The vulnerability creates a denial of service condition in the HTTP channel due to unbounded allocation of resources without limits. An attacker can send crafted HTTP requests that trigger uncontrolled resource allocation, exhausting memory or networking buffers and rendering the application unavailable to legitimate users.

Affected platforms include IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.7 when the servlet‑3.0 to servlet‑6.1 feature is enabled, and IBM WebSphere Application Server traditional versions 8.5.0.0 through 8.5.5.30 and 9.0.0.0 through 9.0.5.28.

The CVSS score of 7.5 reflects a significant impact on availability, but the EPSS score of less than 1% indicates a low probability of real‑world exploitation at the time of analysis. The vulnerability is not listed in the CISA known‑exploited catalog. Based on the description, it is inferred that the attacker would exploit the vulnerability through the HTTP channel, requiring network access and the ability to send repeated crafted requests that trigger uncontrolled allocation. While the risk of immediate exploitation is currently modest, the potential for severe service disruption warrants prompt patching.