What is the CVSS score of CVE-2026-9002?

CVE-2026-9002 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-9002?

Yes, a patch is available for CVE-2026-9002. Update the affected software to the latest version immediately.

WebSphere Extreme Scale CVE-2026-9002

EUVD-2026-40379 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-06-30 ibm

GHSA-qh26-gm6x-4qpg

IBM Denial Of Service Websphere Extreme Scale

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Adjacent-only reach (AV:A) and no authentication needed (PR:N); exclusive availability impact (A:H) from JVM crash with no confidentiality or integrity consequence.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 19:51 vuln.today

DescriptionNVD

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 could allow an adjacent attacker to cause a denial of service due to improper validation in the XDF decoder. The application processes deeply nested Protocol Buffers messages and attacker-controlled length prefixes without sufficient bounds checking, which may allow an attacker on the same network to trigger a StackOverflowError or OutOfMemoryError, resulting in a crash of the WebSphere Application Server JVM.

AnalysisAI

Denial of service in IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 allows adjacent unauthenticated attackers to crash the WebSphere Application Server JVM by sending malformed XDF-encoded Protocol Buffers messages to the data grid. The XDF decoder fails to enforce bounds on recursive protobuf message nesting depth and attacker-supplied length prefixes, triggering either a StackOverflowError or OutOfMemoryError that takes down the JVM process. No public exploit has been identified at time of analysis, and IBM has released a patch via their support advisory.

Technical ContextAI

IBM WebSphere Extreme Scale is an enterprise in-memory data grid (eXtreme Scale) product that uses an XDF (eXtreme Data Format) serialization layer built on Protocol Buffers (protobuf) for encoding and transmitting data between grid nodes. CWE-400 (Uncontrolled Resource Consumption) describes the root cause: the XDF decoder neither caps the recursion depth when parsing nested protobuf message structures nor validates attacker-controlled length prefix values against available resources before allocation. Deeply nested messages exhaust the JVM call stack (StackOverflowError), while inflated length prefixes drive unbounded heap allocation (OutOfMemoryError). Both conditions terminate the WebSphere Application Server JVM. The CPE string cpe:2.3:a:ibm:websphere_extreme_scale:*:*:*:*:*:*:*:* confirms the entire 8.6.1.x family is in scope per IBM.

RemediationAI

Apply the vendor-released patch per the IBM support advisory at https://www.ibm.com/support/pages/node/7278346. A patch is confirmed available from IBM, but no exact fixed version number is specified in the available data; consult the advisory directly to determine the target upgrade version before deploying. As compensating controls prior to patching: enforce strict network segmentation so that only trusted grid nodes and authorized clients can reach WebSphere Extreme Scale listener ports, exploiting the AV:A attack vector requirement to eliminate untrusted adjacency. Additionally, JVM tuning measures such as reducing the thread stack size (-Xss flag) may lower StackOverflowError susceptibility, but will not address OutOfMemoryError conditions from length prefix abuse and may introduce application stability trade-offs. Deep packet inspection to filter anomalous protobuf payloads is technically feasible but operationally complex and not recommended as a primary control.