{"id":8985,"date":"2026-11-14T18:19:59","date_gmt":"2026-11-14T18:19:59","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos"},"modified":"2026-11-14T18:19:59","modified_gmt":"2026-11-14T18:19:59","slug":"cve-2026-94407-ibm-contextforge-mcp-gateway-redos","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos","title":{"rendered":"CVE-2026-94407: IBM ContextForge MCP Gateway ReDoS flaw lets authenticated users trigger denial of service"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">IBM has disclosed a regular expression denial of service (ReDoS) vulnerability in its ContextForge MCP Gateway that allows authenticated users to exhaust CPU resources and potentially disrupt service availability.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>What:<\/strong> CVE-2026-94407, a ReDoS vulnerability (CWE-1333) in IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 with CVSS score 6.5<\/li><li><strong>Who is affected:<\/strong> Organizations running IBM ContextForge MCP Gateway versions 1.0.0 to 1.0.11<\/li><li><strong>Attack vector:<\/strong> Authenticated users with tool-registration privileges can embed catastrophically backtracking regex patterns in a tool&#8217;s JSON Schema pattern field<\/li><li><strong>Impact:<\/strong> Validation calls may consume unbounded CPU, potentially degrading gateway availability<\/li><li><strong>What to do:<\/strong> Upgrade to version 1.1.0 immediately<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">In plain English<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">IBM ContextForge MCP Gateway is a tool that validates data using patterns defined in JSON Schemas. A security flaw lets logged-in users who can register tools insert specially crafted regular expressions (text-matching patterns) that cause the system to work extremely hard when checking data. This can slow down or freeze the gateway, making it unavailable to other users. If you run this software, you need to upgrade to version 1.1.0. If you don&#8217;t use IBM ContextForge MCP Gateway, you can ignore this issue.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">IBM ContextForge MCP Gateway validates tool arguments, tool results, and prompt arguments against JSON Schemas supplied by tool and prompt authors or by federated remote MCP servers. These schemas can contain regular expression keywords such as <code>pattern<\/code> and <code>patternProperties<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability exists because IBM ContextForge MCP Gateway evaluates regular expressions embedded in these schemas without any time or complexity bound. An authenticated user with tool-registration privileges can embed catastrophically backtracking regex patterns in a tool&#8217;s JSON Schema <code>pattern<\/code> field. When ContextForge validates arguments against that schema, the validation call may consume unbounded CPU, potentially degrading gateway availability.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">IBM published the security bulletin on November 13, 2026. The vulnerability is tracked as CVE-2026-94407 and classified under CWE-1333 (Inefficient Regular Expression Complexity). IBM assigned a CVSS v3.1 base score of 6.5 with the vector (CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:N\/A:H), indicating a network-exploitable vulnerability requiring low privileges with high availability impact.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What you should do<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">IBM strongly recommends upgrading to version 1.1.0 immediately. The company states there are no workarounds and emphasizes that organizations should address the vulnerability now.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Administrators running affected versions (1.0.0 through 1.0.11) should consult the v1.1.0 release notes and plan an immediate upgrade. IBM provides no mitigations short of upgrading to the fixed version.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What it means<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This vulnerability highlights the risks of unbounded input validation in systems that process user-supplied schemas or patterns. While the attack requires authentication and specific privileges (tool-registration), it can be exploited remotely over the network with low complexity.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The ReDoS attack vector is particularly concerning for gateway infrastructure, where availability is critical. A single malicious or poorly crafted regular expression can monopolize CPU resources, creating a denial of service condition that affects all users of the gateway.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Organizations using IBM ContextForge MCP Gateway in production environments should treat this as a priority patch, especially if tool-registration privileges are granted to multiple users or if the gateway serves critical workloads.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-94407\" target=\"_blank\" rel=\"noreferrer noopener\">NVD CVE-2026-94407<\/a><\/li><li><a href=\"https:\/\/www.ibm.com\/support\/pages\/node\/7296667\" target=\"_blank\" rel=\"noreferrer noopener\">IBM Security Bulletin: IBM ContextForge MCP Gateway is affected by a regular expression denial of service<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain a regular expression denial of service (ReDoS) vulnerability that allows authenticated users with tool-registration privileges to degrade gateway availability.