Executive brief
IBM WebSphere Application Server is a Java-based middleware platform used to run mission-critical enterprise applications. An attacker can send specially crafted HTTP requests that exploit improper parsing of the transfer-encoding header, allowing them to poison web caches, bypass firewalls, and inject malicious content that targets end users. This could lead to data theft, defacement, or credential compromise.
Technical details
CVE-2026-15634 is an HTTP request smuggling vulnerability (CWE-444) in IBM WebSphere Application Server and WebSphere Liberty, caused by inconsistent parsing of the HTTP transfer-encoding request header. An attacker can craft a malicious HTTP request with a specially formed transfer-encoding header that is interpreted differently by the application server and downstream proxies or caches. The attack is network-accessible and requires no authentication or user interaction. Successful exploitation allows cache poisoning, web application firewall bypass, and cross-site scripting (XSS) attacks. Patches are available: WebSphere AS 9.0.5.29 and 8.5.5.31 or later resolve this issue.
Affected products
- IBM WebSphere Application Server 8.5 prior to 8.5.5.31, 9.0 prior to 9.0.5.29
- IBM WebSphere Application Server - Liberty prior to 9.0.5.29 and 8.5.5.31
Timeline
- 2026-09-14: disclosed