IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.7 are vulnerable to a denial‑of‑service condition caused by uncontrolled heap allocation that can exhaust available memory. The flaw is an out‑of‑bounds heap write (CWE‑787), which an attacker can exploit by sending crafted requests that trigger the allocation bug, leading to memory exhaustion and service interruption.

Vulnerable installations are found in IBM WebSphere Application Server Liberty versions 17.0.0.3 to 26.0.0.7, particularly when the servlet‑3.1, servlet‑4.0, servlet‑5.0, servlet‑6.0, or servlet‑6.1 features are enabled. These features expose the code path that performs the uncontrolled allocation.

The CVSS score of 7.5 indicates a high severity potential. The EPSS score of less than 1 % suggests that, as of now, exploitation is considered unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be a remote web request, as the vulnerability is triggered by crafted requests that activate the vulnerable code path; this inference is based on the description that the flaw is caused by uncontrolled heap allocation during request handling. An attacker would need to deliver such a request to flood the application with many allocation attempts and trigger memory exhaustion.