<\/p>\n","protected":false},"author":2,"featured_media":8984,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"65","_nx_sec_severity":"medium","_nx_sec_affected":"IBM ContextForge MCP Gateway 1.0.0\u20131.0.11","_nx_sec_status":"patch-available","_nx_sec_kicker":"ALERT: ReDoS flaw in IBM ContextForge MCP Gateway","_nx_sec_type":"mcp","_nx_sec_vendor":"IBM","_nx_sec_fixed":"1.1.0","_nx_sec_action":""},"categories":[14,65,12,28],"tags":[],"companies":[],"products":[],"class_list":["post-8985","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-agents","category-ai-security","category-policy-safety","category-security-defense"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2026-94407: IBM ContextForge MCP Gateway ReDoS flaw<\/title>\n<meta name=\"description\" content=\"CVE-2026-94407 in IBM ContextForge MCP Gateway 1.0.0\u20131.0.11 lets authenticated users embed malicious regex patterns to exhaust CPU and degrade service.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2026-94407: IBM ContextForge MCP Gateway ReDoS flaw\" \/>\n<meta property=\"og:description\" content=\"CVE-2026-94407 in IBM ContextForge MCP Gateway 1.0.0\u20131.0.11 lets authenticated users embed malicious regex patterns to exhaust CPU and degrade service.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-14T18:19:59+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"CVE-2026-94407: IBM ContextForge MCP Gateway ReDoS flaw lets authenticated users trigger denial of service\",\"datePublished\":\"2026-11-14T18:19:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos\"},\"wordCount\":542,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos-title.webp\",\"articleSection\":[\"Agents\",\"AI Security\",\"Policy &amp; Safety\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-11-14T18:19:59+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos\",\"name\":\"CVE-2026-94407: IBM ContextForge MCP Gateway ReDoS flaw\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos-title.webp\",\"datePublished\":\"2026-11-14T18:19:59+00:00\",\"description\":\"CVE-2026-94407 in IBM ContextForge MCP Gateway 1.0.0\u20131.0.11 lets authenticated users embed malicious regex patterns to exhaust CPU and degrade service.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"Image: AI-generated, i10X\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2026-94407: IBM ContextForge MCP Gateway ReDoS flaw lets authenticated users trigger denial of service\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"},\"subjectOf\":[{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/papers.ssrn.com\\\/abstract=7426699\",\"name\":\"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/www.heise.de\\\/news\\\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html\",\"name\":\"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/t3n.de\\\/news\\\/bewerbung-schreiben-ki-5-fehler-1747190\\\/\",\"name\":\"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden\"}]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2026-94407: IBM ContextForge MCP Gateway ReDoS flaw","description":"CVE-2026-94407 in IBM ContextForge MCP Gateway 1.0.0\u20131.0.11 lets authenticated users embed malicious regex patterns to exhaust CPU and degrade service.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos","og_locale":"en_US","og_type":"article","og_title":"CVE-2026-94407: IBM ContextForge MCP Gateway ReDoS flaw","og_description":"CVE-2026-94407 in IBM ContextForge MCP Gateway 1.0.0\u20131.0.11 lets authenticated users embed malicious regex patterns to exhaust CPU and degrade service.","og_url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos","og_site_name":"i10X News","article_published_time":"2026-11-14T18:19:59+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_image":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"CVE-2026-94407: IBM ContextForge MCP Gateway ReDoS flaw lets authenticated users trigger denial of service","datePublished":"2026-11-14T18:19:59+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos"},"wordCount":542,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos-title.webp","articleSection":["Agents","AI Security","Policy &amp; Safety","Security &amp; Defense"],"inLanguage":"en-US","dateModified":"2026-11-14T18:19:59+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos","url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos","name":"CVE-2026-94407: IBM ContextForge MCP Gateway ReDoS flaw","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos-title.webp","datePublished":"2026-11-14T18:19:59+00:00","description":"CVE-2026-94407 in IBM ContextForge MCP Gateway 1.0.0\u20131.0.11 lets authenticated users embed malicious regex patterns to exhaust CPU and degrade service.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos-title.webp","width":1344,"height":768,"caption":"Image: AI-generated, i10X"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-94407-ibm-contextforge-mcp-gateway-redos#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"CVE-2026-94407: IBM ContextForge MCP Gateway ReDoS flaw lets authenticated users trigger denial of service"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"},"subjectOf":[{"@type":"CreativeWork","url":"https:\/\/papers.ssrn.com\/abstract=7426699","name":"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens"},{"@type":"CreativeWork","url":"https:\/\/www.heise.de\/news\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html","name":"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT"},{"@type":"CreativeWork","url":"https:\/\/t3n.de\/news\/bewerbung-schreiben-ki-5-fehler-1747190\/","name":"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden"}]}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8985","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=8985"}],"version-history":[{"count":0,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8985\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/8984"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=8985"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=8985"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=8985"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=8985"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=8985"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}