The vulnerability is an HTTP request smuggling flaw caused by improper parsing of the HTTP transfer‑encoding request header. By sending a specially crafted header, an attacker can poison the web cache, bypass the web application firewall, and execute cross‑site scripting attacks. This flaw falls under CWE‑444 and can compromise the integrity of cached content and the confidentiality of user data, while also allowing denial of service if the cache is overloaded.

Affected systems include IBM WebSphere Application Server 9.0 prior to version 9.0.5.29 and IBM WebSphere Application Server 8.5 prior to version 8.5.5.31, both the traditional and Liberty editions. The CWE‑444‑identified improper header handling applies to these deployments.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of <1% suggests a low probability of exploitation, so the current exploitation likelihood is still unclear. The likely attack vector is via the public network using HTTP, requiring an attacker to send a crafted transfer‑encoding header to the target server to trigger the smuggling and achieve cache poisoning or WAF bypass.