EUVD-2026-32281
GHSA-crfv-r2fv-7458
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed WebSphere/Liberty endpoint
-
DeliverySend specially-crafted request
-
ExploitTrigger uncontrolled memory allocation
-
ExecutionExhaust server memory resources
-
ImpactDenial of service to legitimate users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to an affected IBM WebSphere Application Server (traditional 9.0 or 8.5) or WebSphere Application Server Liberty (19.0.0.7 through 26.0.0.5) HTTP/application endpoint; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration is identified as required, so default deployments appear exploitable by a remote unauthenticated attacker. The practical limiting factor is that the vulnerability only causes memory-resource exhaustion (A:H; C:N/I:N) - impact is confined to availability/denial of service with no data disclosure or code execution - and CISA SSVC rates it not automatable, implying the attacker must craft a specific request rather than trivially mass-scan. Real-world exposure is bounded by whether the WebSphere instance is reachable from untrusted networks versus behind internal segmentation or a WAF. |
| Impact | Signals here are strongly concordant and point to a genuine but low-urgency availability issue rather than a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, low-complexity, unauthenticated flaw with no confidentiality or integrity impact - only high availability impact, consistent with the CWE-400 uncontrolled resource (memory) consumption described. The high 7.5 is driven entirely by the A:H component; this is a classic DoS-only finding, not remote code execution. Corroborating exploitation signals are weak: EPSS is just 0.04% (14th percentile), the flaw is NOT on CISA KEV, and CISA SSVC records Exploitation: none, Automatable: no, Technical Impact: partial. The SSVC 'partial' technical impact is consistent with a resource-exhaustion DoS (degradation, not full system takeover). No conflicting signals were found - all sources agree this is a real-but-modest-priority DoS. The only minor tension is that a network-facing, unauthenticated, low-complexity bug could in principle be scanned for widely, yet SSVC marks it not automatable, implying the crafted request is non-trivial to generalize. Priority: patch in a normal maintenance cycle, prioritizing internet-exposed WebSphere/Liberty instances; this is not a drop-everything emergency. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends one or more specially-crafted requests to an internet-facing IBM WebSphere Application Server or Liberty endpoint, causing the server to allocate excessive memory per request. Repeating this exhausts heap/memory resources, degrading or crashing the JVM and denying service to legitimate users. No public exploit code has been identified, and CISA SSVC marks the issue as not automatable, so weaponization would require attacker-developed request crafting. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 15, 2026
Memory-resource exhaustion in IBM WebSphere Application Server - traditional 9.0 and 8.5, plus WebSphere Application Server Liberty 19.0.0.7 through 26.0.0.5 - allows a remote, unauthenticated attacker to deny service by sending a specially crafted request (CWE-400, CVSS 7.5, impact confined to Availability:High with no confidentiality or integrity effect). Per the assessed vector AV:N/AC:L/PR:N/UI:N, exploitation requires only network reachability to an affected HTTP/application endpoint, with no authentication, user interaction, or non-default configuration identified, so default deployments appear reachable. Risk is tempered by the signals: no public exploit code and no confirmed active exploitation were identified (not in CISA KEV), EPSS is very low at 0.04% (14th percentile), and CISA SSVC rates exploitation as none with the attack assessed as not automatable, indicating the attacker must hand-craft a specific request rather than mass-scan.
Earlier versions of this analysis (1)
Memory exhaustion in IBM WebSphere Application Server (Liberty 19.0.0.7-26.0.0.5, traditional WAS 8.5 and 9.0) allows an adjacent-network, low-privileged attacker to trigger uncontrolled memory consumption by sending a specially crafted request. The attack requires both network adjacency and high complexity conditions, constraining the realistic threat surface significantly compared to the High availability impact rating. No public exploit code exists and CISA SSVC rates exploitation as 'none' with technical impact classified as 'partial', placing this vulnerability in a lower operational priority tier despite the A:H component impact.
