EUVD-2026-50020
GHSA-f3v3-mj3c-p68c
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network vector with no auth required (PR:N), but AC:H reflects mandatory proxy-parsing differential; full C/I/A impact from session poisoning is credible.
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP request smuggling.
AnalysisAI
HTTP request smuggling in IBM WebSphere Application Server (versions 8.5 and 9.0) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) enables remote unauthenticated attackers to poison shared HTTP connections between a front-end proxy and the application server backend. The CVSS 8.1 score reflects full confidentiality, integrity, and availability impact (C:H/I:H/A:H) but is constrained by high attack complexity (AC:H), requiring a specific proxy-to-WAS pipeline configuration to exploit. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation is contingent on IBM WebSphere Application Server (8.5 or 9.0) or WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) being deployed behind a front-end HTTP proxy, load balancer, or CDN that parses HTTP/1.1 request headers differently from the WAS backend - this proxy-fronted architecture is the structural prerequisite for any request smuggling attack and is reflected in the SSVC 'Automatable: no' rating. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.1 with AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H signals severe theoretical impact but significantly constrained exploitation probability due to high attack complexity - the attacker must identify and exploit a parsing differential specific to the proxy-WAS pairing in use. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has identified that a target organization's IBM WebSphere instance sits behind an HTTP reverse proxy sends a specially crafted request with conflicting Content-Length and Transfer-Encoding headers, exploiting the parsing differential between the proxy and the WAS HTTP engine. The smuggled request suffix is treated by WebSphere as the beginning of a subsequent legitimate user's request, potentially allowing the attacker to read another user's response data, inject malicious content into their session, or trigger unauthorized actions. … |
| Remediation | The primary fix is the vendor-released patch documented in IBM's advisory at https://www.ibm.com/support/pages/node/7281625; administrators should consult this page directly for the exact iFix or Fix Pack version applicable to their WebSphere or Liberty release, as the specific fix version is not independently confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all IBM WebSphere Application Server instances across versions 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.7, and identify which systems are deployed behind HTTP reverse proxies-prioritizing those handling authentication or sensitive transactions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Websphere Application Server
View allIBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with
IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.
The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Co
Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server (WAS) for z/OS allows
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the sys
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2
Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.1, 7.0 before 7.0.0.27, 8.0, and 8.5 has unknown i
Pre-authentication unsafe deserialization in IBM WebSphere Application Server 9.0 and 8.5 traditional allows remote unau
Unsafe class loading in the ORB (Object Request Broker) component of IBM WebSphere Application Server 8.5, 9.0, and Libe
Remote code execution in IBM WebSphere Application Server 8.5 and 9.0 (traditional) allows an unauthenticated network at
HTTP request smuggling in IBM WebSphere Application Server (traditional 8.5 and 9.0) and WebSphere Liberty (17.0.0.3 thr
Server-side request forgery in IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Serv
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Request Smuggling
View allShare
External POC / Exploit Code
Leaving vuln.today