The CVE description states that IBM WebSphere Application Server 8.5, 9.0, and WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling. HTTP request smuggling is a technique that allows a malicious actor to manipulate the parsing of HTTP request boundaries, potentially resulting in misinterpretation of requests by the server. This weakness is classified as CWE-444.

The vulnerability affects IBM WebSphere Application Server 8.5, 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8. No other product versions are listed in the CNA data.

The CVSS base score is 4.8, which is categorized as medium severity. The EPSS score of < 1% indicates a very low likelihood of exploitation, and the issue is not listed in CISA KEV. The flaw permits manipulation of HTTP request boundary handling; the likely attack vector is remote HTTP traffic, as an attacker would need to craft specially formatted requests to trigger request smuggling. While the severity is moderate, the very low exploitation probability suggests operators can prioritize patching alongside monitoring of suspicious HTTP traffic.