{"id":"CVE-2025-36061","kind":"vulnerability","aliases":["CVE-2025-36061"],"related":[],"title":"IBM TS4500 tape library: crafted SMTP requests cause denial of service","description":"IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library and IBM Storage TS4500 Library could allow an authenticated user to cause a denial of service using specially crafted SMTP requests that would consume excessive amounts of system resources.","summary":"IBM Storage TS4500 and Diamondback tape library firmware from 1.1.1.6 through 1.12.0.3 can be made to consume excessive system resources by specially crafted SMTP requests. An authenticated user can use this to cause a denial of service.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-storage","infrastructure","smtp","tape-library"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-19T23:17:35+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T03:55:43+00:00","updated_at":"2026-10-25T03:55:43+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:55:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM TS4500 tape library: crafted SMTP requests cause denial of service","impact":"low","summary":"IBM Storage TS4500 and Diamondback tape library firmware from 1.1.1.6 through 1.12.0.3 can be made to consume excessive system resources by specially crafted SMTP requests. An authenticated user can use this to cause a denial of service.","category":"infrastructure","nicknames":[],"who_cares":["ibm-storage","tape-library","smtp"],"confidence":0.6,"needs_auth":"yes","worst_case":"Library management becomes unavailable through resource exhaustion","analyst_note":"Find IBM's security bulletin for CVE-2025-36061 to confirm the fixed version and whether SMTP is default-on.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams that run IBM Storage TS4500 or IBM Diamondback tape libraries in the affected version range and have the SMTP (email notification) feature in use. The sources do not say whether SMTP is enabled by default, so unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000551,"input_tokens":3343,"output_tokens":434,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':13A,16A '-36061':14A,17A '1.1.1.6':35B,67C '1.12.0.3':37B,69C 'allow':80C 'amount':99C 'authent':52B,82C 'caus':8A,58B,85C 'consum':42B,97C 'could':79C 'craft':5A,48B,92C 'cve':12A,15A 'denial':9A,60B,87C 'diamondback':30B,71C 'excess':43B,98C 'firmwar':33B 'ibm':1A,19B,26B,63C,70C,75C 'ibm-storag':18B 'infrastructur':21B 'librari':4A,25B,32B,66C,73C,78C 'made':40B 'request':7A,50B,94C 'resourc':45B,102C 'servic':11A,62B,89C 'smtp':6A,22B,49B,93C 'special':47B,91C 'storag':20B,27B,64C,76C 'system':44B,101C 'tape':3A,24B,31B,72C 'tape-librari':23B 'ts4500':2A,28B,65C,77C 'use':55B,90C 'user':53B,83C 'would':96C","nicknames":[],"mitigations":[],"who_affected":"Teams that run IBM Storage TS4500 or IBM Diamondback tape libraries in the affected version range and have the SMTP (email notification) feature in use. The sources do not say whether SMTP is enabled by default, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T23:17:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-36061","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-36061","severity":null,"published_at":"2026-10-19T23:17:35+00:00","modified_at":"2026-10-20T15:17:08+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}