CVE-2026-94407

Name of the Vulnerable Software and Affected Versions IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11

Description An issue exists where an authenticated user with tool-registration privileges can cause a denial of service. This occurs by embedding catastrophically backtracking regular expression patterns—complex patterns that cause the regex engine to take an exponential amount of time to process—within the pattern field of a tool's JSON Schema. When the system validates arguments against this schema, the process may consume unbounded CPU resources, which can degrade the availability of the gateway.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.