The vulnerability allows an attacker to send crafted HTTP requests that cause the server to allocate resources without limits, leading to a denial of service. This flaw is catalogued as CWE‑400, which highlights improper resource exhaustion handling. An exploited instance can exhaust memory or network buffers, rendering the application unresponsive for legitimate users while consuming substantial system resources.

Affected platforms include IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.7 when the servlet‑3.0 to servlet‑6.1 feature is enabled, and IBM WebSphere Application Server traditional versions 8.5.0.0 through 8.5.5.30 and 9.0.0.0 through 9.0.5.28.

The CVSS score of 7.5 reflects a significant impact on availability, but the EPSS score of less than 1% indicates a low probability of real‑world exploitation at the time of analysis. The vulnerability is not listed in the CISA known‑exploited catalog. Based on the description, it is inferred that the attacker would exploit the vulnerability through the HTTP channel, requiring network access and the ability to send repeated crafted requests that trigger uncontrolled allocation. While the risk of immediate exploitation is currently modest, the potential for severe service disruption warrants prompt patching.