CVE-2024-47113 is a high severity (CVSS 8.1) XML injection flaw in IBM Voice Gateway. A remote attacker could send crafted XML statements to view or modify information in an XML document. IBM says to upgrade to the Voice Gateway 1.0.8.x images named in its bulletin, and offers no workaround.
What's affected
IBM lists these Voice Gateway versions as affected: 1.0.2, 1.0.2.4, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.7.1 and 1.0.8.
The remediation in the bulletin is to upgrade to these images:
- ibmcom/voice-gateway-so:1.0.8.17
- ibmcom/voice-gateway-sms:1.0.8.14
IBM states there are no workarounds or mitigations. The same bulletin also covers a separate Liberty certificate validation issue, CVE-2023-50314, which the upgrade addresses.
How to check if you're exposed
Look at the image tags your Voice Gateway containers run from.
docker ps --format "{{.Names}} {{.Image}}" | grep -i voice-gateway
If you run on Kubernetes, check the image fields in your deployment manifests. Anything older than the 1.0.8.17 and 1.0.8.14 tags for the respective images is affected according to the bulletin. Note that IBM lists 1.0.8 itself as affected, so being on the 1.0.8 line is not enough.
What to do now
- List all Voice Gateway deployments and the image tags they run.
- Pull the fixed images named in the IBM bulletin and test them in a staging environment.
- Roll the updated images into production.
- Limit network access to the gateway to the carriers and systems that need it.
- Log and review unusual XML requests if your tooling records them.
Why it matters
The weakness is CWE-91 (XML Injection), also called blind XPath injection. When a service builds XML or XPath queries from request data without escaping it, the attacker can change the structure of the query. The result is that data can be read or altered in the XML document the service works with.
The score of 8.1 reflects network reach with low privileges and high confidentiality and integrity impact. Voice systems often sit between carriers and internal tools, so integrity matters. The record does not flag exploitation and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-47113.
Quick check
Is there a workaround for CVE-2024-47113?
IBM says there are no workarounds or mitigations, so upgrade to the fixed images.
Is 1.0.8 safe?
No. IBM lists 1.0.8 as affected. Use the 1.0.8.17 and 1.0.8.14 images.
Sources
Last reviewed: 19 October 2026.
