IBM Voice Gateway's Zero-Match Problem and the Liberty Runtime Behind It

IBM Voice Gateway is a containerized service that connects voice and messaging channels to applications. Its security exposure is tied to the images in a cluster, not to a single public web title. A ZoomEye run on November 14, 2026 illustrates the gap: app="IBM Voice Gateway" returned zero matches, while title="Voice Gateway" returned 26,031.

Both queries used sub_type=all, page 1 and page size 1. The second number is not a Voice Gateway count. It is a broad title phrase that can match unrelated telecommunications, messaging and networking products.

What is affected

The IBM bulletin lists six Liberty issues inside Voice Gateway images. The affected tags are sip-orchestrator:1.0.8.31 and sms-gateway:1.0.8.23. The fixed tags are sip-orchestrator:1.0.8.32 and sms-gateway:1.0.8.24. There are no separate workarounds listed.

The most relevant feature clue is restConnector-2.0, which appears in information-disclosure and privilege-escalation findings. Certificate validation and archive path handling add other trust boundaries. The public advisory does not establish exploitation, but it does identify enough technical detail to justify prompt image replacement.

Why the app query is zero

Voice Gateway components may be internal services, API endpoints or containers behind a contact center platform. They do not necessarily expose a stable application fingerprint. A title such as "Voice Gateway" is generic and can appear on vendor documentation, customer portals and unrelated products.

Zero matches therefore tell a defender very little about the installed base. The installed base should come from container inventory, Helm manifests, image digests and deployment records.

The correct measurement object

For this issue, the observable external object is a reachable management or service interface, not a vulnerable library. A public interface can be a useful lead when it belongs to the organization and maps to a running image. A private service can still be vulnerable.

An internal check should ask:

1. Which image digest is running for every replica?
2. Does a stale deployment still reference the affected tag?
3. Is restConnector-2.0 enabled?
4. Are administration clients validating certificates correctly?
5. Did the rollout replace every production and standby replica?

These questions produce a verifiable result. Public title counts do not.

Report the ambiguity

The title query is too broad to support a product count. Its value is to show why phrase-based discovery is weak for generic names. The app query is precise but returns zero. A report should preserve both facts and conclude that the external method is insufficient for this service.

That is not a failure of ZoomEye. It is a reason to choose the right inventory source. Search engines observe internet responses; container orchestrators record image identity.

A useful next step

Pull the fixed image, verify its digest and test the deployment in a controlled environment. Then search the cluster for the old digests and for replicas that were missed by the rollout. If an administrative interface is reachable from an untrusted network, narrow access until the ownership and image version are confirmed.

References

• IBM Voice Gateway security bulletin: https://www.ibm.com/support/pages/security-bulletin-security-vulnerabilities-affect-ibm-voice-gateway-12
• ZoomEye query app="IBM Voice Gateway": https://www.zoomeye.ai/searchResult?q=YXBwPSJJQk0gVm9pY2UgR2F0ZXdheSI%3D
• ZoomEye query title="Voice Gateway": https://www.zoomeye.ai/searchResult?q=dGl0bGU9IlZvaWNlIEdhdGV3YXki