Denial of Service Vulnerability in IBM ContextForge MCP Gateway
CVE-2026-94407

6.5MEDIUM

Key Information:

Vendor

IBM
Status
Contextforge Mcp Gateway
Vendor
CVE Published:
13 November 2026

What is CVE-2026-94407?

The IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 may experience denial of service due to an issue with uncontrolled regular expression complexity. An authenticated user possessing tool-registration privileges can exploit this vulnerability by embedding complex regex patterns in a tool's JSON Schema pattern field. This misuse can lead to excessive CPU consumption during validation processes, ultimately degrading the availability of the gateway. It is crucial for users to be aware of this issue and apply the recommended patches as outlined by IBM to maintain optimal system performance and security.

Affected Version(s)

ContextForge MCP Gateway 1.0.0 <= 1.0.11

References

https://www.ibm.com/support/pages/node/7296667
vendor-advisorypatch

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.