{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "notes": [ { "category": "summary", "text": "IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by HTTP request smuggling and a denial of service. This affects IBM WebSphere Application Server Liberty with the servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, servlet-6.1, websocket-1.0, websocket-1.1, websocket-2.0, websocket-2.1, or websocket-2.2 feature enabled." } ], "publisher": { "category": "vendor", "contact_details": "$PLACEHOLDER", "name": "IBM", "namespace": "https://www.ibm.com" }, "references": [ { "category": "external", "summary": "Security Bulletin web URL", "url": "https://www.ibm.com/support/pages/node/7276579" }, { "category": "self", "summary": "Canonical link to Security Bulletin CSAF", "url": "https://public.dhe.ibm.com/ibmdl/export/pub/software/websphere/automation/bulletins/7276579.json" } ], "title": "IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities (CVE-2026-8646, CVE-2026-9320, CVE-2026-9071)", "tracking": { "current_release_date": "2026-06-16T12:00:00.000Z", "generator": { "date": "2026-06-16T12:00:00.000Z", "engine": { "name": "IBM WSA CSAF Script Suite (Internal Use Only)", "version": "1.0.0" } }, "id": "7276579", "initial_release_date": "2026-06-16T12:00:00.000Z", "revision_history": [ { "date": "2026-06-16T12:00:00.000Z", "number": "1", "summary": "Initial Publication" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:vrmf/>=26.0.0.1|<=26.0.0.6", "product": { "name": "IBM WebSphere Application Server Liberty 26.0 vers:vrmf/>=26.0.0.1|<=26.0.0.6", "product_id": "CSAFPID-0001" } } ], "name": "26.0", "category": "product_version" }, { "branches": [ { "category": "product_version_range", "name": "vers:vrmf/>=17.0.0.3|<=17.0.0.4", "product": { "name": "IBM WebSphere Application Server Liberty 17.0 vers:vrmf/>=17.0.0.3|<=17.0.0.4", "product_id": "CSAFPID-0002" } } ], "name": "17.0", "category": "product_version" }, { "branches": [ { "category": "product_version_range", "name": "vers:vrmf/>=18.0.0.1|<=18.0.0.4", "product": { "name": "IBM WebSphere Application Server Liberty 18.0 vers:vrmf/>=18.0.0.1|<=18.0.0.4", "product_id": "CSAFPID-0003" } } ], "name": "18.0", "category": "product_version" }, { "branches": [ { "category": "product_version_range", "name": "vers:vrmf/>=19.0.0.1|<=19.0.0.12", "product": { "name": "IBM WebSphere Application Server Liberty 19.0 vers:vrmf/>=19.0.0.1|<=19.0.0.12", "product_id": "CSAFPID-0004" } } ], "name": "19.0", "category": "product_version" }, { "branches": [ { "category": "product_version_range", "name": "vers:vrmf/>=20.0.0.1|<=20.0.0.12", "product": { "name": "IBM WebSphere Application Server Liberty 20.0 vers:vrmf/>=20.0.0.1|<=20.0.0.12", "product_id": "CSAFPID-0005" } } ], "name": "20.0", "category": "product_version" }, { "branches": [ { "category": "product_version_range", "name": "vers:vrmf/>=21.0.0.1|<=21.0.0.12", "product": { "name": "IBM WebSphere Application Server Liberty 21.0 vers:vrmf/>=21.0.0.1|<=21.0.0.12", "product_id": "CSAFPID-0006" } } ], "name": "21.0", "category": "product_version" }, { "branches": [ { "category": "product_version_range", "name": "vers:vrmf/>=22.0.0.1|<=22.0.0.13", "product": { "name": "IBM WebSphere Application Server Liberty 22.0 vers:vrmf/>=22.0.0.1|<=22.0.0.13", "product_id": "CSAFPID-0007" } } ], "name": "22.0", "category": "product_version" }, { "branches": [ { "category": "product_version_range", "name": "vers:vrmf/>=23.0.0.1|<=23.0.0.12", "product": { "name": "IBM WebSphere Application Server Liberty 23.0 vers:vrmf/>=23.0.0.1|<=23.0.0.12", "product_id": "CSAFPID-0008" } } ], "name": "23.0", "category": "product_version" }, { "branches": [ { "category": "product_version_range", "name": "vers:vrmf/>=24.0.0.1|<=24.0.0.12", "product": { "name": "IBM WebSphere Application Server Liberty 24.0 vers:vrmf/>=24.0.0.1|<=24.0.0.12", "product_id": "CSAFPID-0009" } } ], "name": "24.0", "category": "product_version" }, { "branches": [ { "category": "product_version_range", "name": "vers:vrmf/>=25.0.0.1|<=25.0.0.12", "product": { "name": "IBM WebSphere Application Server Liberty 25.0 