CVE-2026-105442: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.
Other sources
IBM WebSphere Application Server Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Fixed in 26.0.0.11 - Upgrade
Upgrade
IBM WebSphere Application Server traditional 8.5to a version that resolves this vulnerability.Fixed in 8.5.5.32 - Upgrade
Upgrade
IBM WebSphere Application Server traditional 9.0to a version that resolves this vulnerability.Fixed in 9.0.5.30 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch DT503624 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch DT503516
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
IBM WebSphere Application Server 8.5 and 9.0 are listed as affected. WebSphere Application Server Liberty is listed as affected from 17.0.0.3 through 26.0.0.10.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction.
What is the expected impact of a successful attack?
The reported impact is denial of service in the messaging service. The supplied vector indicates availability impact, with no stated confidentiality or integrity impact.