CVE-2025-36099: IBM WebSphere Application Server denial of service
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A privileged user could exploit this vulnerability to cause the server to consume memory resources.
Other sources
IBM WebSphere Application Server is vulnerable to a denial of service, caused by sending a specially-crafted request. A privileged user could exploit this vulnerability to cause the server to consume memory resources.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server traditionalto a version that resolves this vulnerability.Fixed in 8.5.5.29 - Upgrade
Upgrade
IBM WebSphere Application Server traditionalto a version that resolves this vulnerability.Fixed in 9.0.5.26 - Upgrade
Upgrade
IBM WebSphere Application Serverto a version that resolves this vulnerability.Patch PH67817
Event History
Frequently Asked Questions
What is the severity of CVE-2025-36099?
CVE-2025-36099 is classified as a denial of service vulnerability.
How do I fix CVE-2025-36099?
To fix CVE-2025-36099, apply the latest security patches provided by IBM for WebSphere Application Server.
Who is affected by CVE-2025-36099?
CVE-2025-36099 affects IBM WebSphere Application Server versions 8.5 and 9.0.
What type of attack does CVE-2025-36099 involve?
CVE-2025-36099 involves a denial of service attack caused by specially-crafted requests.
What are the potential consequences of exploiting CVE-2025-36099?
Exploiting CVE-2025-36099 can lead to excessive memory consumption, causing the server to become unresponsive.