IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability identified as CWE‑444. Attackers can craft HTTP requests that the server interprets differently, potentially affecting request handling. The likely attack vector is remote network access to the HTTP interface, as the vulnerability exploits request handling logic; this is inferred from the description.

The affected products are IBM WebSphere Application Server versions 8.5.x and 9.0.x, as well as Liberty versions 17.0.0.3 through 26.0.0.8 – all of which contain the mentioned request smuggling flaw.

The CVSS score of 4.8 indicates a moderate potential impact, while the EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of exploitation in the wild. An attacker would need network access to send crafted HTTP traffic to exposed endpoints; the CVE description does not indicate local privilege escalation is required, and the attack surface is limited to the HTTP interface. This inference is based on the description of the vulnerability.