Description

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

Severity (CVSS)

Base score5.9
SeverityMedium
VersionCVSS 3.1
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Provided byCNA

Weaknesses

  • CWE-400 — CWE-400 Uncontrolled Resource Consumption

Affected products

VendorProductVersions
IBMWebSphere Application Server9.0.0 to <=7.0.2 Interim Fix 035; 8.5.0 to <=7.0.3 Interim Fix 017
IBMWebSphere Application Server - Liberty17.0.0.3 to <=26.0.0.6

References

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 23 Jun 2026 10:05 UTC.