vers:vrmf/>=25.0.0.1|<=25.0.0.12", "product_id": "CSAFPID-0010" } } ], "name": "25.0", "category": "product_version" }, { "category": "patch_level", "name": "26.0.0.7", "product": { "name": "IBM WebSphere Application Server Liberty 26.0.0.7", "product_id": "CSAFPID-0023" } } ], "category": "product_name", "name": "WebSphere Application Server Liberty" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:vrmf/>=9.0.0.0|<=9.0.5.28", "product": { "name": "IBM WebSphere Application Server 9.0 vers:vrmf/>=9.0.0.0|<=9.0.5.28", "product_id": "CSAFPID-0024" } }, { "category": "patch_level", "name": "9.0.5.29", "product": { "name": "IBM WebSphere Application Server 9.0.5.29", "product_id": "CSAFPID-0026" } } ], "name": "9.0", "category": "product_version" }, { "branches": [ { "category": "product_version_range", "name": "vers:vrmf/>=8.5.0.0|<=8.5.5.29", "product": { "name": "IBM WebSphere Application Server 8.5 vers:vrmf/>=8.5.0.0|<=8.5.5.29", "product_id": "CSAFPID-0027" } }, { "category": "patch_level", "name": "8.5.5.30", "product": { "name": "IBM WebSphere Application Server 8.5.5.30", "product_id": "CSAFPID-0028" } } ], "name": "8.5", "category": "product_version" } ], "category": "product_name", "name": "WebSphere Application Server" } ], "category": "vendor", "name": "IBM" } ], "full_product_names": [ { "name": "servlet-3.1", "product_id": "CSAFPID-0011" }, { "name": "websocket-1.1", "product_id": "CSAFPID-0012" }, { "name": "servlet-6.1", "product_id": "CSAFPID-0013" }, { "name": "websocket-2.2", "product_id": "CSAFPID-0014" }, { "name": "servlet-3.0", "product_id": "CSAFPID-0015" }, { "name": "servlet-6.0", "product_id": "CSAFPID-0016" }, { "name": "servlet-5.0", "product_id": "CSAFPID-0017" }, { "name": "servlet-4.0", "product_id": "CSAFPID-0018" }, { "name": "websocket-2.1", "product_id": "CSAFPID-0019" }, { "name": "websocket-1.0", "product_id": "CSAFPID-0020" }, { "name": "websocket-2.0", "product_id": "CSAFPID-0021" }, { "name": "z/OS", "product_id": "CSAFPID-0029" }, { "name": "Windows", "product_id": "CSAFPID-0030" }, { "name": "AIX", "product_id": "CSAFPID-0031" }, { "name": "Mac OS", "product_id": "CSAFPID-0032" }, { "name": "Linux", "product_id": "CSAFPID-0033" }, { "name": "IBM i", "product_id": "CSAFPID-0034" }, { "name": "PH71631", "product_id": "CSAFPID-0022" }, { "name": "PH71370", "product_id": "CSAFPID-0025" } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-0029", "CSAFPID-0030", "CSAFPID-0031", "CSAFPID-0032", "CSAFPID-0033", "CSAFPID-0034" ], "summary": "Operating Systems" }, { "group_id": "CSAFGID-0002", "product_ids": [ "CSAFPID-0011", "CSAFPID-0012", "CSAFPID-0013", "CSAFPID-0014", "CSAFPID-0015", "CSAFPID-0016", "CSAFPID-0017", "CSAFPID-0018", "CSAFPID-0019", "CSAFPID-0020", "CSAFPID-0021" ], "summary": "IBM WebSphere Application Server Liberty Features" }, { "group_id": "CSAFGID-0003", "product_ids": [ "CSAFPID-0022", "CSAFPID-0025" ], "summary": "Security Bulletin APARs" } ], "relationships": [ { "category": "installed_on", "full_product_name": { "name": "IBM WebSphere Application Server Liberty 26.0 APAR Remediation Action", "product_id": "CSAFPID-0035" }, "product_reference": "CSAFPID-0022", "relates_to_product_reference": "CSAFPID-0001" }, { "category": "installed_on", "full_product_name": { "name": "IBM WebSphere Application Server Liberty 17.0 APAR Remediation Action", "product_id": "CSAFPID-0036" }, "product_reference": "CSAFPID-0022", "relates_to_product_reference": "CSAFPID-0002" }, { "category": "installed_on", "full_product_name": { "name": "IBM WebSphere Application Server Liberty 18.0 APAR Remediation Action", "product_id": "CSAFPID-0037" }, "product_reference": "CSAFPID-0022", "relates_to_product_reference": "CSAFPID-0003" }, { "category": "installed_on", "full_product_name": { "name": "IBM WebSphere Application Server Liberty 19.0 APAR Remediation Action", "product_id": "CSAFPID-0038" }, "product_reference": "CSAFPID-0022", "relates_to_product_reference": "CSAFPID-0004" }, { "category": "installed_on", "full_product_name": { "name": "IBM WebSphere Application Server Liberty 20.0 APAR Remediation