Executive brief
IBM HTTP Server, a web server component used with WebSphere Application Server, is affected by a security flaw that could allow an authorized user to take control of the server. A user who already has access to the Administration Server could trigger a system crash or execute unauthorized commands. This could lead to a total service outage or the compromise of sensitive data handled by the web server.
Technical details
A heap-based buffer overflow (CWE-122) exists in IBM HTTP Server versions 8.5 and 9.0. The vulnerability is located within the Administration Server component. An attacker must be a privileged user and authenticated to the Administration Server to exploit this flaw. Successful exploitation allows for remote code execution or a denial of service (system crash). The attack vector is classified as 'Adjacent,' implying the attacker must be on the same local network or subnet as the administration interface. IBM has released interim fixes (APAR PH71265) and plans to include permanent fixes in Fix Packs 9.0.5.29 and 8.5.5.30.
Affected products
- IBM HTTP Server 8.5.0.0 through 8.5.5.29, 9.0.0.0 through 9.0.5.28
Timeline
- 2026-05-26: advisory: Initial publication of IBM security bulletin
- 2026-05-26: disclosed