What is the CVSS score of CVE-2026-16192?

CVE-2026-16192 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

IBM WebSphere Liberty CVE-2026-16192

EUVD-2026-50015 MEDIUM

Uncontrolled Recursion (CWE-674)

2026-07-28 psirt@us.ibm.com

GHSA-7xqp-2vgx-pcr5

Denial Of Service IBM Websphere Application Server

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (us) PRIMARY

HIGH

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.1 HIGH

Requires low-privilege network access; recursion causes high availability impact, with low confidentiality impact from potential information leakage.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (us).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Aug 03, 2026 - 14:52 NVD

HIGH MEDIUM

CVSS changed

Aug 03, 2026 - 14:52 NVD

7.1 (HIGH) 6.5 (MEDIUM)

Analysis Generated

Jul 28, 2026 - 20:31 vuln.today

CVE Published

Jul 28, 2026 - 20:17 nvd

HIGH 7.1

DescriptionNVD

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled.

AnalysisAI

Denial of service in IBM WebSphere Liberty 17.0.0.3 through 26.0.0.8 when the restConnector-2.0 feature is enabled, allowing authenticated remote attackers with low privileges to exhaust server resources via uncontrolled recursion (CWE-674). The attack does not require user interaction and can be conducted over the network, resulting in high availability impact and potential partial confidentiality disclosure. No public exploit or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The vulnerability lies in the Liberty profile's REST connector (restConnector-2.0) which handles HTTP-based REST requests within the WebSphere Application Server Liberty runtime (Java application server). The flaw is classified as CWE-674 (Uncontrolled Recursion), indicating that a recursive function or process fails to properly terminate, leading to stack exhaustion or resource depletion when processing specially crafted input. This aligns with the conditions described: enabling the restConnector-2.0 feature introduces the vulnerable code path.

RemediationAI

Update to a non‑vulnerable version of IBM WebSphere Application Server Liberty. IBM has released a fix; refer to the support page https://www.ibm.com/support/pages/node/7281648 for exact patch versions and interim fix details. As an immediate mitigation, disable the restConnector-2.0 feature if it is not required for your application, noting that this will remove any REST endpoints that depend on that connector, potentially impacting legitimate functionality. Ensure that network access to the REST API is restricted to trusted users and that authentication is enforced.