7.5
IBM i 7.4
IBM i 7.3

Discovery Timeline

2026-08-12 - CVE CVE-2026-17271 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-17271

Vulnerability Analysis

CVE-2026-17271 is a denial of service vulnerability rooted in improper input size validation within IBM i. The affected code paths accept input from remote sources without enforcing an upper bound on size. When oversized input arrives, the system allocates resources proportionally, exhausting memory, CPU, or another finite resource.

Because the attack requires no authentication and no user interaction, an attacker only needs network reachability to a vulnerable IBM i service. Successful exploitation degrades or halts availability of the affected component. Confidentiality and integrity are not impacted, but availability loss on midrange business systems can disrupt ERP, database, and batch workloads that depend on IBM i.

Root Cause

The root cause maps to [CWE-770: Allocation of Resources Without Limits or Throttling]. IBM i processes requests without validating the size of incoming input before allocating buffers or processing structures. This missing boundary check allows an attacker-controlled input to drive resource allocation beyond safe limits.

Attack Vector

The attack vector is network-based. An unauthenticated attacker sends a crafted request with oversized input to a service exposed by IBM i. The vulnerable service accepts and processes the input, consuming system resources until the process or subsystem fails. Repeated or sustained requests amplify the impact and can render the affected IBM i partition unresponsive.

See the IBM Support Page for vendor-supplied technical details and affected component information.

Detection Methods for CVE-2026-17271

Indicators of Compromise

Sudden spikes in memory or CPU consumption on IBM i partitions without corresponding legitimate workload changes.
Unresponsive or crashing IBM i services following inbound network traffic from untrusted sources.
Repeated oversized requests targeting exposed IBM i network services in packet captures or flow logs.

Detection Strategies

Monitor IBM i job logs and QSYSOPR messages for abnormal job terminations, storage allocation errors, or subsystem failures.
Inspect network traffic for anomalously large payloads directed at IBM i services and correlate with source reputation.
Baseline normal request sizes for exposed IBM i services and alert on statistical outliers.

Monitoring Recommendations

Forward IBM i system, job, and audit journals to a centralized SIEM for correlation with network telemetry.
Track availability metrics for IBM i-hosted applications and alert on service degradation patterns consistent with resource exhaustion.
Continuously monitor perimeter and internal firewall logs for unexpected connections to IBM i management and application ports.

How to Mitigate CVE-2026-17271

Immediate Actions Required

Apply the IBM-provided fix referenced on the IBM Support Page to all IBM i 7.3, 7.4, 7.5, and 7.6 systems.
Restrict network access to IBM i services so that only trusted management networks and application tiers can reach exposed ports.
Inventory all IBM i partitions and confirm patch level against the vendor advisory.

Patch Information

IBM has published remediation guidance on the IBM Support Page. Administrators should follow IBM's PTF (Program Temporary Fix) instructions for each affected release (7.3, 7.4, 7.5, 7.6) and validate the update on non-production partitions before broad deployment.

Workarounds

Place IBM i systems behind network segmentation controls that limit exposure of vulnerable services to untrusted networks.
Enforce rate limiting and maximum request size at upstream load balancers or firewalls where technically feasible.
Disable unused IBM i network services to reduce the attack surface while patching is scheduled.

bash

# Example: restrict inbound access to IBM i host at the network firewall
# Replace <ibm_i_host> and <trusted_mgmt_cidr> with environment-specific values
iptables -A FORWARD -s <trusted_mgmt_cidr> -d <ibm_i_host> -j ACCEPT
iptables -A FORWARD -d <ibm_i_host> -j DROP