IBM HTTP Server 8.5 and 9.0 contain a classic buffer overflow that can be triggered by a privileged user authenticated to the Administration Server. The overflow permits the attacker to execute arbitrary code or crash the server, exposing confidentiality, integrity, and availability risks. The weakness is classified as-122, Buffer Overflow.

The vulnerability affects IBM HTTP Server 8.5.x and 9.0.x, including WebSphere Application Server V9.0.0.0–9.0.5.28 and V8.5.0.0–8.5.5.29. IBM recommends applying the interim fix PH71265 or installing Fix Pack 9.0.5.29 (or later) for V9, and Fix Pack 8.5.5.30 (or later) for V8, with early interim fixes available for minimal required levels.

The CVSS score of 8.0 marks the flaw as high severity. EPSS score is not available, indicating no current exploitation probability data. The flaw is not listed in CISA KEV, suggesting no publicly known active exploits yet. Exploitation requires the attacker to be a privileged user with administrative authentication, making the attack vector likely internal or compromised administrative access.