CVE-2026-15396

IBM WebSphere Application Server IBM WebSphere Application Server - Liberty HTTP Request Smuggling

View on CVE.org
Published Sep 14, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.

Analysis

AI-generated

Technical impact

IBM WebSphere Application Server 8.5, 9.0, and IBM WebSphere Application Server – Liberty are vulnerable to HTTP request smuggling caused by the improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted transfer-encoding header, an attacker can poison the web cache, bypass the web application firewall protection, and conduct cross‑site scripting attacks, as the flaw is identified as CWE-444.

Affected Systems

Affected installations include IBM WebSphere Application Server 8.5 versions prior to 8.5.5.31, IBM WebSphere Application Server 9.0 versions prior to 9.0.5.29, and IBM WebSphere Application Server – Liberty versions 17.0.0.3 through 26.0.0.8.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.5, indicating moderate severity. The EPSS score of <1% suggests a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is over the public network using HTTP, requiring an attacker to transmit a crafted transfer-encoding header to the target server to induce the smuggling and achieve cache poisoning or WAF bypass.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerabilities now by applying the fix pack(s) listed below. For IBM WebSphere Application Server traditional: For V9.0.0.0 through 9.0.5.28: · Apply Fix Pack 9.0.5.29 SB0030823 (availability September 2026) or later fix pack.  For V8.5.0.0 through 8.5.5.30: · Apply Fix Pack 8.5.5.31 https://www.ibm.com/support/pages/node/7285869 (availability September 2026) or later fix pack.  For IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.8: · Apply Liberty Fix Pack 26.0.0.9 https://www.ibm.com/support/pages/node/7285875 (availability September 2026) or later fix pack.

OpenCVE Recommended Actions

  • Apply Fix Pack 9.0.5.29 SB0030823 or later for WebSphere Application Server 9.0.
  • Apply Fix Pack 8.5.5.31 or later for WebSphere Application Server 8.5.
  • Apply Liberty Fix Pack 26.0.0.9 or later for WebSphere Application Server Liberty.
  • Configure the front‑end web server or WAF to reject or strictly validate HTTP transfer‑encoding headers as a temporary mitigation until the patch is applied.

Generated by OpenCVE AI on October 23, 2026 at 08:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks. IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
Title IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities IBM WebSphere Application Server IBM WebSphere Application Server - Liberty HTTP Request Smuggling
First Time appeared Ibm websphere Application Server Liberty
CPEs cpe:2.3:a:ibm:websphere_application_server_liberty:17.0.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server_liberty:26.0.0.8:*:*:*:*:*:*:*
Vendors & Products Ibm websphere Application Server Liberty
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
Title IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
First Time appeared Ibm
Ibm websphere Application Server
Weaknesses CWE-444
CPEs cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm websphere Application Server
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}
Weaknesses
  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Sources

Status
PUBLISHED
Assigner
ibm
Published
Updated
Oct 22, 2026, 6:55 PM
Reserved
Jul 10, 2026, 1:16 PM

View source JSON

Updated
Sep 15, 2026, 2:37 PM

JSON

Status
Awaiting Analysis
Published
Sep 14, 2026, 8:16 PM
Modified
Oct 22, 2026, 7:17 PM

View source JSON

No data.

Updated
Oct 23, 2026, 8:15 AM

JSON