---
id: "CVE-2026-93441"
kind: "vulnerability"
aliases: ["CVE-2026-93441"]
title: "IBM QRadar SIEM: remote attacker can exhaust resources and cause denial of service"
severity: "high"
cvss: 8.6
epss: 0.00327
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "IBM QRadar SIEM HTTP Receiver protocol", "fixed": ["7.5-20260930064859", "7.6-20260930064911"], "affected": ">= 7.4-20210823144546, <= 7.5-20260930064858; >= 7.6-20260330053257, <= 7.6-20260930064910", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["http-receiver", "ibm-qradar", "infrastructure", "self-hosted", "siem"]
not_affected_if: ["no-http-receiver-log-source"]
published_at: "2026-10-20T22:21:07+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-24T13:15:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93441", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:51:02+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-93441", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# IBM QRadar SIEM: remote attacker can exhaust resources and cause denial of service

The QRadar SIEM HTTP Receiver protocol has an uncontrolled resource consumption flaw (CWE-400). A remote attacker needs no authentication, privileges or user interaction. Sending crafted requests can exhaust resources and take the SIEM offline. IBM rates it CVSS 8.6. IBM lists no workaround. Only deployments that use the HTTP Receiver log source protocol are affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM QRadar SIEM HTTP Receiver protocol affected >= 7.4-20210823144546, <= 7.5-20260930064858; >= 7.6-20260330053257, <= 7.6-20260930064910 fixed 7.5-20260930064859, 7.6-20260930064911

## How to check

In QRadar, check whether any log source uses the HTTP Receiver protocol (Admin > Log Sources). Then check the installed HTTP Receiver protocol RPM build: affected builds are 7.4-20210823144546 to 7.5-20260930064858, and 7.6-20260330053257 to 7.6-20260930064910. On the console, running rpm -qa | grep -i PROTOCOL-HTTPReceiver should show the build.

## Fix

Install PROTOCOL-HTTPReceiver-7.5-20260930064859.noarch.rpm on 7.5, or PROTOCOL-HTTPReceiver-7.6-20260930064911.noarch.rpm on 7.6. QRadar Auto Update delivers these RPMs where it is enabled. IBM lists no workarounds. For 7.4, IBM names no separate fix, so check the bulletin.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93441
- 2026-10-23T23:51:02+00:00 analyst — IBM bulletin (13 Oct 2026) read: flaw is in the QRadar HTTP Receiver protocol; fixed by protocol RPMs. Unauthenticated per IBM CVSS PR:N (Armis says the same). No exploitation or PoC found. I did not search X or social posts. The bulletin title also mentions SQL injection and code execution, but the CVE details cover DoS only.
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-93441

## Documents

- [advisory] IBM Security Bulletin: QRadar SIEM HTTP Receiver (CVE-2026-93441) https://www.ibm.com/support/pages/security-bulletin-ibm-qradar-siem-http-receiver-protocol-vulnerable-denial-service-sql-injection-and-could-allow-remote-attacker-execute-arbitrary-code-system
- [mentions] Armis CVE-2026-93441 https://cve.armis.com/CVE-2026-93441

## From the sources

IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_