IBM WebSphere Application Server Liberty suffers from insecure deserialization, which can be exploited by a low-privileged administrative user to consume system resources and bring the application to a state in which legitimate traffic is denied. The flaw is rooted in improper handling of serialized objects, a weakness classified as CWE-502. Successful exploitation results in a temporary loss of availability, as the application cannot accept additional requests until resources are freed. The vulnerability does not directly compromise data confidentiality or integrity; its primary impact is disruptive service availability.

Products affected are IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8, but only when the restConnector-2.0 feature is enabled. The flaw does not apply to installations that have disabled this feature or that have been upgraded beyond the specified range.

The CVSS score of 5.7 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it has not yet been widely exploited in the wild. The likely attack vector is local; an attacker must first obtain administrative user credentials or otherwise gain a low-privilege administrative role within the Liberty environment to engage the restConnector-2.0 endpoint. Once the vulnerable endpoint is invoked, the attacker can trigger the DoS condition by sending crafted serialized data. Due to its dependency on administrative access, the real-world risk is lowered but remains significant for environments where privileged users are not adequately monitored.