CVE-2026-11722: IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability.
Other sources
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server traditionalto a version that resolves this vulnerability.Fixed in 8.5.5.31 - Upgrade
Upgrade
IBM WebSphere Application Server traditionalto a version that resolves this vulnerability.Fixed in 9.0.5.29 - Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Fixed in 26.0.0.9
Event History
Frequently Asked Questions
Are specific affected versions identified?
No affected version numbers are provided in the available data. Review the IBM support reference for version-specific applicability and remediation guidance.
Does the available information describe exploit prerequisites or temporary mitigations?
No. The data identifies the issue as HTTP request smuggling but does not state attacker access requirements, configuration conditions, or compensating controls.