The latest description indicates a flaw that allows HTTP request smuggling in IBM WebSphere Application Server and its Liberty profile. Detailed specifics beyond the statement that the server may mis-handle request boundaries are not disclosed in the current data, but the impact remains that an attacker could manipulate crafted HTTP requests to bypass access controls, read or modify sensitive data, or disrupt service availability.

Affected products include IBM WebSphere Application Server versions 8.5.0 through 8.5.5.30 and 9.0.0 through 9.0.5.28, as well as WebSphere Application Server Liberty releases 17.0.0.3 through 26.0.0.7 that support servlet specifications 3.0 to 6.1. The vulnerability applies only when the relevant servlet feature is enabled in these releases.

The CVSS score of 7.4 classifies this defect as high severity, while the EPSS score indicates a very low probability of exploitation (<1%). It is not listed in the CISA KEV catalog, suggesting no known active exploits at this time. The likely attack vector is network‑based, inferred because the vulnerability involves HTTP request smuggling which typically requires an attacker to send crafted requests over the network to a vulnerable WebSphere Application Server. Exploitation requires the target to have the susceptible servlet feature enabled and to receive the targeted HTTP traffic.