IBM WebSphere Application Server Liberty versions 20.0.0.12 through 26.0.0.10 contain an uncaught exception that can be triggered by a remote attacker, leading to a denial of service. The weakness is linked to the gRPC integration and results in the server crashing when it processes malformed input. The impact is limited to availability; there is no evidence that the flaw allows code execution or compromise of confidentiality or integrity.

The affected product is IBM WebSphere Application Server Liberty, specifically the instance versions 20.0.0.12 up to 26.0.0.10 in which the grpc‑1.0 feature is enabled. The vendor notes that any Liberty installation in that range that has the grpc‑1.0 feature activated is susceptible to this exception problem, as the flaw resides in the gRPC integration layer.

The CVSS score of 6.5 indicates a moderate severity vulnerability. The EPSS score of less than 1% suggests a very low probability of exploitation at present, and the flaw is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves a remote attacker sending a specially crafted gRPC request to the exposed interface, which triggers the unhandled exception and brings the server down. The consequence is a service outage only, with no elevation of privilege or data disclosure.