What is the CVSS score of CVE-2026-11897?

CVE-2026-11897 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of WebSphere Liberty are affected by CVE-2026-11897?

IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.7) contains a memory exhaustion vulnerability that allows remote, unauthenticated attackers to crash the application server…. A patch is available.

How to fix or mitigate CVE-2026-11897?

Within 24 hours, audit all systems to identify installations of IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.7 and document their business criticality and customer-facing status. Within 7 days, obtain the latest patched release from IBM, execute comprehensive testing in non-production environments to validate application compatibility, and deploy to lower-priority production systems. Within 30 days, complete deployment across all affected production infrastructure, prioritizing customer-facing and mission-critical applications to minimize business risk.

WebSphere Liberty CVE-2026-11897

EUVD-2026-51147 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-30 ibm

GHSA-89rj-ccwc-wmpm

Denial Of Service IBM Websphere Application Server Liberty

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated memory-exhaustion DoS means AV:N/AC:L/PR:N/UI:N with availability-only impact (A:H); corrected C:H in the source vector to C:N since no data disclosure occurs.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:27 vuln.today

CVE Published

Jul 30, 2026 - 14:18 nvd

HIGH 7.5

DescriptionNVD

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

AnalysisAI

Uncontrolled memory consumption in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.7) lets a remote attacker crash or degrade the server by sending a single specially crafted request that forces excessive memory allocation. The flaw is network-reachable and requires no authentication or user interaction (PR:N/UI:N), and IBM (the reporter) has released a fix. There is no public exploit identified at time of analysis, and no EPSS or CISA KEV data was provided.

Technical ContextAI

IBM WebSphere Application Server Liberty is a lightweight, modular Java/Jakarta EE application server runtime widely used to host enterprise web applications and microservices. The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): a request-handling code path allocates memory based on attacker-influenced input without enforcing an upper bound, so a crafted request drives unbounded heap growth. The affected CPE is cpe:2.3:a:ibm:websphere_application_server_-_liberty, covering all Liberty builds in the stated 17.0.0.3-26.0.0.7 range; the exact vulnerable component (e.g., a specific protocol parser or request feature) is not disclosed in the available data.

RemediationAI

Patch available per vendor advisory: apply the IBM-provided fix for WebSphere Application Server Liberty as described at https://www.ibm.com/support/pages/node/7280695, upgrading to the fixed continuous-delivery level or installing the interim fix IBM lists there (the exact fixed version is not specified in the input, so confirm it on the advisory). Until patched, reduce exposure by placing the Liberty server behind a reverse proxy or WAF that enforces request size limits and rate limiting to blunt the crafted-request memory blow-up, and restrict network access to the affected ports to trusted sources; note these controls only slow an attacker and do not eliminate the underlying unbounded allocation. Additionally, set conservative JVM heap limits and monitor for OutOfMemory conditions so an exploitation attempt degrades gracefully and is alerted on rather than silently exhausting the host.