PatchSiren cyber security CVE debrief

CVE-2026-7528 IBM CVE debrief

IBM Langflow OSS versions 1.0.0 through 1.9.0 contain a denial-of-service vulnerability stemming from uncontrolled resource consumption. The issue was published to the CVE Program on 2026-05-27 and carries a CVSS 3.1 score of 7.1 (HIGH). The attack vector is network-based with low attack complexity, requiring low privileges but no user interaction. The confidentiality impact is low, integrity impact is none, and availability impact is high. IBM has published a security bulletin with remediation guidance.

Vendor: IBM
Product: Langflow OSS
CVSS: HIGH 7.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-27
Original CVE updated: 2026-05-27
Advisory published: 2026-05-27
Advisory updated: 2026-05-27

Who should care

Organizations running IBM Langflow OSS versions 1.0.0–1.9.0 in production environments, particularly those exposing instances to network access. DevOps and platform engineering teams responsible for Langflow deployments should prioritize patching. Security operations teams should monitor for resource exhaustion indicators.

Technical summary

The vulnerability exists in IBM Langflow OSS, an open-source visual framework for building LangChain applications. Affected versions (1.0.0–1.9.0) fail to properly constrain resource consumption, allowing an attacker with low-privilege network access to exhaust system resources and cause denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) reflects network exploitability with minimal prerequisites but significant availability impact. The underlying weakness is CWE-400 (Uncontrolled Resource Consumption). No evidence of known exploitation or ransomware campaign use is currently documented.

Defensive priority

HIGH

Recommended defensive actions

Upgrade IBM Langflow OSS to a version beyond 1.9.0 or apply patches per IBM security bulletin
Implement resource quotas and rate limiting on Langflow instances to mitigate uncontrolled consumption
Monitor for anomalous resource utilization patterns that may indicate exploitation attempts
Review IBM's security bulletin for vendor-specific configuration guidance

Evidence notes

CVE description confirms affected versions (1.0.0–1.9.0). CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H indicates network-exploitable, authenticated DoS with high availability impact. CWE-400 (Uncontrolled Resource Consumption) is the primary weakness. IBM PSIRT is the authoritative source.

Official resources

2026-05-27