CVE-2026-103499: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.
Other sources
IBM WebSphere Application Server Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Fixed in 26.0.0.11 - Upgrade
Upgrade
IBM WebSphere Application Server traditionalto a version that resolves this vulnerability.Fixed in 8.5.5.32 - Upgrade
Upgrade
IBM WebSphere Application Server traditionalto a version that resolves this vulnerability.Fixed in 9.0.5.30 - Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Patch DT502943 - Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Patch DT502944
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker can exploit it without authentication or user interaction. The attack requires network access to a vulnerable WebSphere Application Server or WebSphere Application Server Liberty deployment.
What is the impact of successful exploitation?
Successful exploitation can cause denial of service through uncontrolled resource consumption. The provided information does not indicate confidentiality or integrity impact.
Which versions are identified as affected?
WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is identified as affected. WebSphere Application Server 8.5 and 9.0 Liberty are also listed, without more specific affected version ranges.