A flaw in IBM WebSphere Application Server 9.0, 8.5, and the Liberty profile from 17.0.0.3 through 26.0.0.7 permits an attacker to trigger a denial‑of‑service condition by sending a specially crafted HTTP request. The defect relies on improper handling of input size and falls under CWE‑400, which means the application can be overwhelmed by too large or malformed data. The result is a loss of service for legitimate users of the impacted application server.

Systems running IBM WebSphere Application Server in its traditional form—versions 8.5 and 9.0—or the Liberty profile version 17.0.0.3 to 26.0.0.7 are vulnerable. These include any enterprise deployments or middleware stacks that rely on these IBM products to host web applications.

The CVSS score of 7.5 indicates high severity, and although the EPSS score is 0.00305—equating to a very low exploitation probability—the lack of a current KEV listing does not reduce the likelihood that the flaw will be actively exploited in the wild. Because the exploit requires only a crafted HTTP request, an attacker with network access to the target can trigger the denial of service, potentially disrupting critical services or allowing further attacks by exhausting resources. The official recommendation is to apply the latest fixes promptly to prevent exploitation.