Action", "product_id": "CSAFPID-0039" }, "product_reference": "CSAFPID-0022", "relates_to_product_reference": "CSAFPID-0005" }, { "category": "installed_on", "full_product_name": { "name": "IBM WebSphere Application Server Liberty 21.0 APAR Remediation Action", "product_id": "CSAFPID-0040" }, "product_reference": "CSAFPID-0022", "relates_to_product_reference": "CSAFPID-0006" }, { "category": "installed_on", "full_product_name": { "name": "IBM WebSphere Application Server Liberty 22.0 APAR Remediation Action", "product_id": "CSAFPID-0041" }, "product_reference": "CSAFPID-0022", "relates_to_product_reference": "CSAFPID-0007" }, { "category": "installed_on", "full_product_name": { "name": "IBM WebSphere Application Server Liberty 23.0 APAR Remediation Action", "product_id": "CSAFPID-0042" }, "product_reference": "CSAFPID-0022", "relates_to_product_reference": "CSAFPID-0008" }, { "category": "installed_on", "full_product_name": { "name": "IBM WebSphere Application Server Liberty 24.0 APAR Remediation Action", "product_id": "CSAFPID-0043" }, "product_reference": "CSAFPID-0022", "relates_to_product_reference": "CSAFPID-0009" }, { "category": "installed_on", "full_product_name": { "name": "IBM WebSphere Application Server Liberty 25.0 APAR Remediation Action", "product_id": "CSAFPID-0044" }, "product_reference": "CSAFPID-0022", "relates_to_product_reference": "CSAFPID-0010" }, { "category": "installed_on", "full_product_name": { "name": "IBM WebSphere Application Server 9.0 APAR Remediation Action", "product_id": "CSAFPID-0045" }, "product_reference": "CSAFPID-0025", "relates_to_product_reference": "CSAFPID-0024" }, { "category": "installed_on", "full_product_name": { "name": "IBM WebSphere Application Server 8.5 APAR Remediation Action", "product_id": "CSAFPID-0046" }, "product_reference": "CSAFPID-0025", "relates_to_product_reference": "CSAFPID-0027" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-9071", "notes": [ { "category": "description", "text": "IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources." } ], "product_status": { "fixed": [ "CSAFPID-0026", "CSAFPID-0028", "CSAFPID-0023" ], "known_affected": [ "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0002", "CSAFPID-0001", "CSAFPID-0007", "CSAFPID-0003", "CSAFPID-0008", "CSAFPID-0009", "CSAFPID-0027", "CSAFPID-0010", "CSAFPID-0004", "CSAFPID-0024" ] }, "references": [ { "category": "external", "summary": "Complete CVSS v3 Guide", "url": "https://www.first.org/cvss/user-guide" }, { "category": "external", "summary": "On-line Calculator v3", "url": "https://www.first.org/cvss/calculator/3.0" }, { "category": "external", "summary": "Complete CVSS v4 Guide", "url": "https://www.first.org/cvss/user-guide" }, { "category": "external", "summary": "On-line Calculator v4", "url": "https://www.first.org/cvss/calculator/4.0" } ], "remediations": [ { "category": "vendor_fix", "details": "Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH71631", "product_ids": [ "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0007", "CSAFPID-0008", "CSAFPID-0004", "CSAFPID-0009", "CSAFPID-0001", "CSAFPID-0010" ] }, { "category": "vendor_fix", "details": "Apply Fix Pack 26.0.0.7 or later (targeted availability 3Q2026).", "product_ids": [ "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0007", "CSAFPID-0008", "CSAFPID-0004", "CSAFPID-0009", "CSAFPID-0001", "CSAFPID-0010" ] }, { "category": "vendor_fix", "details": "Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH71370", "product_ids": [ "CSAFPID-0027", "CSAFPID-0024" ] }, { "category": "vendor_fix", "details": "Apply Fix Pack 9.0.5.29 or later (targeted availability 3Q2026).", "product_ids": [ "CSAFPID-0024" ] }, { "category": "vendor_fix", "details": "Apply Fix Pack 8.5.5.30 or later (targeted availability 3Q2026).", "product_ids": [ "CSAFPID-0027" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0002", "CSAFPID-0001", "CSAFPID-0007", "CSAFPID-0003", "CSAFPID-0008", "CSAFPID-0009", "CSAFPID-0027", "CSAFPID-0010", "CSAFPID-0004", "CSAFPID-0024" ] } ] }, { "cve": "CVE-2026-9320", "notes": [ { "category": "description", "text": "IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources." } ], "product_status": { "fixed": [ "CSAFPID-0026", "CSAFPID-0028", "CSAFPID-0023" ], "known_affected": [ "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0002", "CSAFPID-0001", "CSAFPID-0007", "CSAFPID-0003", "CSAFPID-0008", "CSAFPID-0009", "CSAFPID-0027", "CSAFPID-0010", "CSAFPID-0004", "CSAFPID-0024" ] }, "references": [ { "category": "external", "summary": "Complete CVSS v3 Guide", "url": "https://www.first.org/cvss/user-guide" }, { "category": "external", "summary": "On-line Calculator v3", "url": "https://www.first.org/cvss/calculator/3.0" }, { "category": "external", "summary": "Complete CVSS v4 Guide", "url": "https://www.first.org/cvss/user-guide" }, { "category": "external", "summary": "On-line Calculator v4", "url": "https://www.first.org/cvss/calculator/4.0" } ], "remediations": [ { "category": "vendor_fix", "details": "Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH71631", "product_ids": [ "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0007", "CSAFPID-0008", "CSAFPID-0004", "CSAFPID-0009", "CSAFPID-0001", "CSAFPID-0010" ] }, { "category": "vendor_fix", "details": "Apply Fix Pack 26.0.0.7 or later (targeted availability 3Q2026).", "product_ids": [ "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0007", "CSAFPID-0008", "CSAFPID-0004", "CSAFPID-0009", "CSAFPID-0001", "CSAFPID-0010" ] }, { "category": "vendor_fix", "details": "Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH71370", "product_ids": [ "CSAFPID-0027", "CSAFPID-0024" ] }, { "category": "vendor_fix", "details": "Apply Fix Pack 9.0.5.29 or later (targeted availability 3Q2026).", "product_ids": [ "CSAFPID-0024" ] }, { "category": "vendor_fix", "details": "Apply Fix Pack 8.5.5.30 or later (targeted availability 3Q2026).", "product_ids": [ "CSAFPID-0027" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0002", "CSAFPID-0001", "CSAFPID-0007", "CSAFPID-0003", "CSAFPID-0008", "CSAFPID-0009", "CSAFPID-0027", "CSAFPID-0010", "CSAFPID-0004", "CSAFPID-0024" ] } ] }, { "cve": "CVE-2026-8646", "notes": [ { "category": "description", "text": "IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowing the attacker to bypass security controls, spoof identity, escalate privilege, and expose sensitive information." } ], "product_status": { "fixed": [ "CSAFPID-0026", "CSAFPID-0028", "CSAFPID-0023" ], "known_affected": [ "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0002", "CSAFPID-0001", "CSAFPID-0007", "CSAFPID-0003", "CSAFPID-0008", "CSAFPID-0009", "CSAFPID-0027", "CSAFPID-0010", "CSAFPID-0004", "CSAFPID-0024" ] }, "references": [ { "category": "external", "summary": "Complete CVSS v3 Guide", "url": "https://www.first.org/cvss/user-guide" }, { "category": "external", "summary": "On-line Calculator v3", "url": "https://www.first.org/cvss/calculator/3.0" }, { "category": "external", "summary": "Complete CVSS v4 Guide", "url": "https://www.first.org/cvss/user-guide" }, { "category": "external", "summary": "On-line Calculator v4", "url": "https://www.first.org/cvss/calculator/4.0" } ], "remediations": [ { "category": "vendor_fix", "details": "Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH71631", "product_ids": [ "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0007", "CSAFPID-0008", "CSAFPID-0004", "CSAFPID-0009", "CSAFPID-0001", "CSAFPID-0010" ] }, { "category": "vendor_fix", "details": "Apply Fix Pack 26.0.0.7 or later (targeted availability 3Q2026).", "product_ids": [ "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0007", "CSAFPID-0008", "CSAFPID-0004", "CSAFPID-0009", "CSAFPID-0001", "CSAFPID-0010" ] }, { "category": "vendor_fix", "details": "Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH71370", "product_ids": [ "CSAFPID-0027", "CSAFPID-0024" ] }, { "category": "vendor_fix", "details": "Apply Fix Pack 9.0.5.29 or later (targeted availability 3Q2026).", "product_ids": [ "CSAFPID-0024" ] }, { "category": "vendor_fix", "details": "Apply Fix Pack 8.5.5.30 or later (targeted availability 3Q2026).", "product_ids": [ "CSAFPID-0027" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0002", "CSAFPID-0001", "CSAFPID-0007", "CSAFPID-0003", "CSAFPID-0008", "CSAFPID-0009", "CSAFPID-0027", "CSAFPID-0010", "CSAFPID-0004", "CSAFPID-0024" ] } ] } ] }