A vulnerability in the JMX REST connector body parser allows unsafe reflection of class names. The flaw can leak internally stored information when a request is parsed, potentially exposing sensitive configuration data, stack traces, or other internal state. It is a classic example of CWE‑470, unsafe reflection, which permits data disclosure without proper validation. Based on the description, it is inferred that an attacker can trigger the flaw by sending crafted input to the JMX REST endpoint, leading to information leakage.

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected. This includes all builds in that range up to but not including 26.0.0.11. The vulnerability is tied to the JMX REST connector body parsing component present in those releases.

The CVSS score of 4.3 indicates a moderate severity and the EPSS score is not available, so the likelihood of exploitation is unknown but not considered high. The flaw can be exploited remotely if the JMX REST service is exposed to untrusted networks, and the vulnerability is listed in the KEV catalog as not present. No public exploit is listed, but the exposure of sensitive data remains a concern for exposed installations. The attack would require network access to the JMX REST endpoint, which may be restricted in many deployments.