IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server – Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability. Attackers can craft malformed HTTP requests that confuse the server’s request parsing logic, potentially leading to insertion or reordering of request data. This may expose sensitive information, alter application behavior, or cause denial of service. The vulnerability maps to CWE‑444, which concerns challenges with parsing boundary information in HTTP traffic.

Affected versions include IBM WebSphere Application Server 8.5.0 through 9.0.5.28 and Liberty profile 17.0.0.3 through 26.0.0.8. For WebSphere traditional, the security advisory recommends applying Fix Pack 9.0.5.29 (or later) for V9.0.0.0–9.0.5.28 and Fix Pack 8.5.5.31 (or later) for V8.5.0.0–8.5.5.30. For Liberty, apply Liberty Fix Pack 26.0.0.9 (or later) for Liberty version 17.0.0.3–26.0.0.8.

The CVSS score of 4.8 indicates moderate severity, while the EPSS score of <1% suggests a very low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, implying no known widespread exploitation. The attack vector is likely over the network, requiring an external actor to send specially crafted HTTP requests to the affected server.