CVE-2026-10841: IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling
Published Sep 16, 2026
·Updated
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling.
Other sources
IBM WebSphere Application Server 8.5, 9.0, and Liberty are vulnerable to HTTP request smuggling.
— IBM
Affected Software
4 affected componentsFixes available
IBM CICS TX Advanced<=10.1
IBM WebSphere Application Server>=8.5.0.0<8.5.5.31
IBM WebSphere Application Server>=9.0.0.0<9.0.5.29
IBM WebSphere Application Server>=17.0.0.3<26.0.0.9
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server traditional 8.5to a version that resolves this vulnerability.Fixed in 8.5.5.31 - Upgrade
Upgrade
IBM WebSphere Application Server traditional 9.0to a version that resolves this vulnerability.Fixed in 9.0.5.29 - Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Fixed in 26.0.0.9
Event History
Sep 16, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Sep 18, 2026
CVE Published
via MITRE·04:06 PM
Data Sourced
via MITRE·04:06 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeaknessAffected Software