WebSphere Liberty EUVD-2026-51147

No special conditions - remote unauthenticated exploitation against reachable WebSphere Application Server Liberty instances (AV:N/AC:L/PR:N/UI:N). The only prerequisite stated in the CVE is the ability to send a specially crafted request that triggers excessive memory allocation. Practical exploitation is limited to Liberty instances in the 17.0.0.3-26.0.0.7 range whose vulnerable request-handling endpoint is network-reachable; instances fronted by proxies that enforce strict request validation, size caps, or rate limiting, or that are not internet-exposed, present a smaller realistic attack surface.

The CVSS base score is 7.5 with vector AV:N/AC:L/PR:N/UI:N - network vector, low complexity, no privileges, no user interaction - which makes exploitation trivial to attempt against exposed servers. However, the provided vector encodes impact as C:H/I:N/A:N (confidentiality), which directly conflicts with the description of a memory-exhaustion denial of service; a DoS should be scored A:H/C:N. This inconsistency should be verified with IBM's advisory, and I have independently reassessed the vector as an availability impact. No EPSS probability, POC, or CISA KEV signal was supplied, so there is no evidence of active exploitation - real-world urgency rests on internet exposure of the Liberty instance rather than confirmed attacks. For internet-facing Liberty servers this is a genuine patch priority because the barrier to attempt is near zero; for internal-only deployments the practical risk is lower.

An attacker locates an internet-exposed WebSphere Liberty endpoint and sends one specially crafted HTTP request that triggers the unbounded memory allocation, spiking heap usage. Repeating the request drives the JVM toward OutOfMemory, causing the server to stop responding and denying service to legitimate users. No authentication is required and no public exploit code has been identified, but the low attack complexity makes weaponization straightforward.