IBM WebSphere Application Server and the Liberty profile suffer from a flaw that causes the server to interpret inbound HTTP requests inconsistently. When an attacker sends specially crafted requests, the server may mis-handle the request boundaries, enabling request smuggling. This tampering can allow an attacker to bypass access controls, read or modify sensitive data, or disrupt service availability, thereby compromising the integrity and confidentiality of client‑server communication.

Affected products include IBM WebSphere Application Server versions 8.5.0 through 8.5.5.30 and 9.0.0 through 9.0.5.28, as well as WebSphere Application Server Liberty releases 17.0.0.3 through 26.0.0.7 that support servlet specifications 3.0 to 6.1. The vulnerability applies only when the relevant servlet feature is enabled in these releases.

The CVSS score of 7.4 classifies this defect as high severity, while the EPSS score indicates a very low probability of exploitation (<1%). It is not listed in the CISA KEV catalog, suggesting no known active exploits at this time. The likely attack vector is network‑based, inferred because the vulnerability involves HTTP request smuggling which typically requires an attacker to send crafted requests over the network to a vulnerable WebSphere Application Server. Exploitation requires the target to have the susceptible servlet feature enabled and to receive the targeted HTTP traffic.