Executive brief
IBM WebSphere Application Server is a platform used to host and run enterprise Java applications. A security flaw in how the server handles web traffic could allow an attacker to 'smuggle' hidden requests past security filters. This could lead to unauthorized access to sensitive data or the ability to bypass security controls by interfering with how the server processes multiple user requests.
Technical details
IBM WebSphere Application Server (Traditional and Liberty) is vulnerable to HTTP request smuggling (CWE-444). The vulnerability exists when servlet features (3.0 through 6.1) are enabled, allowing an attacker to send a specially crafted request that is interpreted differently by front-end proxies and back-end servers. This can be exploited over the network without authentication, though it requires specific timing or environmental conditions (AC:H). Successful exploitation can lead to sensitive information disclosure or unauthorized modification of data. IBM has released interim fixes (APAR PH72191 and PH72192) and plans to include permanent fixes in upcoming Fix Packs (26.0.0.8, 9.0.5.29, and 8.5.5.31).
Affected products
- IBM WebSphere Application Server 9.0.0.0 - 9.0.5.28, 8.5.0.0 - 8.5.5.30
- IBM WebSphere Application Server - Liberty 17.0.0.3 - 26.0.0.7
Timeline
- 2026-07-28: advisory: Initial publication by IBM
- 2026-07-28: disclosed