IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.9 contain an integer overflow flaw that is triggered when an authenticated user with the Reader role requests detailed version information. The overflow leads to an uncaught exception, which terminates the application instance and disables the service for all users. The flaw does not allow remote code execution, but it can result in service disruption.

IBM WebSphere Application Server Liberty releases from 17.0.0.3 up to 26.0.0.9 are affected. IBM recommends addressing the vulnerabilities by applying Liberty Fix Pack 26.0.0.10 or later, which became available starting October 2026.

The CVSS base score is 4.3, indicating moderate severity, and the EPSS score is below 1%, implying a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV. The flaw can be triggered only by an authenticated Reader‑role attacker, so remote unauthenticated exploitation is not possible.