Denial of service via configuration write access in IBM HTTP Server (CVE-2026-8856)

IBM HTTP Server 8.5 and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration. This vulnerability is classified as uncontrolled resource consumption (CWE-400) and carries a CVSS base score of 7.7. No workarounds or mitigations are available; IBM recommends applying the relevant interim fix or fix pack. Affected versions: - IBM HTTP Server 8.5 - IBM HTTP Server 9.0 We recommend updating to: 9.0.5.29, 8.5.5.30. CVSS 9.1 · our assessment: act_now Reference: https://www.ibm.com/support/pages/node/7274065 Details: https://vuln.today/cve/CVE-2026-8856