What is the CVSS score of EUVD-2026-31904?

EUVD-2026-31904 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of IBM HTTP Server are affected by EUVD-2026-31904?

IBM HTTP Server 8.5 and 9.0 contain a denial-of-service vulnerability that could disrupt web application availability when the optional mod_mem_cache module is active.. A patch is available.

How to fix or mitigate EUVD-2026-31904?

Within 24 hours: Inventory systems running IBM HTTP Server 8.5 or 9.0 and determine which have mod_mem_cache module loaded. Within 7 days: Apply the vendor-released patch to all affected servers, prioritizing systems with mod_mem_cache enabled. Within 30 days: Complete patch deployment across all identified systems and document remediation.

IBM HTTP Server EUVD-2026-31904

| CVE-2026-8854 HIGH

Expired Pointer Dereference (CWE-825)

2026-05-26 ibm

GHSA-2h2g-6j29-j4fm

Denial Of Service IBM Http Server

7.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (ibm) · only source for this CVE.

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:11 vuln.today

DescriptionCVE.org

IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_mem_cache.

AnalysisAI

Denial of service in IBM HTTP Server 8.5 and 9.0 allows remote unauthenticated attackers to crash or degrade the service when the optional mod_mem_cache module is loaded. The flaw carries a CVSS 7.5 (availability-only impact) and has no public exploit identified at time of analysis, though the SSVC framework rates exploitation as automatable. EPSS probability is very low (0.01%, 3rd percentile), suggesting limited near-term exploitation interest.

Technical ContextAI

IBM HTTP Server is IBM's Apache-based web server commonly bundled with WebSphere Application Server deployments (CPE cpe:2.3:a:ibm:http_server). The issue resides in mod_mem_cache, an optional caching module that stores responses in process memory to accelerate repeat requests. CWE-825 (Expired Pointer Dereference) indicates the root cause is a use-after-free or stale-reference condition - code accessing a memory location after its lifetime has ended - likely triggered by cache eviction or expiry logic in mod_mem_cache, causing the worker process to crash and degrading availability.

RemediationAI

Patch available per vendor advisory - apply the IBM-provided interim fix referenced at https://www.ibm.com/support/pages/node/7274065 for both 8.5 and 9.0 branches (the EUVD record notes 8.5 fixes supersede Interim Fix 002). If patching cannot be performed immediately, the most effective compensating control is to unload mod_mem_cache from httpd.conf (comment out the LoadModule mem_cache_module directive and any CacheEnable mem entries), since the vulnerability is conditional on this optional module - the trade-off is loss of in-memory response caching and a potential increase in backend load and latency for cached resources. Where mod_mem_cache is required, restrict network exposure of the HTTP Server to trusted networks via firewall ACLs or place it behind a reverse proxy/WAF until patching completes.