IBM HTTP Server 8.5 and 9.0 expose a flaw that allows remote code execution and denial of service when TLS mutual authentication is enabled. An attacker who can present a client certificate can trigger the vulnerability and run arbitrary code on the server, whereas the same configuration also permits the attacker to terminate the service, impacting availability. The vulnerability is classified as CWE‑94 (Code Injection).

The affected product is IBM HTTP Server across the 8.5.x and 9.0.x series. The CVE applies to any deployment that includes TLS mutual authentication for client authentication. The mitigation guidance references IBM fix packs 8.5.5.30+ and 9.0.5.29+ or an interim fix. Versions 8.5.0 and higher, and 9.0.0 and higher, are included in the scope of the advisory.

The CVSS score of 8.1 categorises the risk as high. No EPSS score is available, and the vulnerability is not listed in CISA KEV, indicating no publicly known active exploits yet. The attack environment requires the possibility of initiating a TLS connection with mutual authentication; therefore the threat originates from a remote source that can provide a client certificate. The lack of explicit exploit code in the advisory suggests that the risk remains theoretical but substantial, emphasizing the need for prompt patching.