IBM Web Server Plug‑ins for WebSphere Application Server, including both traditional and Liberty builds, have a flaw (APAR PH71342) that enables HTTP request smuggling when handling specially crafted requests. This flaw results in the plug‑ins misinterpreting HTTP request boundaries, potentially causing unintended request processing downstream in the application. The weakness is classified as CWE‑444.

Affected products are IBM Web Server Plug‑ins for WebSphere Application Server – used with either traditional or Liberty WebSphere – in versions 8.5.0.0 through 8.5.5.29 and 9.0.0.0 through 9.0.5.27. Any deployment of these plug‑ins on a WebSphere environment should be checked against those version ranges.

The vulnerability carries a CVSS score of 7.5, classification high severity. An attacker would only need the ability to send crafted HTTP traffic to the plug‑ins, typically satisfied for internet‑facing or otherwise accessible application servers. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, so the current prevalence of exploitation is uncertain. Nonetheless, the low attack complexity and lack of privileged access requirement raise the risk that an attacker could misuse the misinterpreted request boundaries to influence application behavior. The potential impact, while not explicitly defined in the advisory, could involve unintended request handling or inadvertent data exposure.