Skip to main content

IBM HTTP Server CVE-2026-8856

| EUVDEUVD-2026-31903 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-05-26 ibm GHSA-48g8-mw8p-w6j7
Denial Of Service IBM Http Server
7.7
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.7 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

1
Analysis Generated
Jun 08, 2026 - 09:38 vuln.today

DescriptionCVE.org

IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.

AnalysisAI

Denial of service in IBM HTTP Server 8.5 and 9.0 allows local attackers with write access to server configuration files to crash or render the web server unavailable. The CVSS vector (AV:L/PR:N) indicates a local attack vector with high integrity and availability impact, and no public exploit has been identified at time of analysis. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain local foothold on IHS host
Delivery
Obtain write access to httpd config
Exploit
Inject malicious configuration directive
Execution
Trigger reload or worker respawn
Persist
Crash or hang httpd process
Impact
Web service denial of service
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires local access to the host running IBM HTTP Server 8.5 (≤ Interim Fix 002) or 9.0 AND write permission to at least part of the server configuration - typically httpd.conf, an Include'd fragment, or files under the conf/ directory. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Risk signals are mixed but trend low-to-moderate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A low-privileged local user or compromised service account that has been granted write access to an included httpd.conf fragment (for example, a deployment tool that drops virtual-host snippets) injects a malformed or resource-intensive configuration directive. On the next reload or worker spawn, the httpd process exhausts resources or terminates, taking the web tier offline. …
Remediation Patch available per vendor advisory - apply the fix published by IBM at https://www.ibm.com/support/pages/node/7274065, which supersedes the 8.5.0 Interim Fix 002 baseline for the 8.5 branch and provides a corresponding update for the 9.0 branch (exact fix version should be taken directly from the IBM support page). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all IBM HTTP Server 8.5 and 9.0 instances and assess their criticality and network exposure. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Http Server

View all
CVE-2026-49975 HIGH POC
7.5 Jun 03

Denial of service in Apache HTTP Server 2.4.17 through 2.4.67 (via the bundled mod_http2 module) allows remote unauthent
CVE-2026-21962 CRITICAL
10.0 Jan 20

Oracle HTTP Server and WebLogic Server Proxy Plug-in have a CVSS 10.0 access control vulnerability allowing unauthentica
CVE-2025-23048 CRITICAL POC
9.1 Jul 10

CVE-2025-23048 is an authentication bypass vulnerability in Apache HTTP Server 2.4.35-2.4.63 affecting mod_ssl configura
CVE-2025-58098 HIGH POC
8.3 Dec 05

CVE-2025-58098 is a security vulnerability (CVSS 8.3). High severity vulnerability requiring prompt remediation.
CVE-2026-8855 HIGH
8.1 May 26

Remote code execution and denial of service in IBM HTTP Server 8.5 and 9.0 affects deployments configured with TLS mutua
CVE-2026-8834 HIGH
8.0 May 26

Heap-based buffer overflow in IBM HTTP Server 8.5 and 9.0 allows an attacker already authenticated to the Administration
CVE-2025-3891 HIGH
7.5 Apr 29

A flaw was found in the mod_auth_openidc module for Apache httpd. Rated high severity (CVSS 7.5), this vulnerability is

CVE-2025-49630 HIGH POC
7.5 Jul 10

CVE-2025-49630 is a denial of service vulnerability in Apache HTTP Server versions 2.4.26 through 2.4.63 that can be tri
CVE-2025-53020 HIGH
7.5 Jul 10

CVE-2025-53020 is a late release of memory after effective lifetime vulnerability (use-after-free) in Apache HTTP Server
CVE-2024-42516 HIGH POC
7.5 Jul 10

HTTP response splitting vulnerability in Apache HTTP Server core allows network-based attackers without authentication t
CVE-2024-43204 HIGH
7.5 Jul 10

CVE-2024-43204 is a Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server when mod_proxy is loaded, all
CVE-2024-47252 HIGH POC
7.5 Jul 10

CVE-2024-47252 is a security vulnerability (CVSS 7.5). High severity vulnerability requiring prompt remediation.

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2026-45498 MEDIUM POC
4.0
CVE-2025-26673 HIGH
7.5
CVE-2025-27473 HIGH
7.5
CVE-2025-27469 HIGH
7.5
CVE-2025-26680 HIGH
7.5
CVE-2025-26652 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2014-1761 HIGH POC
7.8
CVE-2011-0609 HIGH POC
7.8
CVE-2013-3163 HIGH POC
8.8
CVE-2014-1776 CRITICAL POC
9.8

Share

CVE-2026-8856 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy