IBM WebSphere Application Server and its Liberty edition are vulnerable to HTTP Response Smuggling caused by the improper handling of non‑standard HTTP version tokens. This flaw can allow an attacker to split or rewrite HTTP responses, exposing sensitive data or enabling further attacks. The weakness is classified as CWE‑444, an HTTP request smuggling vulnerability.

Affected products include IBM WebSphere Application Server 9.0 and 8.5, as well as WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.7. All deployments of these products that expose the relevant servlet features (servlet‑3.0 through servlet‑6.1) are susceptible unless patched.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit this weakness by sending specially crafted HTTP requests with non‑standard version tokens over a network path to the affected server. The official recommendation is to apply the interim fix or an updated fix pack promptly to mitigate the risk.