RemediationAI
No fixed version was disclosed in the intelligence provided, so remediation should begin by pulling the version-specific fix pack or interim fix from the IBM advisory at https://www.ibm.com/support/pages/node/7273424 and confirming the installed Liberty or traditional WebSphere build against the listed affected ranges; IBM typically ships both a fix pack and a same-day interim fix, and the interim fix is the faster path for older 8.5/9.0 baselines that cannot be upgraded immediately. Until the patch is applied, the highest-value compensating control is to remove untrusted network reachability: place the WebSphere HTTP/application endpoints behind a reverse proxy or WAF that enforces per-source request-rate and connection limits and oversized-header/body rejection, recognizing that aggressive rate limits can break legitimate high-volume clients and that WAF rules are only generic CWE-400 heuristics without a published request signature. Additional short-term measures are to reduce the JVM maximum heap so exhaustion fails faster and is caught by health checks, enable heap-dump and GC alerting to detect abnormal memory growth, and temporarily restrict the exposed listener ports to trusted source ranges or internal segmentation, with the trade-off that this breaks external clients until the patch lands. Because the flaw is unauthenticated and default-configuration exploitable, do not rely on authentication or admin-console hardening as a mitigation, and note that availability-only impact means post-patch verification should focus on sustained load testing of the previously affected endpoint.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-400, Uncontrolled Resource Consumption: an affected WebSphere HTTP/application request path accepts a crafted input that causes the server to allocate or retain memory without adequate bounds, driving the JVM toward heap pressure, excessive garbage collection, or OutOfMemory conditions. CPE data confirms three affected product branches - cpe:2.3:a:ibm:websphere_application_server with the traditional edition flags and a separate Liberty channel - matching traditional WebSphere Application Server 9.0 and 8.5 alongside WebSphere Application Server Liberty 19.0.0.7 through 26.0.0.5. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with S:U and only A:H affected, the flaw lives in the network-facing request-handling layer rather than in authentication, authorization, or data-processing logic; there is no path to code execution or data disclosure. The SSVC judgment that the issue is not automatable is technically meaningful: the trigger is request-shape specific, so broad automated scanning and opportunistic worm-style propagation are unlikely, and an adversary would generally need to understand the endpoint behavior to reproduce the exhaustion.
Know when Websphere Application Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated crafted request (AV:N/AC:L/PR:N/UI:N) causing memory exhaustion gives availability-only impact (A:H), with no confidentiality or integrity effect and unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
Executive ViewAI
A high-severity availability flaw in IBM WebSphere Application Server traditional 9.0/8.5 and Liberty 19.0.0.7 through 26.0.0.5 could allow remote unauthenticated attackers to exhaust memory and disrupt hosted business services. Because these platforms often underpin customer-facing or internal applications, a successful denial-of-service could cause operational outages, lost productivity, and recovery costs. Leadership should prioritize mitigation planning, though no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include limiting network access to affected WebSphere HTTP/application endpoints, deploying WAF/rate-limiting rules for memory-exhaustion patterns, monitoring memory and thread usage for early DoS detection, and engaging IBM support for workaround guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Websphere Application Server
View allIBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with
IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.
The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Co
Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server (WAS) for z/OS allows
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the sys
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2
Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.1, 7.0 before 7.0.0.27, 8.0, and 8.5 has unknown i
Pre-authentication unsafe deserialization in IBM WebSphere Application Server 9.0 and 8.5 traditional allows remote unau
Unsafe class loading in the ORB (Object Request Broker) component of IBM WebSphere Application Server 8.5, 9.0, and Libe
Remote code execution in IBM WebSphere Application Server 8.5 and 9.0 (traditional) allows an unauthenticated network at
HTTP request smuggling in IBM WebSphere Application Server (traditional 8.5 and 9.0) and WebSphere Liberty (17.0.0.3 thr
Server-side request forgery in IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Serv
Exploit-DB