Riskcovery

CVE-2026-8646

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

State
Published
Severity
7.4 High
Published
Jun 22, 2026
Updated
Jun 24, 2026
Reserved
May 14, 2026

Read the record on cve.org

Description

IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowing the attacker to bypass security controls, spoof identity, escalate privilege, and expose sensitive information.

Scores

CVSSScoreVectorSource
3.17.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nibm

Weaknesses

  • CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected Products

ProductVersions
WebSphere Application ServerIBM
  • 9.0.0 through 7.0.2 Interim Fix 035Affected
  • 8.5.0 through 7.0.3 Interim Fix 017Affected
WebSphere Application Server - LibertyIBM
  • 17.0.0.3 through 26.0.0.6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.